Supply Chain
A two-week SBOM proof of concept plan, day by day
A practical two-week plan for an SBOM proof of concept: scope, test repos, success criteria, stakeholders and the decision meeting at the end.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
SBOM platform questions on storage, retention and sharing
Questions for an SBOM platform on storage, retention, access control and sharing with customers, so your inventory stays useful and under your control.
Oct 18, 20263 min read
Supply Chain
Should you reject a bad SBOM or accept it with warnings?
Define four intake outcomes for supplier SBOMs (accept, accept with warnings, quarantine, reject) so bad files never silently shape your risk numbers.
Oct 18, 20263 min read
Supply Chain
SBOM generator or vulnerability scanner: which do you need?
An SBOM lists what is in your software. A scanner judges risk. Learn which one you need first, why most teams need both, and what to check in each.
Oct 18, 20263 min read
Supply Chain
SBOM generation or ingestion: which capability are you buying?
Producers need to generate SBOMs, consumers need to ingest and analyze them. Learn which side you are on before you compare SBOM tools or write an RFP.
Oct 18, 20263 min read
Supply Chain
What to put in an SBOM for a shipped desktop or mobile app
An app SBOM should list what is inside the installer, not only what the repo declares: bundled runtimes, native libraries and SDKs, per release.
Oct 18, 20263 min read
Supply Chain
What does an SBOM mean for a SaaS product an agency uses?
For SaaS, OMB M-26-05 points agencies to an SBOM of the runtime production environment. What CISA says is hard about SaaS SBOMs and how to answer.
Oct 18, 20263 min read
Supply Chain
The SBOM distributor role: who holds SBOMs without making or reading them
CISA's sharing documents added an SBOM distributor role for those who neither author nor use SBOMs. Who counts, what they consider and where hubs fit.
Oct 18, 20263 min read
Supply Chain
Which changes in an SBOM diff should trigger a security review?
Not every SBOM diff needs a person. These seven change types, from new components to supplier swaps, are the ones worth routing to a security reviewer.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.