Inventory Every Dependency, Image, Model, and Server
You cannot secure what you cannot see. Continuous discovery of every software component, container layer, AI model, and MCP server across the estate — with a queryable SBOM/AI-BOM graph your entire security program can build on.
The Inventory Gap Nobody Admits
Most organisations can't answer “what runs in production?” without two weeks of meetings.
Shadow Dependencies Accumulate
Dev teams add packages, test frameworks pull in transitives, and experiments leave dependencies behind. Three years later the production image has 400 packages nobody planned for.
AI Models Aren't In The SBOM
Your CycloneDX file tracks jars and npm packages. It rarely tracks the fine-tuned model in /opt/ml, the embedding weights in the vector DB, or the MCP servers giving LLMs production credentials.
Multiple Tools, Conflicting Inventories
SCA, CSPM, vulnerability scanner, cloud inventory, CMDB — each has its own asset list. Reconciliation is a quarterly spreadsheet exercise that nobody trusts.
Runtime Reality Drifts From Declared State
IaC says what should exist. CMDB says what was built. Runtime shows what actually runs. These three agree maybe 60% of the time. The other 40% is the security gap.
Continuous Discovery. Queryable Graph.
Software Bill of Materials
CycloneDX and SPDX SBOMs generated at every build across Maven, npm, PyPI, Cargo, Go modules, RubyGems, NuGet, and container registries.
AI Bill of Materials
Extended AI-BOM format tracks model weights, training data sources, fine-tuning recipes, vector DB indexes, and MCP server inventories alongside software components.
Queryable Asset Graph
Every asset joined with reachability, ownership, version, license, and vulnerability data. Queryable via SQL, API, or natural language via Griffin AI.
An Enterprise Discovers 213 Public npm Packages It Forgot About
A financial services customer thought they published around 40 npm packages to the public registry. Safeguard's asset discovery found 213, eleven of which had been abandoned for years. One of those abandoned packages still contained a hardcoded internal API endpoint. Rotation and takedown happened within the week. Without continuous discovery, the drift would have stayed invisible.
Where This Bites In Real Life
The moments when missing inventory becomes the security incident.
Newly Acquired Subsidiary
Point Safeguard at their GitHub org. Get the full asset inventory — repos, services, dependencies, models — in 24 hours, not 24 weeks.
Shadow IT Surfaces
Production services no one in security knew existed. Cloud accounts billed to a team that no longer exists. They all show up in the graph.
EOL Software Hunt
Every service still pinned to a deprecated framework version, every container still on a base image that stopped getting patches a year ago.
AI Asset Inventory
Every model, prompt, MCP tool, vector store, and fine-tune the company is paying for — listed with owner, cost centre, and policy posture.
How Safeguard Handles It
- 01
Connect SCM & Cloud
GitHub, GitLab, Bitbucket, Azure DevOps, plus cloud accounts and container registries. Read-only by default; least privilege out of the box.
- 02
Auto-Discover
Repos, services, clusters, cloud accounts, model artifacts, and MCP servers enumerated. Eleven scanners run in parallel.
- 03
Build The Dependency Graph
Every asset joined to every other asset it touches — transitive dependencies, base images, model lineage, MCP capability edges.
- 04
Classify By Criticality
Production-facing, customer-facing, regulated-data, and internal-only tiers assigned from signals plus configurable rules.
- 05
Enrich With Ownership
CODEOWNERS, the IDP, and the SSO directory resolve every asset to a person and a team. The 'who owns this?' question stops being a Slack thread.
- 06
Drift Detection On Schedule
Daily diff against the previous inventory snapshot. New assets, removed assets, ownership changes — all surfaced.
- 07
Continuous Inventory Updates
Webhook-driven updates from every connected source. The inventory is never older than the last commit.
What You See, Ship, And Report
Asset Card On Hover
Hover a package, service, or model in your editor. Get the owner, the criticality, the last scan time, and the open findings — pulled straight from the graph.
Discovery Report In The Build
Every build appends a delta: assets added, assets removed, ownership changes. Reviewers see drift before it lands on main.
Org-Wide Map & Shadow IT
The full asset graph, filtered by criticality. RAG status by business unit, plus a dedicated shadow-IT list with last-seen, owner-guess, and a 'reclaim' workflow.
See Every Asset. In One Graph.
Point Safeguard at your repos, registries, and runtime. Get a complete inventory on day one — then keep it current.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.