Agent vs. Scanner

Registered

LabCyber OperationsProgrammeProject BLUE LIGHT

The question

An unauthenticated scanner is the established way a mid-market firm sees its own attack surface. This study asks whether an AI agent, given exactly the same access, sees more of it.

The method

Lab C built two arms at strict access parity: a fixed-configuration unauthenticated scanner, and an AI agent restricted to the same network-adjacent vantage, with no credentials, no exploitation, and no writes permitted to either. The environment is synthetic and owned, so its true exposures are known by construction. The primary endpoint is coverage of those exposures. A coverage win counts only if precision holds inside a pre-registered guardrail, because an agent that reported everything would otherwise win on noise alone.

Publication transparency

Coverage, precision, and time, each with confidence intervals, whichever way the result falls. A null is a result.

Transparency block

The protocol was frozen before any data existed, and anyone can verify this independently.

Protocol hash: 2e26176ee839c702d38100ff5d546f7c239b67048d42ade6a6b87755d575245e

Grid hash: 8933508f69d1c8b147effd55d4eafc36190c354cf3795984b7e04b539d654368

Bitcoin block heights: 961781, 961784, 961836

Check this yourself

Two separate checks, because they prove two separate things. The OpenTimestamps proof shows that a specific string existed before a specific Bitcoin block. It says nothing about what that string is a hash of — that half comes from the protocol file and the verification script together, which show that the attested string is the hash of the exact pre-registration we say it is. Neither artifact alone proves both; together they do.

# 1. Confirm the attestation was timestamped on Bitcoin
# (needs the OpenTimestamps client: pip install opentimestamps-client)
ots verify freeze_attestation.txt.ots

# 2. Confirm the attested string is this protocol's hash
# (stdlib + PyYAML only, no bridgham-lab checkout needed)
python3 verify_protocol_hash.py protocol.yaml

Run ots verify and python3 verify_protocol_hash.py from the same directory as the downloaded files above. ots verify expects the target file (freeze_attestation.txt) alongside its .ots proof.

The frozen protocol is released alongside these hashes, and the file below is the exact text that was frozen.