Research domains, topics and where they are used
SAFE SQUARE researches the technology and systems that help people and AI build their capabilities and work together effectively.
We also treat security intelligence, vulnerabilities and attack and defence techniques, knowledge infrastructure, and AI models and agents as research and development fields in their own right.
What do we research and build?
We research six independent domains and turn the results into technology and tools for security work.
Reviewed
The three groups are there to make the six domains easier to follow. We research KNOWLEDGE on a par with the other five.
We advance professional capability and collaboration between multiple people and AI agents, and build technologies that make knowledge useful wherever it is needed.
We improve the capabilities and practical use of AI models, and build systems that use knowledge and tools to perform real work.
We analyse exposure and attack surfaces, and develop techniques to verify vulnerabilities and their real-world impact.
We research how professionals can analyse more deeply and judge more accurately, and how multiple people and AI agents work together: sharing roles, goals and context, and coordinating, reviewing and handing over work. We also develop the frameworks and collaborative environments this needs.
We research the full knowledge lifecycle, from collecting, processing and managing expertise and experience to delivering it for use. We develop delivery methods, integration technologies, frameworks and systems so people, AI agents and models can use the knowledge they need in ways that suit their goals and environments.
We research model evaluation, training, customisation, optimisation, inference and operation. We improve models for security work and develop local models and deployment systems that are easier to install, customise and run in the environments where they are needed.
We research how AI can plan towards goals, use knowledge and tools, perform tasks and check results. We develop systems for agent execution and state management, task coordination, permissions, approval and result verification.
We collect information about assets, services, accounts and other exposures observed across the internet, and analyse changes, history and relationships across attack surfaces. We combine this with relevant threat information to develop technologies and platforms for security assessments, threat investigations and incident analysis.
We analyse and verify system vulnerabilities, the conditions needed to exploit them, and their real-world impact. We advance vulnerability research and offensive and defensive techniques, and develop specialist tools and test environments for analysis, reproduction and validation.
We improve the model and the surrounding knowledge, tools, workflows and collaboration together.
For an agent to finish a task correctly, the tools, execution environment, permissions, instructions and verification have to work alongside the model's responses. So we research MODEL and AGENT separately.
The technologies in COLLAB, KNOWLEDGE, MODEL and AGENT may also apply beyond security.
Each domain is researched in its own right; real tasks draw on several of them at once.
MODEL adapts and optimises the model. KNOWLEDGE supplies permitted knowledge and evaluation data. AGENT connects it to tasks, EXPLOIT contributes security validation criteria, and COLLAB adds expert review.
COLLAB supports shared work and handover; AGENT handles execution; EXPLOIT provides analysis and validation; INTEL adds external evidence; KNOWLEDGE makes reusable knowledge available; MODEL supports the model technology.
INTEL interprets history and relationships. KNOWLEDGE supplies reusable delivery and integration; AGENT handles repeatable work; COLLAB supports review. EXPLOIT is added when actual exploitability must be verified.
These are examples of how the domains work together.
A research domain describes a capability we keep developing; a service describes work a client can commission. The same technology can serve several services, and experience from delivery can raise new research questions.
Where the research domains are put to work in security: the problems we study and the typical environments they come from.
The attack surface of AI models and agent services, and responses to threats such as prompt attacks, data leakage and misuse.
Attacking and defending web, mobile, APIs, cloud and networks: the fundamentals every other topic builds on.
From OT, ICS, IoT and firmware to robots, vehicles and ships: vulnerabilities in systems that touch the physical world, and their effect on safety.
Offensive and defensive techniques against advanced threats, including zero-day vulnerability research.
Research and development at SAFE SQUARE centres on two core organisations of its own: tty.link and Return-Oriented AI Lab.
Maker Studio
IMAGINE · MAKE · EXPERIMENT
tty.link's identity lies not in any one technology but in making and experimenting first-hand. Its work ranges across software, electronics and hardware, firmware, AI and automation, and systems where the digital and the physical meet. Alongside systems for security research and practice, it pursues ideas that have nothing to do with security, on its own terms.
