Application Security
Detecting MFA Tampering and Fail-Open Bypass (T1556.006)
Attackers who get in may disable MFA or register their own method. Learn how to spot it, audit enrollments and make MFA fail closed.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Auditing Active Directory Reversible Encryption (T1556.005)
Reversible password encryption can let an attacker recover plaintext passwords. Learn how to find affected accounts and turn the setting off.
Oct 18, 20263 min read
Application Security
Detecting Network Device Authentication Backdoors (T1556.004)
A patched device image can accept a hard coded password. See how it works and why MFA via TACACS+ or RADIUS and tight admin access help.
Oct 18, 20262 min read
Application Security
Detecting Pluggable Authentication Module Tampering (T1556.003)
PAM guides login on Linux and macOS. See how a patched module becomes a backdoor or credential harvester and how to verify yours.
Oct 18, 20263 min read
Application Security
Detecting Malicious Password Filter DLLs (T1556.002)
Windows password filters see plaintext passwords during changes. Learn how a rogue filter harvests them and how to audit what is registered.
Oct 18, 20262 min read
Application Security
Detecting Domain Controller Authentication Patching (T1556.001)
A patched LSASS on a domain controller can accept a secret password for any account. See how Skeleton Key style attacks work and how to protect LSA.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Authentication Process Tampering (T1556)
Attackers who change how login works need no stolen password. See the platforms and mechanisms involved and the controls that limit the damage.
Oct 18, 20264 min read
Application Security
Detecting Theft from Cloud Secrets Managers (T1555.006)
AWS Secrets Manager, GCP Secret Manager and Azure Key Vault centralize credentials. Learn how they get read by attackers and how to limit and log access.
Oct 18, 20264 min read
Application Security
Defending Password Managers from Credential Theft (T1555.005)
Password managers are worth using, and worth hardening. Learn how attackers go after master passwords and memory and how to shrink that window.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.