Research domains, topics and where they are used
Research in AI, security, knowledge use, professional development and people–AI collaboration.
We research AI and security technologies and build the knowledge systems, tools and collaborative environments that help professionals and AI work more effectively. We aim to improve the quality and efficiency of security work across different environments, without relying on model capability alone.
What do we research and build?
We research six independent domains and turn the results into technology and tools for security work.
Reviewed
The groups help readers understand the research. They are not an organisational hierarchy, an order of development or a restriction on which domains can work together. KNOWLEDGE is both an independent research domain and a shared foundation used across the other five domains.
We advance professional capability and collaboration between multiple people and AI agents, and build technologies that make knowledge useful wherever it is needed.
We improve the capabilities and practical use of AI models, and build systems that use knowledge and tools to perform real work.
We analyse exposure and attack surfaces, and develop techniques to verify vulnerabilities and their real-world impact.
We research ways for professionals to analyse more deeply and make better-informed judgements. We develop frameworks and collaborative environments where multiple people and AI agents share roles and context, coordinate work, review results and hand tasks over.
We research the full knowledge lifecycle, from collecting, processing and managing expertise and experience to delivering it for use. We develop delivery methods, integration technologies, frameworks and systems so people, AI agents and models can use the knowledge they need in ways that suit their goals and environments.
We research model evaluation, training, customisation, optimisation, inference and operation. We improve models for security work and develop local models and deployment systems that are easier to install, customise and run in the environments where they are needed.
We research how AI can plan towards goals, use knowledge and tools, perform tasks and check results. We develop systems for agent execution and state management, task coordination, permissions, approval and result verification.
We collect information about assets, services, accounts and other exposures observed across the internet, and analyse changes, history and relationships across attack surfaces. We combine this with relevant threat information to develop technologies and platforms for security assessments, threat investigations and incident analysis.
We analyse and verify system vulnerabilities, the conditions needed to exploit them, and their real-world impact. We advance vulnerability research and offensive and defensive techniques, and develop specialist tools and test environments for analysis, reproduction and validation.
We improve the model and the surrounding knowledge, tools, workflows and collaboration together.
A good answer from a model does not mean an agent will complete the task correctly: tools, the execution environment, permissions, instructions and verification all have to work together. That is why MODEL and AGENT are researched as separate domains.
The technologies in COLLAB, KNOWLEDGE, MODEL and AGENT may also apply beyond security.
Each domain is researched in its own right; real tasks draw on several of them at once.
MODEL adapts and optimises the model. KNOWLEDGE supplies permitted knowledge and evaluation data. AGENT connects it to tasks, EXPLOIT contributes security validation criteria, and COLLAB adds expert review.
COLLAB supports shared work and handover; AGENT handles execution; EXPLOIT provides analysis and validation; INTEL adds external evidence; KNOWLEDGE makes reusable knowledge available; MODEL supports the model technology.
INTEL interprets history and relationships. KNOWLEDGE supplies reusable delivery and integration; AGENT handles repeatable work; COLLAB supports review. EXPLOIT is added when actual exploitability must be verified.
These examples show how the domains connect. They do not mean that a capability has already been released as a product or applies to every project.
A research domain describes a capability we keep developing; a service describes work a client can commission. The same technology can serve several services, and experience from delivery can raise new research questions.
Where the research domains are put to work in security: the problems we study and the environments they come from.
The attack surface of AI models and agent services, and responses to prompt attacks, data leakage and misuse.
Attacking and defending web, mobile, APIs, cloud and networks: the fundamentals every other topic builds on.
From OT, ICS, IoT and firmware to robots, vehicles and ships: vulnerabilities in systems that touch the physical world, and their effect on safety.
Offensive and defensive techniques against advanced threats, including zero-day vulnerability research.
Research and development at SAFE SQUARE centres on two core organisations of its own: tty.link and Return-Oriented AI Lab.
Maker Studio
IMAGINE · MAKE · EXPERIMENT
tty.link's identity lies not in any one technology but in making and experimenting first-hand. Its work ranges across software, electronics and hardware, firmware, AI and automation, and systems where the digital and the physical meet. Alongside systems for security research and practice, it pursues ideas that have nothing to do with security, on its own terms.
