Terms of use

This site publishes security research. These terms cover using it, holding an access code, and what you may do with the resources you download.

The embargo

Until 00:01 UTC on 14 September 2026, everything on this site is under a coordinated disclosure embargo. If you hold an access code, you received it so that you could prepare: read the research, verify it, brief your organisation, or write about it. You agree not to publish, broadcast, or otherwise make public any part of this material, or its substance, before that moment.

Sharing an access code is a breach of these terms. Codes are issued to named recipients and their use is recorded, which theprivacy notice sets out in full. If you need access for a colleague, ask us and we will issue one.

We may withdraw a code at any time. In practice we withdraw one when we believe it has been shared, and we would rather issue a second code than withdraw the first, so tell us if a code has gone astray.

Handling markings

Resources carry Traffic Light Protocol markings, and the marking governs how far you may pass a resource on, independently of whether your code opens it. The TLP page explains each marking. Controlled material under /intel/ stays restricted after the public release and does not open with the rest of the site.

Using and citing the research

Once the embargo lifts you may quote from and cite this research freely, including in commercial reporting and in security products, as long as you attribute it to nDiligence and do not present it as your own. Cite the versioned resource name and the version DOI printed on each release page rather than the living URL, so that a citation still means what it meant when you made it.

Figures may be reproduced with their caption and credit line intact. A caption and credit sheet is published in the press area for that purpose.

You may not present modified research as ours, or attribute conclusions to nDiligence that this material does not support. Where a claim here is calibrated, the calibration is part of the claim.

The demonstrations

The live demonstrations run against resources we control, for the purpose of showing behaviour this research describes. They are not a tool, and they are not offered as one. Do not use anything on this site as a component of an attack on a system you are not authorised to test.

No warranty

This research is published as it stands. We have taken care over it and we document our method in the provenance appendix, and we still do not warrant that it is complete or that it is correct for your environment. Decisions about your own systems remain yours. To the extent the law allows, nDiligence is not liable for loss arising from use of this material.

The corpus keeps moving. Anything here may be revised, and revisions are recorded rather than made quietly.

Getting in touch

Questions about these terms, about a code, or about anything on this site: the ATG team.