AI & Security Advisory
Voice AssistantInsights
AI Agent Tool Poisoning
The same properties that make AI agents useful make them exploitable. This article examines how Model Context Protocol (MCP) tool poisoning works, why attacks execute with the agent’s own credentials and appear legitimate in logs, and what controls can reduce the blast radius.
Manipulating Factuality in LLMs
An exploration of how factual knowledge in large language models can be modified using Rank-One Model Editing (ROME). The article demonstrates how pairwise associations can be altered to change specific facts in generated responses, highlighting both corrective and adversarial use cases.
Anatomy of Phishing Attacks
A walkthrough of how modern phishing attacks actually succeed in the real world. This article breaks down phishing as a system-level failure rather than a user mistake, showing how attackers exploit legitimate authentication flows to capture and replay credentials, session cookies, and access tokens.
Identity Verification in the AI Era
Deepfakes and AI-driven impersonation are eroding the assumptions traditional identity verification relies on. This article examines how organizations must rethink identity proofing, authentication, and trust when voice, video, documents, and digital presence can all be fabricated — and what a more resilient verification model requires.
Voice Agent Internals
Examine the internals of a voice agent to better understand how modern voice AI systems work beneath the surface. This article breaks down the core components behind a voice agent pipeline, including audio transport, voice activity detection, speech recognition, language model architecture, tool calling, and text-to-speech synthesis.
The Risk-Reward of AI Agents
AI agents promise real productivity gains, but introduce new risks around identity, access, and control. This article examines why agentic systems must be treated as identities, and what guardrails are required as agent adoption accelerates faster than security can keep up.
Shadow AI is the new Data Leak
Unsanctioned AI usage and widespread LLM adoption are creating new data leakage paths for enterprises. This article explains how everyday AI workflows turn prompts into data egress points, which types of data are most at risk, and how organizations can restore visibility and control.
Golden SAML: Bypassing SSO
Golden SAML attacks allow attackers to forge authentication assertions and move laterally across every service trusting a compromised identity provider. This article explains how the attack works, how stolen signing certificates enable token forgery at scale, and why federated SSO environments are particularly exposed.
Reconstructing Biometric Data
Biometric systems store templates rather than raw biometric data — but templates can be reversed. This article examines how template inversion attacks allow attackers to reconstruct original biometric data from stored representations, and what the privacy and security implications are for systems that fail to protect them.
Identity Provider Internals
Examine the internals of an identity provider to better understand how modern identity systems work beneath the surface. This article breaks down the core components behind enterprise identity platforms, including directory services, authentication flows, federation protocols, automated provisioning, and the threat-protection mechanisms that defend identity infrastructure at runtime.
Password Vault Internals
Examine the internals of a password vault to better understand how modern credential systems work beneath the surface. This article breaks down the core components behind password vault architecture, including encryption models, secret generation, secure storage, cross-device synchronization, and the key security boundaries that protect credentials at rest.
Face Verification Internals
Examine the internals of a face verification system to better understand how modern biometric systems work beneath the surface. This article breaks down the core components behind facial verification, including face capture, biometric matching, liveness detection, and defenses against deepfake and spoofing attacks.
Labs
Live
Passkeys: Interactive Demo
An interactive, step-by-step exploration of how passkey-based authentication works in practice. This lab visually breaks down passkey registration and authentication flows, showing on-device key generation, cryptographic challenge signing, and server-side verification as they occur.
Live
Securing AI Chatbots
An interactive lab featuring a vulnerable and a secured AI support chatbot. Explore how LLM-powered agents can be manipulated through enumeration, social engineering, and cross-account attacks — then see how backend guardrails like input scanning, tool-level authorization, and output filtering defend against the same exploits.
Live
Interactive Voice Assistant
Build an autonomous voice concierge that helps users understand and navigate a website through natural conversation. This lab covers real-time speech synthesis, intent recognition, contextual response generation, and seamless integration with site content and navigation.
Live
Facial Liveness Verification
An interactive lab exploring how facial verification systems distinguish a live human from a spoofed image, video, or mask. This lab covers passive and active liveness techniques, depth estimation, challenge-response prompts, and texture analysis used to defend against presentation attacks.
Live
Browser Fingerprinting
See what your browser silently reveals to every website you visit. Run an instant audit of your digital fingerprint, network identity, and tracking surface — covering canvas and audio fingerprints, installed fonts, GPU details, permissions, and more. Adjust your settings and run it again to see what changed.
Live
Deepfake Detection
An interactive lab exploring how deepfake detection systems identify AI-generated faces, manipulated video, and synthetic media. This lab examines spatial and temporal artifact analysis, frequency-domain signatures, and neural network classifiers used to distinguish authentic content from fabricated imagery.
Live
Your Personalized AI
An interactive look at how highly personalized AI can accelerate everyday tasks, sharpen decision-making, and act as an expert advisor across your personal and professional life. This lab explores preference learning, context-aware recommendations, and adaptive workflows that tailor intelligent assistance to the way you think and work.
Coming Soon
CAEP: Interactive Demo
An interactive introduction to the Continuous Access Evaluation Protocol (CAEP) and how it enables real-time session revocation across applications. This lab walks through CAEP event flows and lets you trigger a live credential-change event that instantly terminates an active session on a paired application.