Security Research

Offensive and Defensive Security Research

We break systems we are authorized to break, and we build the controls that make AI systems trustworthy. Both sides feed each other: what we learn attacking real targets shapes the open-source tooling we ship for defenders. Every engagement is scoped, authorized, and human-driven.

Offensive · Red Team

Authorized Offensive Security

We conduct red-team and bug-bounty research against systems we are explicitly permitted to test. The work is AI-assisted. Our internal tooling helps plan reconnaissance, reason about vulnerability chains, and write up findings, but a human operator reviews and executes every action. Nothing runs autonomously against a target.

  • Registered researcher on HackerOne, working strictly within each program's published scope and rules of engagement
  • Licensed lab and training environments: HackTheBox, sanctioned CTFs
  • Clear, reproducible findings with CVSS scoring and remediation guidance
Defensive · AI Trust

Defensive AI Research

Our defensive work asks how you make AI systems, and the environments they run in, trustworthy, auditable, and compliant. We study agent governance, tamper-evident audit trails, application allowlisting, and deterministic vulnerability remediation, mapped to the frameworks regulators actually cite.

  • Agent auditability and tamper-evident evidence for AI actions
  • Allowlist governance and vulnerability remediation at enterprise scale
  • Alignment to CIS Controls, ISO/IEC 27001, and the NIST AI RMF

Scope & Authorization

We only test systems we are authorized to test. In practice that means published bug-bounty program scopes, licensed lab environments, and engagements conducted under written rules of engagement. Anything outside those boundaries is out of scope, full stop.

Where we use AI to assist the work, a human stays in the loop at every step: the tooling proposes and analyzes, and a human operator decides, authorizes, and executes. We do not point autonomous agents at live targets.

Open Source

Tooling This Research Produces

The defensive side of the practice ships as open source. These are tools we use ourselves, released for anyone building disciplined, auditable AI and security workflows.

Evidence Engine

Attestor

Verified-not-asserted risk assessment for any app or repo.

Point it at a codebase and it produces a graded, evidence-honest security assessment: deterministic A–F grading with the evidence clamped so a model cannot self-certify. Zero-dependency, runs locally.

Deps Zero Runs Local
View on GitHub
AI Audit & Governance

Provenant

Tamper-evident, examiner-ready records of what your AI agents did.

An open reference implementation for AI-agent audit trails. Every action is captured, hash-chained so any later edit is detectable, and anchored to public time: a self-contained report an auditor can verify without trusting you or us.

License BSL 1.1 Runs Local / air-gapped
More Product Info →
Agentic Operating Doctrine

OpenTenet

Make any AI coding assistant verify its work before it says "done."

A plain-markdown operating doctrine you drop into any project: a constitution of hard rules, a six-phase algorithm, and a verification doctrine that refuses unverified claims, identical across Claude Code, Cursor, Codex, Gemini CLI, and Aider.

License MIT Runs Local
More Product Info →
Vulnerability Remediation

REDGuard

Deterministic vulnerability remediation with a review cockpit.

Ranks findings by exposure, business criticality, and known exploitation, then drives change-managed, human-approved remediation. Scoring and runbook matching are deterministic engine code: auditable and reproducible, not a black‑box model.

Posture Self-hosted Approval Human-gated
Talk to the team →

Want to discuss an authorized engagement, or the enterprise edition of these tools? Talk to the team →