Research & Development

The discipline: test it, do not trust the datasheet

Security technology is sold on claims that are almost never independently verified. A camera specified for a certain distance was measured under conditions your site does not have. A lock rated to a standard was rated in a laboratory, not on a door with a gap. A "military-grade" anything is a marketing phrase with no defined meaning. A device promising to detect surveillance detects what its firmware was written to detect and is silent about the rest. And a vehicle described as bulletproof is protective against a specific threat, at a specific angle, at a specific range, with a specific round — and vulnerable outside those parameters.

Our research and development practice exists because that gap between claim and behaviour is where clients lose money and, occasionally, worse. The work is empirical: define the threat, define the environment, define the test, run it, and write down what actually happened. Where a product performs, we say so. Where it performs only inside conditions the brochure did not mention, we say that too, and it is usually the more useful finding.

Physical research and development

Detection and surveillance systems. Camera and sensor evaluation against real site conditions rather than specification-sheet conditions: Arizona glare and thermal load, dust, monsoon, the particular problem of a lens pointed at a sunlit parking area at four in the afternoon. Analytics tested against the false-alarm rate they actually produce on your site, because an analytic that cries wolf twelve times a night is worse than no analytic at all — operators stop looking.

Access control and physical barriers. Reader and credential technology assessed for the attacks that exist rather than the ones vendors discuss, door hardware assessed as installed, and the ordinary failures that defeat expensive systems: propped doors, unbalanced closers, tailgating, and the badge that was never revoked.

Vehicle protection systems. Armour, glazing, run-flat systems and vehicle integration, evaluated against defined ballistic threat levels rather than adjectives. Protection is a level, a coverage envelope and a set of transition points — the pillar, the door edge, the glass-to-frame join — and a serious specification names all three. Weight, braking, suspension and handling consequences are part of the assessment, because an armoured vehicle that cannot stop is a different hazard, not a solved one.

Counter-surveillance and technical protection. Detection equipment tested against the emitters and storage devices that are genuinely in circulation. This is the area with the widest gap between price and performance, and the reason we run a store at all: clients kept buying expensive devices that were not appropriate to their problem.

Technical and cyber research

On the digital side the work is method development as much as product evaluation. Forensic tooling changes constantly and so do the artefacts worth pursuing: new device encryption behaviour, new application data structures, cloud sources that appear and disappear, the effect of solid-state storage behaviour on recoverability. We validate tools against known data sets before they touch a client matter, because a forensic conclusion drawn from an unvalidated tool is an opinion with a logo on it.

We also build internal tooling — parsers, correlation and reporting workflows — where existing products do not answer the question, and we test detection and monitoring products the way an adversary would rather than the way a demonstration does. Findings feed directly into our forensics and cyber practices, which is the point: research that does not change delivered work is a hobby.

How an evaluation runs

A client engagement here usually starts with a procurement decision that somebody is uncomfortable making. The sequence is consistent. First, the threat and the environment are written down in specific terms — what are we protecting against, at what level, in what conditions, operated by whom. Second, the criteria are agreed before anything is tested, so the result cannot be reverse-engineered to justify a preferred vendor. Third, the test is run, documented, and repeated where the result is marginal. Fourth, the report states findings and confidence separately, names what was not tested, and gives a recommendation with its reasoning exposed rather than a score.

We take no commission, referral fee or vendor incentive on products we evaluate. That is a structural requirement rather than a preference; an evaluator paid by outcome is not an evaluator. Where we do sell equipment, it is disclosed plainly, and where a client's best option is a product we do not carry, that is what the report says.

Limits we work inside

Export control. Ballistic protection, armoured vehicle technology, certain sensors and certain cryptographic and intrusion-related software sit under United States export control — the ITAR and the EAR — and the restrictions apply to information and technical assistance, not only to shipped hardware. Sharing a design or a test result with a foreign national can itself be an export. Anything with an international dimension is assessed for licensing before work begins, and where the answer is that it requires an authorisation we do not hold, that is the end of the conversation.

Interception devices. Federal law makes it a crime to manufacture, sell, or possess a device whose design renders it primarily useful for the surreptitious interception of communications. We do not build, sell, source, or advise on acquiring them, and we treat a request for one as a reason to end the engagement rather than a niche to serve.

Drone mitigation. We do not develop, sell or deploy equipment that jams, spoofs or disables aircraft. Detection is lawful; mitigation authority in the United States is held by a short list of federal agencies and by nobody else.

Offensive tooling. We do not develop or supply exploitation tooling, malware, or capabilities for accessing systems and accounts. Our cyber research is defensive, and the products of it are used on systems we are authorised to test.

Absolute claims. We will not certify a product as bulletproof, unhackable, undetectable or tamper-proof, because none of those words describe anything real. Everything is rated against a defined threat, and we will give you the rating and the envelope instead.

Frequently asked questions