Product
Regenerate the SBOM for an old release an agency still runs
Rebuild an SBOM for a two-year-old release from its tag, lockfile or archived image, label how it was made, and say if the new KEV entry affects it.
Oct 25, 202639 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedProduct
Patch Dependencies in a 24x7 Clinical Service With Three SREs
A small SRE team keeps an always-on clinical service patched by splitting routine and emergency paths, batching upgrades, canarying and tracking patch lag.
Oct 25, 202639 min read
Product
On-call runbook: a critical CVE in your production base image
Paged at night for a critical CVE in a base image? Confirm exploitation, find every affected workload, rebuild or mitigate, verify, and hand over cleanly.
Oct 25, 202639 min read
Product
Agent Identity in Safeguard: Which AI Agent Holds What Access
Safeguard's agent identity (GA) shows which AI agent holds what access, at what level, across your Safeguard tenant, your laptops and your MCP servers.
Oct 25, 202639 min read
Product
Measuring Zero-Day Readiness: Time to Know, Mitigate and Patch
Track three clocks per affected asset: time to know you are affected, time to cut exposure and time to run the fix. Define, baseline and shrink each one.
Oct 25, 202638 min read
Product
Zero-Day Risk in AI Agents, MCP Servers and Skills: A Defender's Guide
A zero-day in an agent stack reaches whatever the agent can touch. Inventory agents, MCP servers and skills, cut standing access, and gate fixes fast.
Oct 25, 202638 min read
Product
Zero-days and the CRA 24-hour early warning: a manufacturer workflow
Since 11 September 2026, CRA Article 14 gives manufacturers 24 hours to warn of an exploited flaw. An hour-by-hour workflow, and where Safeguard fits.
Oct 25, 202637 min read
Product
Coordinated Vulnerability Disclosure: CNAs, CVE IDs, Embargoes, 90 Days
How coordinated disclosure works: who assigns CVE IDs, the 72 hour CNA rules, how embargoes hold, and where 90+30, 45 and 7 day deadlines come from.
Oct 25, 202638 min read
Product
Exploited zero-days 2024 to 2026: what GTIG and Project Zero data shows
GTIG tracked 90 exploited zero-days in 2025, 48% in enterprise tech. What GTIG and Project Zero data says on vendors, product types and timing.
Oct 25, 202638 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.