Software Supply Chain Security Fundamentals

BeginnerFree9 modules · 21 lessons · ~53 min

About this course

Learn what a software supply chain is, why attacks against it are rising, and how SBOMs, the four supply-chain roles (Producer, Distributor, Reseller, Consumer), and Safeguard's ESSCM, Portal, TPRM, and OSM products fit together into one platform.

What you'll learn

Why Supply Chain Security Matters

What Is a Software Supply Chain?
Why Supply Chain Attacks Happen

SBOMs: The Foundation

What Is an SBOM?
SBOM Formats and Standards

The Four Supply Chain Actors

Producer, Distributor, Reseller, Consumer
Where Safeguard Fits: ESSCM, Portal, TPRM, and OSM

Open Source Intelligence and Gold

OSM and the Gold Directory
The Gold Registry and Hardened Components

Anatomy of Real Supply Chain Attacks

Dependency Confusion and Namespace Attacks
Typosquatting, Starjacking, and Malicious Packages
Build System Compromise and the Blast Radius Problem

Reading Dependency Trees in Depth

Direct, Transitive, and the Lockfile Contract
Transitive Depth, Dependency Age, and Health Signals
Container Images: Layers, Base Images, and Inherited Risk

Vulnerability Intelligence: Sources and Scoring

The CVE Lifecycle and Why Feeds Disagree
CVSS, EPSS, and KEV: Three Questions, Not One Score

Your First Scan: A Guided Walkthrough

Connecting a Source and Choosing a Scan Mode
Reading the Dashboard and the Project Tabs
From Finding to Fixed: Tasks, Search, and the Remediation Loop

Deployment, Sovereignty, and Operating Modes

The Four AI Modes and What Each One Means Operationally
Deployment Models, Network Posture, and Certification Language

01Why Supply Chain Security Matters2 lessons

What Is a Software Supply Chain?7 min
Why Supply Chain Attacks Happen7 min

02SBOMs: The Foundation2 lessons

What Is an SBOM?7 min
SBOM Formats and Standards6 min

03The Four Supply Chain Actors2 lessons

Producer, Distributor, Reseller, Consumer7 min
Where Safeguard Fits: ESSCM, Portal, TPRM, and OSM7 min

04Open Source Intelligence and Gold2 lessons

OSM and the Gold Directory6 min
The Gold Registry and Hardened Components6 min

05Anatomy of Real Supply Chain Attacks3 lessons

Dependency Confusion and Namespace Attacks
Typosquatting, Starjacking, and Malicious Packages
Build System Compromise and the Blast Radius Problem

06Reading Dependency Trees in Depth3 lessons

Direct, Transitive, and the Lockfile Contract
Transitive Depth, Dependency Age, and Health Signals
Container Images: Layers, Base Images, and Inherited Risk

07Vulnerability Intelligence: Sources and Scoring2 lessons

The CVE Lifecycle and Why Feeds Disagree
CVSS, EPSS, and KEV: Three Questions, Not One Score

08Your First Scan: A Guided Walkthrough3 lessons

Connecting a Source and Choosing a Scan Mode
Reading the Dashboard and the Project Tabs
From Finding to Fixed: Tasks, Search, and the Remediation Loop

09Deployment, Sovereignty, and Operating Modes2 lessons

The Four AI Modes and What Each One Means Operationally
Deployment Models, Network Posture, and Certification Language

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.

Read the full FAQ