Emerging threats and attack techniques
How adversary methods are changing, and which of those changes are significant for defenders.
Guiding questionWhich developments should alter defensive priorities, and which can simply be monitored?
Research
Focused enquiry, directed at practical questions.
Our research aims to explain how threats and technologies are changing, and what defenders can reasonably do in response.
Research areas
Vulnerability research and technical analysis
Examining classes of weakness and software behaviour to understand root causes, the conditions for exploitation and effective mitigation.
Guiding questionWhat must be true in an environment for a weakness to matter in practice?
Cloud, application and infrastructure security
The security properties of modern platforms, including identity, software supply chains and configuration at scale.
Guiding questionWhere do common architectural patterns create risk that is easy to overlook?
AI-related cybersecurity risks
Risks that arise when AI systems are built, integrated or misused, including data exposure, manipulation of models and over-reliance on automated output.
Guiding questionWhat should change in governance and design when AI enters a business process?
Security trends and practical defensive guidance
Translating technical developments into guidance that security teams and leaders can apply.
Guiding questionWhat is the most useful next step for a team with limited time and budget?
Working with us
How organisations use our research.
Research can be commissioned on its own, or used to inform a consulting engagement. Each piece of work starts from a question that matters to a decision you need to make.
Commissioned research
A focused investigation of a question specific to your organisation, such as how a new technique or technology could affect your environment. You receive a written report that sets out the method, findings and limits.
Technical briefings
Concise analysis of a significant vulnerability, attack technique or platform change: what it affects, how likely it is to matter to you and what to do about it.
Leadership briefings
Plain-language sessions for boards and executives on how the threat landscape is changing and what it means for priorities, investment and oversight.
Research-informed advice
Our research feeds directly into our consulting, so that recommendations reflect current techniques and technologies rather than yesterday’s assumptions.
Standards for published work
Evidence
Conclusions are tied to stated sources and methods, so that readers can judge them.
Limits
Each publication says what was examined, what was not and how confident we are.
Responsible handling
Vulnerabilities are handled through coordinated disclosure with affected parties.
Confidentiality
Client information is never used in published research without agreement.
Have a question worth investigating?
We would be glad to discuss research that could inform a decision in your organisation.
Request a Consultation