Research
Proof you can read before the pitch.
A red-team report is hard to judge before you have bought it, so this page puts the checkable part first: the tooling, the preprints, the shape of a finding, and the frameworks the work maps to. Published advisories land in the Labs as they publish.
Public, and checkable today
What you can read right now.
None of this is a claim about a client. It is the work itself, in the open, under the founder's own name.
- Systems software in Rust
- Packages published on crates.io, built around agent memory and identity boundaries. Public source, and the fastest way to see how the work is done before we talk.
- A sample finding
- One page from the pack, built from the template rather than taken from a client, so you can read the shape of a finding before you pay for one.
- A regression harness
- The format we hand over with every engagement: each exploit written as a machine-readable scenario your engineers run in CI, so a fix stays fixed when a prompt or a model changes.
Written up
Two preprints.
The failure modes this practice is built to test for, worked out in public before they became a service. DOIs are on the record under Phillip Austin Green's name.
- Agent memory provenance
- Where an agent's memory came from, and what it means to trust it. Published with a DOI, linked below.
- Identity stability
- Whether an agent stays the same actor across a session and across time. Published with a DOI, linked below.
Provenance Is Not IndependenceThe Individuation Architecture
What findings map to
The frameworks procurement already uses.
Every finding is written against the taxonomies an enterprise security team uses, so the report answers the question the questionnaire asked instead of starting a new one.
- OWASP LLM and agentic guidance
- The community taxonomy of how LLM apps and agents fail: goal hijack, tool misuse, identity abuse, memory poisoning, and the rest.
- NIST AI Risk Management Framework
- The governance structure enterprises manage AI risk against. Adversarial testing is its Measure function.
- MITRE ATLAS
- The adversary-behaviour vocabulary, so a finding names the technique a defender can look for.
- ISO/IEC 42001
- The certifiable AI management standard. Our findings are evidentiary artifacts an auditor uses; we issue no certificate.
A finding that is not mapped is a finding procurement cannot use, so the mapping is the deliverable, not an upsell.
Seen enough to talk?
A few questions, one business day for a reply, and a real person on the other end of it.