A Fide research domain
How do we make autonomous cyber defense dependable?
AI defenders need to stop attacks without harming the systems they protect. Fide studies the evidence, controls and oversight that could make this possible, moving from investigations of public records to controlled comparisons of defensive methods.
Featured work
Visual investigation · September 30, 2026
One address carried instructions for other computers to act. We followed a known sequence through the archived records to ask what ran, what was requested and what data appeared in an outbound request.
Read the investigation →From evidence to defense
Our investigations examine what incident records establish, what reports leave unresolved and where controls stop short. We use those findings to develop testable questions about autonomous response.
Analysis
We checked claims in AI-written incident reports against the underlying records. Better overall scores could coexist with surviving errors.
The question for defense
Visual investigation
We reconstructed a known sequence across services, separating submitted instructions, recorded requests and recorded output. Transluce discovered the activity.
The question for defense
These questions inform our planned autonomous-response study. The investigations do not establish how well an AI defender would perform.
See the experiments these findings motivate →Public research tool · Preview
The Agentic Cyber Explorer is a sourced, regularly updated record of AI agents in cybersecurity.
It chronicles attacks carried out with AI agents and attacks on them, capability evaluations, defenses, and policy. Each claim links to its sources and carries a status that changes as new work arrives. Key questions summarize where the evidence stands, and research openings mark where it runs out, including questions tied to this program.
Public research tool
An AI defender may take the right-looking action while leaving the outcome uncertain.
The Defense Evidence Lab uses public records and published evaluation methods to help readers ask what happened, what changed, and what still needs to be verified before trusting a response or report. Where the explorer is the record, the Lab is the practice.
Open the Defense Evidence Lab ↗Current studies
Investigations surface questions worth testing. Our studies turn those questions into comparisons, with methods and findings added to each project’s record as the work develops.
Flagship study · Planned
When should an AI cyber defender act, wait, or hand control back to a human?
A proposed study of when additional oversight reduces harmful intervention without making autonomous defense ineffective. We will compare permission checks with escalation and approval under uncertain evidence.
Where it stands
Study direction selected. Collaborator, environment and final protocol remain to be qualified; experiments have not begun.
Next milestone
Qualify one defensive task and simulation with a cybersecurity collaborator, then run a feasibility pilot before fixing the main comparison.
Cybersecurity
Protocol developmentFide is developing a study of whether targeted retesting catches meaningful performance declines, or gives false reassurance. We begin with AI malware-report analysis, comparing smaller retests against complete benchmark reruns.
Protocol and evaluation tooling in development. No model-performance findings yet.
Updated
Publications
Analysis
Published
Fide traces an AgentDojo scoring correction through evaluator selection, older benchmark versions and the records excluded by our own audit.
Cybersecurity
Methods and evidence →Analysis
Published
Fide AI checked DSEWiki reports against incident records and tracked 78 follow-ups. Higher scores often coexisted with earlier errors or unsupported claims.
Cybersecurity
Explorer setup and screenshots ↗Methods and evidence →Evaluation methods
Fide AI’s approach to embedded evaluations combines frontier AI engineering, safety-critical systems research and humanistic and social inquiry to study trustworthy AI.
Research directions
Controlled response is our first focus. Verification of repair and recovery is the next direction; resilience across teams of defenders is a longer-term question. Each step needs suitable cases, collaborators and resources before experiments can begin.
01 · First focus
Can an AI defender stop an attack without disrupting the systems it is meant to protect?
Begin with the decision to intervene. Our planned study compares permission checks with additional oversight, measuring containment alongside service disruption.
02 · Next direction
How do we know an AI-generated fix actually restores security?
Extend the question from stopping an attack to establishing that a repair worked. A first study needs a reproducible repair case and a software-security collaborator.
03 · Longer-term direction
Can a team of AI defenders keep protecting a network when one agent is compromised?
Study how failures spread across cooperating defenders once we have suitable tasks and evidence checks. This depends on additional methods, resources and multi-agent expertise.
Selected research elsewhere
Benchmarks, methods and findings from researchers advancing defensive AI and its evaluation.
Cybersecurity
Meta & CrowdStrike researchers
Benchmark paper · 2025
Existing report-based tasks and answer keys for evaluating AI assistance in defensive analysis. Fide’s current study uses the malware-analysis portion; it does not measure live incident-response performance.
Source reviewed
Cybersecurity
Anthropic
Research overview · 2025
Work on vulnerability discovery and patching, with a call for evaluations of defensive capabilities. A useful starting point for studying effective defense; the authors also discuss the gap between benchmarks and real security operations.
Source reviewed
AI monitoring
Anthropic Fellows, Redwood Research & Anthropic researchers
Research & benchmark · 2026
A study of monitor failures using synthetic agent transcripts. A starting point for investigating oversight and shared blind spots, with limits on how synthetic cases represent deployed systems.
Source reviewed
Cybersecurity
UK AI Security Institute
Research agenda
A technical research agenda covering cyber capabilities, safeguards, and risks from advanced AI systems.
Source reviewed
These are the named organizations’ contributions. Inclusion does not imply partnership or endorsement.
Follow the research
Interested in Fide’s cybersecurity research? Request updates on this topic by email, or subscribe to Fide’s broader essays and research notes.
Request topic updates →Opens a draft in your email app. Send it to request updates.
Subscribe to all Fide updates on Substack ↗Contribute to the research
Opens our research inquiry form with this topic included.