Offensive research, pointed at defense.
This is XS1 Cyber's research agenda. Offensive capability is studied so it can be defended against — every area runs inside authorized, instrumented environments with a full action log, and several are available to partners under contract.
- 01Zero-day discovery
- 02Exploit chaining
- 03Proof of exploit (PoE)
- 04Evaluation harnesses
- 05Autonomous red-teaming
- 06Defensive hardening
01 / Research areas
The research agenda
Areas marked Available to partners can be contracted under written scope; the others are internal research that feeds them.
- 01
Zero-day discovery
Reasoning from a specific configuration to a specific consequence, rather than recalling a vulnerability class.
- › Trust-boundary analysis
- › Documented vs. actual behavior
- › Exploitable vs. theoretical triage
Internal researchStudied in Project North Star - 02
Exploit chaining
Composing individually low-severity findings into the path a real attacker would take.
- › Privilege-flow modeling
- › Multi-step path construction
- › Impact under real constraints
Available to partners - 03
Proof of exploit (PoE)
Minimal, non-weaponized artifacts that demonstrate impact without leaving usable weaponry behind.
- › Lab-scoped reproduction
- › Evidence a defender can act on
- › No release of working tooling
Available to partners - 04
Evaluation harnesses
Instrumented environments that measure capability honestly, including where models fail.
- › Full action logging
- › Calibration under uncertainty
- › Regression across model versions
Internal researchCore to Project North Star - 05
Autonomous red-teaming
Long-running agent probing that keeps memory of prior findings instead of annual snapshots.
- › Persistent state across weeks
- › Scope encoded, not assumed
- › Escalation with audit trail
Available to partners - 06
Defensive hardening
Findings fed back into detection, configuration, and architecture changes that close the path.
- › Detection engineering
- › Configuration remediation
- › Architecture-level fixes
Available to partners
02 / Defensive translation
Every offensive result becomes something a defender can use.
Offense is the method; defense is the product.
- A zero-day is foundA detection rule and patch guidance for the team that owns the system.
- An exploit chain is provenThe cheapest break point, so defenders can cut a single link.
- Proof of exploit landsBounded evidence that sets real severity, not a theoretical score.
- An evaluation runsAn honest measure of where a model helps a defender and where it fails.
03 / Rules of engagement
Authorized, contained, stoppable, never weaponized.
XS1 Cyber works under explicit constraints. They apply to every research project and every engagement.
Written authorization first
Work runs only against systems whose owner has authorized it in writing, within a scope agreed before anything starts.
Contained, instrumented environments
Capability demonstrations run in lab replicas and isolated ranges, instrumented end to end, with destructive actions disabled.
A named owner can stop it
Scope and testing windows are set in advance, and a named owner can pause or revoke at any time.
Nothing is weaponized or released
Proof-of-exploit artifacts are minimal and non-weaponized, working offensive tooling is never distributed, and evidence is retained for review.
XS1 Cyber
Have a system to test, or a research problem to pose?
Tell us what you are working on. We reply within 1–2 business days; qualified partners receive more detail after an initial conversation.