Systems & Security Research
UNDERSTAND · CHALLENGE · REINVENT
Return-Oriented AI Lab investigates how systems and technologies work, how they are built and where their limits lie. Its research covers vulnerabilities and offensive and defensive techniques, and equally the inner workings of systems and AI models and agents; a question can start from a security problem or from curiosity about how a system behaves, performs or uses its resources.
The six domains (COLLAB, KNOWLEDGE, MODEL, AGENT, INTEL and EXPLOIT) are not divided between the two organisations: they are capabilities the whole of SAFE SQUARE builds together. People working in education, training and evaluation, and in business and operations, also take part in the research and in putting it to use.
| Aspect | tty.link | Return-Oriented AI Lab |
|---|---|---|
| Main starting point | What could we make and try out? | How does this work, and how far can it go? |
| Core inclination | Creating, making and building | Exploring, analysing and verifying |
| Shared activities | Research, development, reverse engineering, experimentation, using AI, exploring new technologies | |
Return-Oriented AI Lab and tty.link each carry out independent research and development, grounded in their own expertise and interests.
Understanding of principles and constraints leads to new designs and builds, and problems found while making and using things lead to new research. The cooperation runs both ways, on each piece of work where it helps.
The three words are not a fixed production process; they describe a culture of making in which all three keep coming round.
Spotting new problems and possibilities, and imagining what could be made.
Turning ideas into something that actually works.
Using and observing what we make first-hand, and changing hypotheses and designs as we go.
Small experiments and prototypes are results in their own right. Not every project needs to become a commercial product; where we do choose to turn one into a product, we make its purpose, environment, required quality, verification and support clear. Hardware work can take in the device, its control software, interfaces and test environment together.
tty.link is not a development team that implements other people's research. It starts research and development from its own questions and interests and, where needed, carries out analysis, reverse engineering, work with models and systems research itself. Making that has nothing to do with security is shown on tty.link's own site.
Understanding in depth how things work and how they are built.
Questioning and testing existing assumptions, designs and technical limits.
Finding new perspectives and approaches and, where needed, reconstructing and improving existing technology.
Here a hacker's perspective means more than a job in attack or defence. It is the habit of not taking the given explanation at face value: checking for yourself how things work inside, and testing the assumptions everyone takes for granted and the uses nobody expected.
The lab studies the principles, capabilities and limits of AI models and agents themselves, and also uses AI actively to analyse, experiment, verify and develop. Using and researching AI is open to the whole company, not confined to the lab.
The name was inspired by ROP (return-oriented programming), an attack technique that chains short instruction sequences already present in a program's memory, each ending in a return instruction, to make the program do something it was never meant to do, without injecting any new code. The lab reads in it the idea of understanding existing pieces deeply and connecting them in new ways, and has made that its approach to research. It is a metaphor in the name: ROP itself is not a technique for improving systems.
Finding a root cause, showing that a technology behaves in unexpected ways or proving a new attack technique are all research results. Not every piece of research has to end in a product or a new implementation.
Research starts not only from problems met in real work but also from curiosity about technology, from systems behaving in unexpected ways and from new ideas for things to make. The results become our own technologies, tools and methods, used in services and in work with clients, and field experience becomes the next research question.
Our own technology for analysing the history and relationships of exposure and attack surfaces drives the investigation.
We use our research on attack techniques and systems to verify what can really be exploited, and our agent research to build the AI agents used in testing.
Our research into attack techniques and systems pins down the conditions under which a business harm could happen.
Field techniques and knowledge, together with our research into how professionals learn and judge, become controlled labs and exercises. Evaluation and improvement of AI agents draw on our agent and model research.
The capability we have built with people and AI also reaches selected organisations with limited means.
The Comprehensive Security Health Check and Cybersecurity Care build on the same technology and methods. Our research puts the results you receive on firmer ground.
SAFE SQUARE researches security technology, puts it to work in real analysis and testing, and builds the tools and AI it needs. We select work close to our research domains and take it on with you as technical collaboration or joint research.
Together with you, we design and build the technology the work needs, such as security analysis and testing techniques, security automation, AI models and agents, or knowledge systems.
We research open questions with you, such as new offensive and defensive techniques or how people and AI work together.
If you already run AI agents, AI agent evaluation and improvement looks at how well they do the work.
