All research questionsFIDE RESEARCH QUESTION / 01 01 / WHAT THE RECORD CAN SAY 02 / WHAT REMAINS OPEN 03 / A MORE DECISIVE TEST OBSERVATIONS A STUDY WOULD NEED
When should a defender act, wait, or hand control back?
An intervention may stop an intrusion while interrupting a service people need. The research question is how to balance those consequences under incomplete evidence.
Planned studyFide proposes comparing permission checks with additional escalation and approval. The comparison must account for security outcomes, disruption and review effort together.
When does oversight prevent harmful intervention, and when does waiting make the outcome worse? The proposed study has not yet produced experimental findings.
Hold the defensive task and resources comparable. Include benign activity, genuine intrusions and ambiguous observations, and record proposed as well as executed actions.
PROPOSED TEST · NO RESULT CLAIMEDWhat would change the answer?
- Containment
- Service disruption
- Authority violations
- Response delay
- Review effort
LINKED PUBLICATIONS
Follow the evidence and its limits.
Source type and limitation are kept visible. A research plan is not an observed outcome.
01
RESEARCH PLAN · Fide AI
02When the Defender Becomes the Threat
Task qualification and a feasibility pilot remain ahead. No defense-performance findings are reported.
TOOL · CAGE Challenge organizers
03CAGE Challenge 4
Simulation results depend on the task, observations, action space and opponent. Transfer to operational networks requires validation.
VENDOR REPORT · Microsoft
Rethinking security for the age of AI
Vendor-reported capabilities. Any-crash and target-vulnerability success are different measurements and must not be conflated.