Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Browser and IDE extensions run with the trust of the host app. Why attackers use them for persistence and how to control which ones get installed.
Hidden payloads must be decoded before they run. How certutil, copy /b, base64 and friends show up in logs, and how to catch the decoding step.
WLL, XLL, COM, VSTO and VBA add-ins all run code at Office startup. How to spot a malicious one and how to restrict add-ins to signed, approved ones.
Outlook rules sort mail, but a hostile one can launch a program when a crafted email arrives. How to audit rules, what logs show, and how to block it.
Outlook can load a web page whenever a folder opens, and a crafted page can run code. How the legacy feature is abused and how to spot and block it.
A custom Outlook form planted in a mailbox can run code when a crafted email arrives. What it looks like, which patches matter and how to spot it.
A little-known Office Test registry key loads any DLL when Word or Excel starts. It does not exist by default, so its presence is a strong signal.
A macro hidden in Normal.dotm or PERSONAL.XLSB runs every time Word or Excel starts. Where those files live, how GlobalDotName is abused, and how to block it.
Templates, add-ins, Outlook rules, forms and home pages can all run code when Office starts. A guide to the six methods, what to log and which settings to harden.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
