Sign inFree scoreBook a demo
Research & disclosures

We publish what we find, including when it is inconvenient.

Every product we sell started as a piece of research. Findings go to the affected vendor first, then to the public on a fixed timetable, whether or not a patch has shipped.

Disclosure deadline90 days
Extension on requestUp to 30 days
Active exploitation7 days
Methodology publishedAlways

Published papers

2026
PATENT-PENDING
Dual-Chain SBOM Verification for Software Supply Chain IntegritySBOMs are proliferating under regulatory mandate, but an SBOM is only as trustworthy as the process that generated it and the integrity of the chain between generation and consumption. AxiomChain addresses three structural weaknesses in current SBOM workflows through a dual-chain cryptographic verification architecture.
2026
PATENT-PENDING
On-Device Behavioural Pathway Analysis for Child Online SafetyKeyword filters and URL blocklists act on content that has already been classified as harmful. But grooming, radicalisation, and self-harm escalation are not single-event phenomena. They are behavioural pathways that develop over time through patterns no content filter can detect. Guardian analyses these trajectories on-device, without transmitting raw behavioural data to the cloud.
2026
PAPER
The S3 Framework: Surface, Sequence, SealTraditional security platforms are collections of disconnected tools, each generating alerts in isolation. The S3 Framework reimagines the entire security pipeline as a single continuous workflow: discovery, contextual attack-path analysis, and cryptographic attestation, without human glue logic.
2026
DISCLOSURE POLICY

The timetable, and why it does not move

Vendors get 90 days from first contact, extendable by 30 if a fix is genuinely in flight. Seven days if we see the issue being exploited. We publish on the deadline regardless of patch status, because users deserve to know what they are running.

Where a finding touches one of our own products, the same rules apply to us. Our advisories are on this page alongside everyone else's.

Reporting something to usFound an issue in CyberFit, Nudger or Guardian? Send it to [email protected] with a PGP key if you have one. We acknowledge within two working days and will not send lawyers.
Working with usWe co-publish with independent researchers and credit properly. If you have a finding that needs a lab behind it, get in touch.

Shorter notes, published more often

Field notes and working observations that are not full papers.

Read the blog