Observe
Campaigns, malware, infrastructure, and tradecraft.
Campaign research / controlled emulation
We analyze intrusion methods by reproducing them.
Under controlled conditions, we trace attacker behavior, test the relevant path, and publish the evidence, limits, and defensive consequences.
ResearchThreat intelligence · red teaming · malware · cloud
EvidenceObserved · reproduced · inferred · unknown
RecordStable IDs · scope · limits · disclosure · artifacts
01 / Method
A report is an evidence chain.
Readers should be able to tell observation, reproduction, inference, and uncertainty apart without decoding our confidence.
Model
Hypotheses, paths, confidence, and prerequisites.
Emulate
Bounded, authorized reproduction of behavior.
Validate
Controls, detections, outcomes, and the model itself.
Publish
Evidence, limitations, artifacts, and reuse.
Every public report names
Identity · evidence state · scope · method · defense · limits · artifacts · disclosure · citation
02 / Research
Publish the work that survives validation.
No activity counter. No placeholder findings. The public index starts empty and changes only when a record clears review.
Record state / empty
No research has been published yet.
The index, metadata contract, RSS feed, and report routes are ready. The first entry will be real work—not simulated momentum.
Open the research index →03 / CVE Hunter
Private until the method holds.
building
An AI-assisted vulnerability-research framework being built around explicit experiments, deterministic execution, and evidence that can survive independent review.
Public when findings are reproducible, safety boundaries are explicit, and disclosure permits it.
Read the current state →04 / Publications
Four formats. Four jobs.
Papers carry the method. Talks carry the argument. Datasets carry the material. Slides preserve the frame.
05 / Principles
Claim less.
Show more.
Mechanism first.Name what happened before saying why it matters.
Limits in view.Show what could narrow or overturn the conclusion.
Defense attached.Connect the research to telemetry, controls, and a test.