InfoResearch
Five cyber resilience challenges and review records
The KCBCA Signals Issue 2 editorial examines five cyber resilience challenges and the review records needed to keep rights, evidence, and responsibility verifiable after systems fail.
Research
Findings from KCBCA Signals and other research, summarised.
InfoResearch
AI red teaming: what to test in each situation
AI red teaming tests how systems fail under deception. Checks vary for public-sector AI, financial approvals, high-impact deployments, and the testing agents themselves.
InfoResearch
Blockchain security: proof and its limits
Hashes, signatures, and verification histories can add a proof layer to security assurance while keeping originals private. Unchanged records still do not establish truth.
InfoResearch
AI agent security: permissions, limits, and verification
Agents act directly in business systems. Ten checks cover permission separation, transaction limits, independent verification, gradual delegation, and failure testing.
InfoResearch
SBOM management beyond the component list
An SBOM records software components, versions, and origins. It needs updates with deployments, evidence tracking, and a wider map of dependencies beyond code.
InfoResearch
Hash values: how to verify files and understand the limits
Hashes help check files, deployed code, and reports for changes. Built-in commands can compare fingerprints, but truth, authorship, and interpretation require separate checks.
InfoResearch
AI agent payments: limits, checks and records
AI agents are already making payments, and protected keys do not prevent unwanted approvals. Signals contributions examine spending limits, independent checks, human review and kill switches.
InfoResearch
Deepfake fraud: verify before transfers and signatures
AI-generated faces and voices can induce transfers and wallet approvals. A Hong Kong fraud case and Signals scenarios show why protecting keys must be paired with independent verification.
InfoResearch
When smart contract patches become attack roadmaps
A public patch can reveal clues to attackers. Private AI-assisted testing should verify root causes and alternative attack paths while treating premature disclosure and incomplete fixes separately.
InfoResearch
Supply chain attacks and the need for verifiable security evidence
AI helps attackers find weak suppliers and software dependencies faster. Supply chain security needs current, verifiable evidence, controlled package intake, and visibility into changes.
InfoResearch
Prompt injection and the need to separate AI permissions
Instructions hidden in external content can become real actions. Three cases show why analysis, approval, publication, and signing need separate permissions and checks outside AI.