The same kind of object
A critical vulnerability chain in a codebase is the same kind of object as an attack on a cryptographic scheme: a sequence of operations that composes into something dangerous, drawn from a space too large for manual enumeration. Static analysis finds known patterns. We are building systems that search for novel ones.
Program structure as the substrate
Our offensive security work uses structured program representations (code property graphs, taint analysis, binary lifting) as the substrate over which AI agents operate. The agents do not classify known vulnerability types. They search for multi-step exploitation paths that no predefined signature would match, scored against the actual behavior of the target system.
One thesis, two oracles
This is a second application of the same thesis: evolutionary search over a combinatorial space of programs, guided by a domain-specific oracle. In cryptanalysis, the oracle is the Lattice Estimator. In offensive security, the oracle is the target system itself.
SecAgent
SecAgent is the program-analysis layer. Its first pipeline takes firmware, binaries and protocols to a cryptographic bill of materials and a post-quantum migration plan. Post-quantum migration for IoT fleets shows how it applies to device fleets. It runs offline, without an LLM, and every run can be replayed. After migration, the same pipeline re-scans the target to verify closure independently.