Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
DNS records and passive DNS archives show subdomains, mail servers and hosts. Here is what T1596.001 means and how to review what your DNS gives away.
Public records of your domains, certificates and scan results are free for anyone to search. A defender's look at T1596 and how to review what you have published.
Wordlist scanning guesses page names, folders and bucket names to find what you forgot you published. Here is how to spot it and what to remove.
Adversaries scan for software versions that match a known exploit. Here is how T1595.002 works at a high level and how to find your own exposed, outdated components first.
Scanning IP blocks tells an adversary which of your addresses are alive and what runs on them. This guide covers what T1595.001 means and how to keep the answer dull.
Active scanning is the noisy first step of many intrusions. Here is what MITRE ATT&CK says about T1595, what you can realistically detect, and how to shrink what a scan finds.
Your own website is a source of staff names, locations, and hidden paths. What MITRE documents, what to look for in web logs, and how to audit your site.
Public repositories can reveal languages, libraries, staff names, and leaked keys. What MITRE documents, and the audit and developer guidance it recommends.
Specialized search queries can surface leaked network details or credentials. What MITRE documents and a routine for checking your own exposure.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
