Pass a proctored-style timed exam and earn a publicly verifiable credential.
Validates working knowledge of software supply-chain security and the Safeguard platform: the scan engines and findings-triage workflow, SBOM and VEX, compliance and the Trust Center, and the Gold / CLI / MCP ecosystem. Earned by completing the Safeguard Certified Practitioner course and passing a timed exam of 30 questions drawn from a 60-question pool, 45 minutes, 70% to pass (21 of 30), with a 24-hour retake cooldown; multi-select questions are graded exact-match with no partial credit. Valid for 24 months from issue; certificates are anonymously verifiable at learn.safeguard.sh/cert/(id).
Validates working knowledge of Safeguard's secrets scanning (200+ issuer patterns, entropy analysis, live verification, git-history purge, pre-push hooks, custom patterns) and Eagle malware detection (cross-ecosystem classification and inline/registry/CI/admission enforcement).
Awarded for completing the Software Supply Chain Security Fundamentals course and passing its certification exam.
Awarded for completing the Vulnerability Management and Remediation with Safeguard course and passing its certification exam.
Awarded for completing the SBOM Compliance and Secure CI/CD course and passing its certification exam.
Validates working knowledge of Safeguard's ESSCM product: its scan inputs, the Risk Score and SCAL scoring model, reachability-based vulnerability prioritization, Griffin AI remediation, and the Policies/Gates/Guardrails governance model. Earned by completing the ESSCM course and passing a 30-question timed exam drawn from a 65+ question pool, 30 minutes, 70% to pass, 24-hour retake cooldown.
Validates working knowledge of Safeguard's Portal product: the free entry tier vs the Publish/Share product, the Publish vs Share distinction, Product vs Project vocabulary, Portal's sub-modules, compliance verification (EO 14028/FedRAMP/NTIA), and the Trust Center. Earned by completing the Portal course and passing a 30-question timed exam drawn from a 65+ question pool, 30 minutes, 70% to pass, 24-hour retake cooldown.
Validates working knowledge of software attestation: SLSA build levels, Sigstore keyless signing (Fulcio/Rekor), in-toto attestation chains, X.509/package signatures, and Safeguard's SCAL/LCAL scoring used to gate releases on build integrity rather than just known vulnerabilities.
Validates working knowledge of Safeguard's Data Security Posture Management capability: data classification (PII/PHI/PCI/secrets), the redaction mandate, S3/RDS connector scope, and mapping findings to GDPR/HIPAA/PCI DSS/CCPA.
Validates working knowledge of Safeguard's SecOps/SIEM capability: OCSF ingestion sources, Sigma/IOC detection, alert deduplication, and its relationship to AutoTriage within the unified findings model.
Validates working knowledge of Safeguard's license compliance capability: SPDX-based detection, license risk categories, policy-as-code enforcement, NOTICE generation, and the License category in Autonomous Remediation.
Validates working knowledge of Griffin Remediate's pipeline and modes, and the full Autonomous Remediation category/strategy matrix, including its off-by-default master toggle.
Validates working knowledge of Safeguard's org hierarchy (Tenant/Organization/Project/Version), roles and SSO mapping, the Product-vs-Project vocabulary, and the platform's one-findings-model consolidation story.
Validates working knowledge of Safeguard's TPRM product: the Consumer supply-chain role, Vendor Management, the SBOM Request status pipeline, the 0-100 (higher-is-better) vendor Risk Score, and continuous Monitoring/alerting. Earned by completing the TPRM course and passing a 30-question timed exam drawn from a 65+ question pool, 30 minutes, 70% to pass, 24-hour retake cooldown.
Validates working knowledge of OSM's per-package intelligence (LCAL, malicious-package scanning) and Gold's two offerings: the free public directory at gold.safeguard.sh and the paid Gold Registry of hardened artifacts. Earned by completing the course and passing a 30-question timed exam drawn from a 65+ question pool, 30 minutes, 70% to pass, 24-hour retake cooldown.
Validates working knowledge of Safeguard's AI security surface: its own purpose-built models (Griffin/Eagle/Lion), configurable AI modes and privacy posture, AI-BOM/AI-SPM/model scanning, the AI Gateway and MCP Guardrail, and agent-native operation (MCP server, agent identity, autonomous agent, agentic procurement). Earned by completing the course and passing a 30-question timed exam drawn from a 65+ question pool, 30 minutes, 70% to pass, 24-hour retake cooldown.
Validates working knowledge of Safeguard's Compliance and GRC suite: its eleven app tabs, continuous evidence mapping powered by Lino, and standards coverage including EO 14028, NIST SSDF, SLSA, and VEX. Earned by completing the course and passing a 30-question timed exam drawn from a 65+ question pool, 30 minutes, 70% to pass, 24-hour retake cooldown.
Validates working knowledge of Safeguard's application security testing engines: first-party SAST (dataflow tracing, CWE/OWASP mapping), first-party DAST (safe, scoped, verified-target-only dynamic testing), and Red Team defensive adversary emulation/BAS mapped to MITRE ATT&CK under a strict safety kernel (signed rules of engagement, in-scope only, kill-switch, no weaponized payloads).
Validates working knowledge of Safeguard's three-layer governance model: Policies (which decide what's a Finding), Gates (which enforce at build/release checkpoints with block/warn/notify/require-approval actions, including CI gate actions), and Guardrails (runtime/proxy enforcement such as the AI Gateway and MCP Guardrail).
Validates working knowledge of Safeguard's Zero-Day Discovery capability: the limitation of reactive CVE-feed-only vulnerability management, the SGZ-YYYY-XXXXX advisory format with CVSS vectors, coordinated disclosure practice, and how zero-day findings integrate into prioritization and remediation.
Validates working knowledge of Safeguard's Runtime Protection (CWPP/CNAPP concepts, ATT&CK-mapped rule packs, the ~1% CPU eBPF collector, and gated response: alert/block/kill/quarantine/isolate) and Package Firewall (install-time proxy for npm/pip catching typosquatting, dependency confusion, and malware, with allow/warn/block/audit/quarantine modes).
Awarded for completing ESSCM Essentials for Developers and passing its exam, demonstrating the ability to connect, read, triage and remediate a project in ESSCM.
Validates the ability to interpret EO 14028 Section 4 and NIST SSDF practices, map them to evidence produced by Safeguard, and assemble a defensible secure software development attestation package.
Validates that the holder can read and explain SPDX and CycloneDX documents, choose the right format for an audience, and generate, export, and critically review an SBOM using Safeguard.
