Supply Chain
SBOM spreadsheet vs platform: eight myths and the facts
Eight common beliefs about tracking SBOMs in spreadsheets or platforms, checked against how the work really goes, with a test you can run for each.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Tracking SBOMs in a spreadsheet: which columns do you need?
Tracking SBOMs in a spreadsheet? Keep the seven NTIA baseline fields plus release, source file, identifier and status columns so a later move is easy.
Oct 19, 20264 min read
Supply Chain
Supplier says the component is fixed but your scan still flags it. Why?
A scan can flag a patched component when the fix kept the version string, or data lags. How to check, what to ask, and how to record the result.
Oct 19, 20264 min read
Supply Chain
SBOM platform exit plan: how do you keep your data portable?
An exit plan for an SBOM platform keeps originals, uses standard formats, tests exports regularly and records what a move needs. Build it before you buy.
Oct 19, 20264 min read
Supply Chain
One SBOM per environment or per release? A decision guide
Generate the SBOM once per build and tie it to the artifact. Add environment snapshots only to catch drift. Here is when each approach fits.
Oct 19, 20263 min read
Supply Chain
Which ownership fields should you add to SBOM records?
Add product, team, owner, environment and criticality to SBOM records so findings reach the right person. The fields and how to keep them current.
Oct 19, 20264 min read
Supply Chain
SBOM or VEX: which should you attach to a customer security review?
An SBOM lists what is in your software, a VEX says whether a known flaw affects it. When to send each in a customer review, and how to keep them current.
Oct 19, 20264 min read
Supply Chain
SBOM governance: who requests, stores and reviews SBOMs?
Using the NTIA minimum elements, here are the SBOM decisions a governance group should settle: frequency, depth, access, delivery and how to fix mistakes.
Oct 19, 20264 min read
Supply Chain
Why should research software ship an SBOM, and which format?
Research software gains from a software bill of materials: it makes later scanning possible. Which formats exist, how to produce one, and what to include.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.