Systems & Security Research
UNDERSTAND · CHALLENGE · REINVENT
Return-Oriented AI Lab investigates how systems and technologies work, how they are built and where their limits lie. Its research covers vulnerabilities and offensive and defensive techniques, and equally the inner workings of systems and AI models and agents; a question can start from a security problem or from curiosity about how a system behaves, performs or uses its resources.
These are representative examples of activities, not a way of dividing the work.
The six domains (COLLAB, KNOWLEDGE, MODEL, AGENT, INTEL and EXPLOIT) are not divided between the two organisations: they are capabilities the whole of SAFE SQUARE builds together. People working in education, training and evaluation, and in business and operations, also take part in the research and in putting it to use.
| Aspect | tty.link | Return-Oriented AI Lab |
|---|---|---|
| Main starting point | What could we make and try out? | How does this work, and how far can it go? |
| Core inclination | Creating, making and building | Exploring, analysing and verifying |
| Shared activities | Research, development, reverse engineering, experimentation, using AI, exploring new technologies | |
Return-Oriented AI Lab and tty.link each carry out independent research and development, grounded in their own expertise and interests. In-depth research into how systems work, and free-ranging making and experimentation, give each other new ideas and technical possibilities, and grow together.
Understanding of principles and constraints leads to new designs and builds, and problems found while making and using things lead to new research. The cooperation runs both ways, on the work where it helps; not every project has to be a joint one.
The three words are not a fixed production process; they describe a culture of making in which all three keep coming round.
Spotting new problems and possibilities, and imagining what could be made.
Turning ideas into something that actually works.
Using and observing what we make first-hand, and changing hypotheses and designs as we go.
Small experiments and prototypes are results in their own right. Not every project needs to become a commercial product; where we do choose to turn one into a product, we make its purpose, environment, required quality, verification and support clear. Hardware work can take in the device, its control software, interfaces and test environment together.
tty.link is not a development team that implements other people's research. It starts research and development from its own questions and interests and, where needed, carries out analysis, reverse engineering, work with models and systems research itself. Making that has nothing to do with security is shown on tty.link's own site.
Understanding in depth how things work and how they are built.
Questioning and testing existing assumptions, designs and technical limits.
Finding new perspectives and approaches and, where needed, reconstructing and improving existing technology.
Here a hacker's perspective means more than a job in attack or defence. It is the habit of not taking the given explanation at face value: checking for yourself how things work inside, and testing the assumptions everyone takes for granted and the uses nobody expected.
The lab studies the principles, capabilities and limits of AI models and agents themselves, and also uses AI actively to analyse, experiment, verify and develop. Using and researching AI is open to the whole company, not confined to the lab.
The name was inspired by ROP (return-oriented programming), an attack technique that chains short instruction sequences already present in a program's memory, each ending in a return instruction, to make the program do something it was never meant to do, without injecting any new code. The lab reads in it the idea of understanding existing pieces deeply and connecting them in new ways, and has made that its approach to research. It is a metaphor in the name: ROP itself is not a technique for improving systems.
Finding a root cause, showing that a technology behaves in unexpected ways or proving a new attack technique are all research results. Not every piece of research has to end in a product or a new implementation.
Sovereign Security AI, the direction we are working towards, does not belong to any one organisation: research at Return-Oriented AI Lab, systems built at tty.link, the work on knowledge, learning and evaluation, and experience from client work all contribute to it. Not every independent research project or piece of making outside security is a sub-task of it, though.
Research starts not only from problems met in real work but also from curiosity about technology, from systems behaving in unexpected ways and from new ideas for things to make. The results become our own technologies, tools and methods, used in services and in work with clients, and field experience becomes the next research question.
Our own technology analyses the history and relationships of exposure and attack surfaces; experts then review source, timing and relevance to your assets.
Tools and AI agents cover the ground; experts analyse by hand and safely confirm what can really be exploited.
Field techniques and knowledge, together with our research into how professionals learn and judge, become controlled labs and exercises where people learn the attacker's view first-hand. Evaluation and improvement of AI agents draw on our agent and model research and are delivered as tailored engagements.
We design and develop security tools, AI models and agents, knowledge delivery systems and collaborative environments for needs that existing tools do not fully address.
The capability we have built with people and AI also reaches selected organisations short on budget.
You receive this as better-grounded work, not as a separate product.
