01 // RESEARCH

Notes from the public surface.

Field reports on what is currently leaking, methodology details, and the occasional opinion on the cybersec market.

02 // FIELD NOTES

Patterns, not client-attributable stories.

Launch articles are skeletons by design until the founder publishes final copy. The research standard is strict: no company names, no engagement-identifying screenshots, no public CVE details, and no case-study cards that can be pattern-matched back to a client.

FIELD REPORT // 2026-05-07

The Docker registry goldmine of 2026.

Public Docker registries continue to refill with prod-tagged images, environment residue, build metadata, and credentials. Six months of pattern observations, with the names removed.

Read

OPINION // 2026-05-07

The exposure shipped by your AI assistant.

AI coding assistants are not malicious. They are statistically faithful to public examples. That is the entire problem, and it is fixable with compensating controls — not with refusing the tool.

Read

METHODOLOGY // 2026-05-07

Why we run four LLMs against every finding.

Majority vote is a comfortable model. It is also wrong for security work. Four independent models, steel-manned against each other, with a founder adjudicating. Here is the protocol and why it survives audit.

Read

FIELD REPORT // 2026-04-29

The NPM supply-chain canaries we keep replaying.

The NPM supply chain is not getting safer. It is getting more legible. Here is what Labs reads when scoping a public package surface — and the signals that almost always justify a deeper look.

Read

FIELD REPORT // 2026-04-22

What actually leaks from build pipelines.

CI/CD logs, artefact storage, and deploy manifests leak more than most teams realise. Not because the platforms are weak — because the defaults reward velocity. Patterns from six months of observation.

Read

FIELD REPORT // 2026-04-15

The half-life of a leaked AWS key.

From exposure to first probe, from first probe to enumeration, from enumeration to action. The intervals are shorter than most playbooks assume. A reconstruction from observed cases, names removed.

Read

METHODOLOGY // 2026-04-08

The evidence ladder.

Most audit deliverables blur the line between observation and conclusion. The ladder is the discipline that keeps them distinct. Five rungs, and the rules that decide which rung a finding sits on.

Read

METHODOLOGY // 2026-04-01

Single auditor of record.

The founder runs the engagement. There is no junior handoff. The signature on the attestation belongs to the same person who read the artefacts. The reasons this matters are commercial, not vain.

Read

METHODOLOGY // 2026-03-25

The redacted Challenge Log.

Transparency without leakage. The Challenge Log shows the buyer how a finding was decided, including the dissenting arguments — without disclosing client artefacts or the methodology's working secrets.

Read

METHODOLOGY // 2026-03-18

Proof of Threat without exploitation.

An attacker's playbook is to chain reads into impact. Our playbook is to construct the same chain from declared infrastructure, without running it. The distinction is what makes Labs an audit firm and not a pentest.

Read

OPINION // 2026-03-11

Scanners audit code. Attackers audit surfaces.

Every team we audit has SAST, SCA, secret scanning, dependency alerts, CSPM, and cloud config checks. Those controls catch code-shaped problems. The exposure that hurts is not code-shaped.

Read

OPINION // 2026-03-04

Why the pentest industry needs to rebrand.

Penetration testing as a category was born in a different era of network architecture. The product the market still buys does not match the threat model most buyers actually face. The rebrand is overdue.

Read

DOCTRINE // 2026-02-25

The reciprocal-NDA reference model.

Most B2B services list their clients publicly. Audit firms should not. Here is what Labs does instead, and why a prospect who asks for a public client list is asking the wrong question.

Read

03 // PUBLISHING STANDARD

More research will publish when it can be useful without being identifying.

Labs research is intended to become an SEO and authority asset. It will not trade client safety for velocity. Articles describe archetypes, methodology, and observed classes of exposure.

Get new research in your inbox.

One short note when we publish. No marketing, unsubscribe anytime.