Threat briefs, founder scans, and operational notes from the Fall Risk AI research program. Where the papers establish what is provable, the articles make the implications concrete — for security leaders, governance teams, and anyone trying to understand what runtime identity actually means in production.
Two scans of the same developer laptop, one month apart. The first found the gap. The second showed what a signed registry changes — 8 verified groups of 40, then 66 verified of 93 as the registry grew from 75 records to 211.
Read the scan →Every credential stayed valid. Every audit log looked normal. Only the model had changed. Three substitution scenarios measured against a live gateway with signed credentials — all detected in under 7 seconds.
Read the brief →