Product
A Critical Vendor Failed Our Review at Renewal. What Now?
When a vendor you cannot replace fails review at renewal: write dated fixes into the contract, add your own controls, monitor, plan an exit, record acceptance.
Oct 25, 202638 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedProduct
Vet your suppliers' components before you re-attest to a federal agency
Before a federal re-attestation, inventory every third-party component, get supplier SBOMs, judge open source by policy and keep dated proof per product.
Oct 25, 202638 min read
Product
Our core software vendor was acquired: what to re-check, and how fast
After a core software vendor is acquired, re-check ownership, hosting, team, support and SBOM within 30 days, then monitor it closely through year one.
Oct 25, 202638 min read
Product
Your Service Is on the Affected List: A Developer's Patch Checklist
On the CVE affected list? Trace how the package gets in, pick the fixed version or an override, rescan the rebuilt artifact and write a PR that proves it.
Oct 25, 202641 min read
Product
Regenerate the SBOM for an old release an agency still runs
Rebuild an SBOM for a two-year-old release from its tag, lockfile or archived image, label how it was made, and say if the new KEV entry affects it.
Oct 25, 202639 min read
Product
Patch Dependencies in a 24x7 Clinical Service With Three SREs
A small SRE team keeps an always-on clinical service patched by splitting routine and emergency paths, batching upgrades, canarying and tracking patch lag.
Oct 25, 202639 min read
Product
On-call runbook: a critical CVE in your production base image
Paged at night for a critical CVE in a base image? Confirm exploitation, find every affected workload, rebuild or mitigate, verify, and hand over cleanly.
Oct 25, 202639 min read
Product
Agent Identity in Safeguard: Which AI Agent Holds What Access
Safeguard's agent identity (GA) shows which AI agent holds what access, at what level, across your Safeguard tenant, your laptops and your MCP servers.
Oct 25, 202639 min read
Product
Measuring Zero-Day Readiness: Time to Know, Mitigate and Patch
Track three clocks per affected asset: time to know you are affected, time to cut exposure and time to run the fix. Define, baseline and shrink each one.
Oct 25, 202638 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.