Resilient Privacy Research
Research from the people who break, secure and govern AI.
What our testers, analysts and auditors learn on engagements, written down so your team can use it: threat models, checklists and buyer’s guides.
AI security series
Where AI systems actually break.
Prompt injection, data leakage through retrieval and agent tool misuse, mapped to the OWASP Top 10 for LLM Applications and MITRE ATLAS. Start with the one-page threat model.
- AI security
AI agents and MCP: securing the tools your models can call
Agents turn text into actions. The Model Context Protocol makes connecting tools easy, which moves the real attack surface to tool permissions, tokens and the servers you install.
· 11 min read
Read - AI security
Securing LLM applications: a threat model that fits on one page
Prompt injection is not a bug you patch once. Treat the model as an untrusted component and design the controls around what it can reach.
· 3 min read
Read
Latest
More from the blog and guides.
CTEM in practice: from vulnerability lists to exposure decisions
More scanners produce more rows. Continuous Threat Exposure Management turns findings into a repeating cycle that ends in fixes.
· 2 min read
ReadSOC 2 readiness: where first audits stall
Most first SOC 2 audits don't fail on missing policies. They stall on evidence that controls actually ran during the review period.
· 2 min read
ReadAPI security starts with authorization, not the gateway
The most damaging API bugs need no exploit, just a valid token and someone else's object ID. Fix authorization first.
· 2 min read
ReadSOC 2 readiness checklist
The controls, evidence and decisions to have in place before your SOC 2 review period starts, grouped by area.
· 2 min read
ReadChoosing an MDR provider: questions that separate the field
Every managed detection and response provider says 24/7. These questions show what they actually watch, what they do and who does it.
· 2 min read
ReadMapping the API surface before a partner launch
A payments company was about to open its APIs to partners. Its engineering teams had added endpoints over several years, and nobody could say with confidence which versions were still live or which returned card-adjacent data.
Newsletter
New research, once a month.
Articles, guides and practical notes from our analysts. No spam; unsubscribe by replying.
Browse
Find what you need.
Rather talk it through?
Book time with the practitioner behind the research that fits your question.