DevelopmentIn progress
Apply the learning
Assemble the environment, document the equipment and permitted targets, and establish reproducible configurations.
Evidence: inventory · lab scope · reset procedure
Internal research & infrastructure
Build carefully.
Verify what matters.
TVI is developing an internal environment for cybersecurity learning, controlled research, and the gradual construction of hardened company server infrastructure.
Proposed first project
Community services portal access control laboratory
The first project will use a local demonstration portal to investigate whether authorization stays consistent from a web request to a background job and a later download.
Two fictitious organizations, synthetic users, and generated records will provide the test conditions. The planned scope includes participant, coordinator, organization administrator, and reviewer roles, together with a limited record and export workflow.
The question: Can a change in role or organization access leave an export or download available to someone who should no longer receive it?
The project is planned. No findings or completed security tests are claimed at this stage.
A reproducible method
From a permission rule
to a checked result.
Each experiment will document the initial conditions, the action, the expected behavior, the observed result, and the outcome after a fix.
- 01
Define the boundary
Map identities, roles, organization context, records, jobs, and download permissions.
- 02
Run a controlled experiment
Use isolated systems and synthetic fixtures to examine one documented security question.
- 03
Validate the improvement
Review the result, test the mitigation, and retain a regression test and reproducible record.
The infrastructure roadmap
A development lab today.
A foundation for TVI tomorrow.
The goal is a company server environment supporting internal applications, research evidence, technical documentation, and other authorized operations.
StagingPlanned
Harden and test
Verify restricted administration, service permissions, updates, monitoring, and backup restoration before relying on a configuration.
Evidence: access checks · logs · restore test
OperationsPlanned
Support company services
Promote reviewed configurations into operational use while keeping experimental targets separate.
Evidence: service inventory · recovery procedure
Research charter
Defined scope.
Human review.
Defensive value.
Research will be limited to systems TVI owns or is explicitly authorized to assess. The initial portal project will use entirely synthetic information in an isolated local environment.
AI-assisted work will use scoped permissions and human review. Experiments will remain separate from operational company services. Seeded teaching defects and any genuine findings will be identified distinctly.
Intended outputs include a threat model, permission matrix, reproducible environment, test results, validated fixes, and reviewed technical writeups.
For research inquiries or security reports, email security@tribalvitality.com.
Read the complete charter