Independent security research and services initiative
Security research for systems that act.
Contextual Trust explores how organisations can secure AI agents, strengthen digital trust and prepare for cryptographic change. We translate research into practical guidance, architecture and security services for teams building and operating complex technology.
Start the free Security Check
See proposed services →
Available now: a self-reported Security Check and educational library. Guided services and security-agent capabilities are in development. This site does not scan, monitor or change your systems.
Insights
Start with the practical questions.
Short explainers and original conceptual diagrams for teams considering their next steps.
1. Giving an AI agent the right authority
An agent may need to retrieve information or propose an action. That does not mean it should inherit every permission held by the person who asked. Identify the agent, scope its permissions to the task, and check the relevant rules at the point where an action is committed.
1 · Request2 · Scoped authority3 · Action check4 · Evidence
A useful review question: if approval expires while a workflow is waiting, can the system detect that change before carrying out the action? Design an explicit route for review when conditions cannot be established.
Source: NIST: identity and authority of software agents.
2. Where to begin with post-quantum readiness
Start with what exists. Identify the services that rely on public-key cryptography, where certificates and keys are managed, and which components depend on suppliers. The result is a starting inventory, not proof that a system is quantum safe.
1 · Locate2 · Assess3 · Plan4 · Test
Prioritise critical services and data that needs protection for a long time. Ask suppliers how their products will support migration, and test compatibility before changing production systems. Timelines and algorithm choices depend on the organisation and applicable guidance.
Source: Australian Cyber Security Centre: questions to ask vendors.
3. Certificates: a small dependency with a large footprint
Certificates support trust between systems, but their ownership and renewal can be spread across teams and vendors. A useful first step is to map where certificates are used, who owns them, when they expire and how they are replaced.
1 · Discover2 · Assign owner3 · Monitor4 · Renew
Use the map to identify critical dependencies and missing owners. Include certificate lifecycle in broader resilience and cryptographic transition planning.