Incident Analysis
CTEM worked example: from exposure alert to verified fix
A constructed walk through one CTEM cycle, from a new exposed service to validation, owner assignment, fix and re-test, with the decision at each step.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIncident Analysis
AIDR worked example: an agent alert from detection to resolution
A constructed AIDR case: an AI assistant makes too many lookups after hidden text in a paste. Triage, containment, root cause and the fix that followed.
Oct 18, 20265 min read
Incident Analysis
Agent identity in practice: a constructed alert to resolution walkthrough
A constructed example of an AI agent using access it should not have: detection, attribution, revocation, scoping and the fixes that follow.
Oct 18, 20265 min read
Incident Analysis
xz backdoor timeline: what defenders should learn from it
The xz backdoor, CVE-2024-3094, took over two years to set up and one engineer's curiosity to find. Read the dated timeline and the defender lessons.
Oct 18, 20264 min read
Incident Analysis
xz backdoor: a checklist to test whether your org would catch it
A practical checklist built from the xz backdoor (CVE-2024-3094): tarball vs git checks, behavior monitoring, linked-library inventory and release delays.
Oct 18, 20265 min read
Incident Analysis
What happens if the CVE program stops? A calm explainer
In April 2025 the CVE contract was a day from expiring before CISA extended it. Here is what a lapse would mean and how to keep your work running.
Oct 18, 20264 min read
Incident Analysis
Ukraine power grid attacks: timeline and lessons for defenders
Three documented attacks on Ukrainian power systems (2015, 2016, 2022) and the controls that matter: remote access, inventory, backups and manual fallback.
Oct 18, 20265 min read
Incident Analysis
Ukraine power grid attack of 2015: could your org have caught it?
A practical checklist built from CISA's account of the December 2015 Ukraine grid attack: remote access, credentials, segmentation, firmware and recovery.
Oct 18, 20264 min read
Incident Analysis
What happened in the Uber breach of 2022, and what can defenders learn?
A dated timeline of Uber's September 2022 incident from its own updates: a contractor account, repeated MFA prompts, and fixes defenders can apply today.
Oct 18, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.