Designing a New Scanner: From Detection Idea to Production Engine

AdvancedFree5 modules · 15 lessons · ~2 min

About this course

An advanced course for Application Security (AppSec) practitioners on scanner engineering as its own discipline: choosing a detection strategy, building a labelled corpus, setting precision, recall and a false positive budget, and shipping a rule through staged rollout and shadow mode without breaking the trust its findings depend on. The course closes by grounding every principle in Safeguard's own engine model: Connected Tools read through the Static Analysis Results Interchange Format (SARIF), Unified Findings, AutoTriage, and Zero-Day Artificial Intelligence discovery tuning across the Griffin, Eagle and Lino model family.

What you'll learn

From Idea to Detection Logic

From a Detection Idea to a Rule or an Engine
Choosing a Detection Strategy: Signature, Heuristic and Taint Tracking
Choosing a Detection Strategy: Behavioural, Statistical and Machine Learning

Building the Evidence Base

Building a Labelled Corpus of Known-Vulnerable and Known-Clean Samples
Setting Precision, Recall Targets and a False Positive Budget
Benchmarking and Regression Suites

Shipping It Without Breaking Trust

Rule Versioning and Backwards Compatibility of Findings
Staged Rollout: Feature Flags and Shadow Mode
Measuring Drift and Decay After Release

01From Idea to Detection Logic3 lessons

From a Detection Idea to a Rule or an Engine
Choosing a Detection Strategy: Signature, Heuristic and Taint Tracking
Choosing a Detection Strategy: Behavioural, Statistical and Machine Learning

02Building the Evidence Base3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Living With the Rule

Disputed Findings and Suppression Feedback as a Signal
Deprecating a Rule That No Longer Earns Its Place
The Ethics of Publishing a Detection

Grounding It in Safeguard's Engine Model

Scanner Settings, Connected Engines and Reading Results Through SARIF
Unified Findings and AutoTriage: What a New Rule Feeds Into
Zero-Day AI Discovery Tuning and the Griffin, Eagle and Lino Model Family

Building a Labelled Corpus of Known-Vulnerable and Known-Clean Samples

Setting Precision, Recall Targets and a False Positive Budget

Benchmarking and Regression Suites

03Shipping It Without Breaking Trust3 lessons

Rule Versioning and Backwards Compatibility of Findings
Staged Rollout: Feature Flags and Shadow Mode
Measuring Drift and Decay After Release

04Living With the Rule3 lessons

Disputed Findings and Suppression Feedback as a Signal
Deprecating a Rule That No Longer Earns Its Place
The Ethics of Publishing a Detection

05Grounding It in Safeguard's Engine Model3 lessons

Scanner Settings, Connected Engines and Reading Results Through SARIF
Unified Findings and AutoTriage: What a New Rule Feeds Into
Zero-Day AI Discovery Tuning and the Griffin, Eagle and Lino Model Family2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.