Research Program

Research

Focused, reproducible research into how AI systems and everyday technology can fail, and which practical controls make them safer. Each study starts with a clear question, uses synthetic or public data, and publishes its method, evidence and limitations alongside the results.

Research Agenda

AI Security·Original ResearchPlanned

Evaluating Prompt Injection Risks in Small-Business AI Assistants

Research question: How do different instruction-handling and tool-permission strategies affect the resilience of a small-business AI assistant against prompt injection?

A controlled comparison of defensive design choices for AI assistants that read untrusted content and can take actions, such as answering customer email or updating records.

Method

Build a local test assistant that operates only on synthetic business data.
Run the same injection test suite against a baseline and against each defensive configuration.
Compare input separation, tool permission restrictions, output validation, human approval steps and retrieval trust boundaries.
Score every outcome against a published rubric so results can be reproduced and challenged.

Planned outputs

Test cases and scoring rubric
Results tables with limitations
Reproducible test harness on GitHub
Practical recommendations for small teams

References: OWASP Top 10 for LLM Applications · MITRE ATLASEthics: Synthetic data only. No testing against third-party production systems.

AI Governance·Technical ExperimentPlanned

AI Governance Readiness for Small Businesses

Research question: What is the smallest practical set of governance controls a small business needs before relying on AI tools for customer-facing or decision-making work?

A practical readiness assessment that translates the NIST AI Risk Management Framework and ISO/IEC 42001 concepts into steps a small team can actually carry out.

Method

Map NIST AI RMF functions (Govern, Map, Measure, Manage) to small-business operating realities.
Draft an assessment questionnaire, control inventory and risk prioritization matrix.
Clearly separate direct framework requirements from educational interpretation.

Planned outputs

Readiness questionnaire
Risk register template
Control inventory and governance checklist
Starter policy templates

References: NIST AI RMF 1.0 · ISO/IEC 42001 (concepts)Ethics: Educational resource. It is not a certification, legal advice or a formal compliance audit.

Security Analytics·Technical ExperimentPlanned

Analyzing Authentication Logs for Suspicious Activity

Research question: Which simple, explainable detection rules surface suspicious authentication activity in Linux and Windows logs with an acceptable false-positive rate?

An end-to-end security analytics study: ingesting, cleaning and analyzing authentication logs, then measuring how well each detection performs.

Method

Use public or synthetic authentication datasets with documented provenance.
Build ingestion and cleaning steps, then failed-login and anomaly detection logic.
Measure detections against labeled events and analyze false positives.
Publish notebooks so every chart and number can be regenerated.

Planned outputs

Reproducible notebooks
Detection logic with test data
Visualizations and false-positive analysis
Written findings

References: MITRE ATT&CK T1110 (Brute Force)Ethics: Public or synthetic data only. No personal data from real users.

Publication Standards

Every publication is labeled by type so readers know exactly what kind of evidence stands behind it. Findings are published only after the work has been carried out, and every report includes its limitations, data sources and reproduction steps.

Original Research: An investigation that was actually carried out, with its data and method published.
Technical Experiment: A smaller, reproducible test of a tool, control or technique.
Literature Review: A structured synthesis of published research and standards.
Educational Guide: An explanation of an established concept, with sources.
Opinion / Commentary: A clearly labeled point of view.

Interested in collaborating on AI security or governance research, or reviewing a draft?

Get in touch