Pwnshow's work is organised as a continuing, numbered series of investigations into vulnerability. Each entry is a self-contained body of work; together they trace a single inquiry across substrates — silicon, protocols, markets, institutions, models, persons.
Cyber policy when control on AI is lost. Threats amplified by open-weight LLMs; the mitigation gap in the AI Act and GPAI Code of Practice; standardisation pathways.
Outputs & registers — arXiv preprint · Pwnshow article · ETSI SC 2025 · EU AI Office consultation · FOSDEM 2026 · ETSI TC SAI membership · EPP's Think Twice 2026 talk
Read the case →Public advisories, regime shifts, and what a decade of data reveals about the security of compartmentalised systems.
Outputs & registers — arXiv preprint · Zenodo replication bundle (forthcoming)
Read the case →Surveillance turned on itself: GAN-hallucinated portraits on powered-off e-ink; surveillance imaging repurposed for elegy; a typeface that replaces euphemism with honest language.
Outputs & registers — Bangkok Art Biennale · Ars Electronica · National Portrait Gallery · Hariban Award honours
Read the case →The first private-sector code of ethics for the acquisition of vulnerability information and cybersecurity capabilities.
Outputs & registers — NATO CyCon U.S. · ACSC Canberra · EC JRC invited talk
Read the case →Game theory of the zero-day market: extortion, cooperation, and the disciplining power of disclosure.
Outputs & registers — AusCERT · HITB · CODE BLUE · PHDays
Read the case →Nobody but us: an asymmetric backdoor in RSA key establishment, and what one poisoned CA certificate does to the entire X.509 trust architecture.
Outputs & registers — HITB · DeepSec · ZeroNights · WhiteHat Top 10 Web Hacking Techniques of 2015
Read the case →The first information-security prediction market: security-event futures as forward-looking indicators, telling good security from mediocre.
Outputs & registers — IFIP TM keynote · RSA Conference Europe · Metricon
Read the case →Where it began: fault attacks on cryptographic modules and the reliable lifetimes of keys.
Outputs & registers — FDTC/CHES · LNCS · COSIC, K.U. Leuven
Read the case →Pwnshow (formerly secYOUre) · Rome, Italy · Investigating vulnerability since 2010. © 2026 Pwnshow
