Tim McAllister · Public research resources
Research & source index
Find practical guides, public essays, and source-backed incident data on the operating side of digital trust. Start with a question, follow the evidence, and keep each source’s scope attached to the claim.
Four connected subjects
Each guide provides an at-a-glance summary, anchored sections, practical questions, and sources with scope notes. Review dates below come from the guides themselves.
Device & machine identity
Can you isolate one compromised system without breaking everything that depends on it?
Device trust · Device and machine identity · Device attestation · Matter device attestation · IoT and OT security
Device identity from manufacture to retirement
A practical architecture for provisioning, attestation, signed updates, recovery, and evidence across the life of a connected product.
When quorum closes the conversation too early
A proposed approval pattern that preserves a binding decision and the full review record for trust lists, signing releases, and other consequential changes.
Software assurance
Can you connect a shipped product to its components, release approval, and next security update?
Software supply-chain security · Build provenance · Code signing · Product security evidence
Software assurance: make the product evidence usable
A practical operating model for secure releases, vulnerability response, and EU Cyber Resilience Act readiness.
Funding digital trust with your own evidence
Build a decision around operating costs, required capabilities, and testable risk reduction. Make every assumption visible.
Cryptographic change
Which dependency will stop your next certificate or algorithm change from reaching production?
Public key infrastructure (PKI) · Certificate lifecycle · Cryptographic agility · Post-quantum cryptography (PQC)
PQC readiness: the first five actions
Five practical actions that turn post-quantum planning into an inventory, tested deployment paths, and supplier commitments.
PQC migration: build the ability to change cryptography
A practical architecture and roadmap for moving from an algorithm inventory to tested post-quantum deployment.
PKI operations: from renewal alerts to a managed service
Build certificate operations that can handle shorter lifetimes, changing trust policies, and the next algorithm transition.
AI trust in practice
Can you explain an agent’s authority, stop its actions, and reconstruct what happened?
AI-agent identity · Delegated authorization · Runtime policy · Content provenance
AI agents need authority you can constrain and revoke
A field brief on workload identity, delegated permissions, runtime policy, and the evidence needed when an agent gets something wrong.
An operating model for production AI security
Connect model releases, agent authority, data provenance, and runtime evidence so an AI system can be evaluated, constrained, and stopped.
Recent writing
Public essay descriptions and original publication dates. Archived essays retain their original dates and publication history; they may describe an earlier technical or policy context.
AI Agents Hacked Hugging Face Using Access OpenAI Gave Them
The agents got past OpenAI’s firewall by using a software server OpenAI had set up for them, and the tests kept running through two months of warning signs. A reconstruction from the incident reports, and what it means for any company deploying AI agents.
A Cyberattack Forced Supermarkets to Destroy Food. The Bill Could Reach Tens of Millions.
France’s refrigeration attack hit about 700 supermarkets. What manufacturers need to learn about remote access, local control and OT security.
The 24-Hour Clock Is Already Running
CRA reporting duties are live. Can your team identify affected product versions and file an early warning within 24 hours of awareness?
The Script Kiddie Has a Copilot Now
An exposed résumé request leads to a harder question about how much an attacker needs to know
When Software Starts Acting for US
Woz, AI agents, and what SELECT26 revealed about the next era of building.
When Great Writing Becomes Cheap, Is Your Point Worth Reading?
AI can supply the craft. You still owe the reader a point worth making—and evidence that it’s true. Three checks before you publish.
Beyond the OT isolation assumption
Forescout’s segmentation findings challenge the assumption that OT is isolated. NIST’s new draft shows how stronger architecture, device identity, trusted updates, and tested recovery can narrow the gap.
The surveillance platform that outlived the account
Anthropic banned the account used to engineer Mali’s Lakana 360 surveillance platform. The locally deployed system was unaffected.
Browse all public writing → All 46 article descriptions as JSON →
Data, methodology & feeds
- Writing RSS feed
- Public article titles, summaries, original publication dates, and canonical links.
- AI cybersecurity incident dashboard
- Curated public reports, disclosed security research, evidence qualifications, outcomes, and editorial lessons.
- AI incident world map
- Zoomable affected-region map with documented geography, source evidence, and an explicit list of reports without confirmed locations.
- Incident register methodology
- Coverage, disclosure dates, evidence limits, and the distinction between observed incidents and demonstrations.
- AI incident JSON dataset
- The public incident register with its source links and review metadata.
- AI incident RSS feed
- Public entries from the AI incident register. Reader instructions explain RSS and provide the feed address.
- Forcing Function Calendar
- Dated digital-trust requirements and planning events with source links and scope notes.
- AI Trust Market Report
- Public report landing page. Subscriber-only report content is outside this catalog.
Citing and checking this work
- Cite Tim McAllister, the exact title, the canonical page URL, and the date shown on that page. Include your access date when a page can change.
- Article datePublished is the original publication date, including for migrated articles. A guide reviewedAt date records its stated review date; it is not an original publication date.
- Link to an existing section anchor when citing a specific guide finding. For requirements, technical specifications, or vendor findings, consult and cite the linked primary source as well.
- Treat operating recommendations and incident lessons as the author's analysis. A linked vendor or researcher claim is not independent verification or an endorsement.
For the incident register, include the report identifier, linked source publication dates, the register’s stated review date, and your access date. Its methodology explains coverage and evidence limits.
Scope, sources & disclosure
Personal views. This site does not speak for DigiCert or for the authorities and vendors it references. The checklists, operating frameworks, and lessons are my recommendations and analysis. Linked authorities define their own requirements; verify product, version, and jurisdiction-specific obligations against the current primary material.
Source links identify the origin of a statement. Preserve distinctions between a standard’s requirement, a vendor’s or researcher’s reported result, an independently reported event, and my interpretation. A source link alone does not establish independent verification.
Guide review dates and article publication dates describe different events. This index does not assign new publication dates, review status, or report versions. The public market-report landing page explains that report’s access; protected material is not reproduced here.
Suggest a sourced correction or discuss a research question →