ESSCM: Zero-CVE Supply Chain Management

IntermediateFree8 modules · 21 lessons

About this course

A working tour of Safeguard's flagship ESSCM product: what it scans, how Risk Score and SCAL turn raw findings into a prioritized worklist, and the connect-to-fix loop that takes a repo from unknown risk to a gated, remediated release.

What you'll learn

What ESSCM Scans

Inputs: Code, Containers, Models, Uploads
From Connection to SBOM

Prioritization and Remediation

Cutting Noise with Reachability
AI Auto-Fix with Griffin

Governance and the Demo Flow

Policies, Gates, and Guardrails
The Demo Flow, End to End

Scoring Deep Dive: Risk Score and SCAL

Risk Score: Component Integrity, Not a CVE Count
SCAL and LCAL: Attestation Levels and How They Map to SLSA
Reading the Risk versus Attestation Scatter

The Project Workspace, Tab by Tab

Info, Dependencies and the Transitive Tree
Vulnerabilities, Findings and Mitigations
Security Posture, Code Quality, Suppliers and Licenses

Scan Engines, Modes and Coverage

The Scanner Catalog and What Is First Party
Fast, Deep and Proactive: Choosing a Scan Mode
Reachability: Turning a Finding List into a Work Queue

Configuring Autonomous Remediation

The Eight Categories and Their Strategies
A Safe Rollout Plan for Autonomous Fixes
Griffin's Pipeline, Step by Step

Deployment, Sovereignty and the Local Runner

The Four AI Modes
Deployment Models and the Local Runner
Org Hierarchy, Roles and Multi-Team Rollout

01What ESSCM Scans2 lessons

Inputs: Code, Containers, Models, Uploads
From Connection to SBOM

02Prioritization and Remediation2 lessons

Cutting Noise with Reachability

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

AI Auto-Fix with Griffin

03Governance and the Demo Flow2 lessons

Policies, Gates, and Guardrails
The Demo Flow, End to End

04Scoring Deep Dive: Risk Score and SCAL3 lessons

Risk Score: Component Integrity, Not a CVE Count
SCAL and LCAL: Attestation Levels and How They Map to SLSA
Reading the Risk versus Attestation Scatter

05The Project Workspace, Tab by Tab3 lessons

Info, Dependencies and the Transitive Tree
Vulnerabilities, Findings and Mitigations
Security Posture, Code Quality, Suppliers and Licenses

06Scan Engines, Modes and Coverage3 lessons

The Scanner Catalog and What Is First Party
Fast, Deep and Proactive: Choosing a Scan Mode
Reachability: Turning a Finding List into a Work Queue

07Configuring Autonomous Remediation3 lessons

The Eight Categories and Their Strategies
A Safe Rollout Plan for Autonomous Fixes
Griffin's Pipeline, Step by Step

08Deployment, Sovereignty and the Local Runner3 lessons

The Four AI Modes
Deployment Models and the Local Runner
Org Hierarchy, Roles and Multi-Team Rollout

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.