SBOM & Compliance
Signed SBOMs As Procurement Leverage
Unsigned SBOMs are paperwork. Signed SBOMs with in-toto attestations are leverage. Here is how mature procurement programmes use signing to harden vendor relationships.
Feb 27, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSBOM & Compliance
SBOM requirements for financial services under DORA
DORA now requires EU financial entities to track every software component down to the dependency level. Here's what the SBOM requirements actually mean.
Jan 5, 20267 min read
SBOM & Compliance
Software bill of materials expectations from banking regu...
FFIEC and OCC examiners now expect banks to show software transparency. Here's what SBOM banking regulators actually ask for, and how to be ready before the next exam.
Jan 4, 20267 min read
SBOM & Compliance
FDA SBOM requirements under Section 524B for medical devi...
What Section 524B means for medical device makers: FDA SBOM requirements, premarket cybersecurity guidance, and how to avoid a Refuse to Accept letter.
Jan 2, 20267 min read
SBOM & Compliance
SBOM requirements under DoD software supply chain risk ma...
A practical breakdown of DoD SBOM requirements — where they came from, how Software Fast Track enforces them, and what happens when contractors can't produce one.
Dec 27, 20257 min read
SBOM & Compliance
Fulcio Certificate Lifecycle: Enterprise View
Fulcio issues short-lived certificates for keyless signing. Here is the enterprise view of how those certificates are issued, validated, and woven into long-term trust.
Dec 22, 20247 min read
SBOM & Compliance
Java SBOM Generation Tools Compared
Six tools generate SBOMs from Java projects. They disagree on transitive depth, license fields, and licensing of their own output. A head-to-head.
Dec 5, 20245 min read
SBOM & Compliance
Provenance Attestation Consumer Workflow
Generating provenance is half the story. Consuming it correctly, at the right points in the pipeline, is where the security value actually materialises.
Nov 20, 20247 min read
SBOM & Compliance
SBOM Quality Benchmarking: What We Found in 2024
We scored 1,200 production SBOMs in 2024 across CycloneDX and SPDX. The quality distribution is worse than advertised and we have the numbers.
Nov 8, 20245 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.