Agent vs. Scanner

Registered

LabCyber OperationsProgrammeProject BLUE LIGHT

Study Facts

Status: Registered
Question: An unauthenticated scanner is the established way a mid-market firm sees its own attack surface. This study asks whether an AI agent, given exactly the same access, sees more of it.
Design: Lab C built two arms at strict access parity: a fixed-configuration unauthenticated scanner, and an AI agent restricted to the same network-adjacent vantage, with no credentials, no exploitation, and no writes permitted to either. The environment is synthetic and owned, so its true exposures are known by construction. The primary endpoint is coverage of those exposures. A coverage win counts only if precision holds inside a pre-registered guardrail, because an agent that reported everything would otherwise win on noise alone.
Pre-Registration: 2e26176ee839c702d38100ff5d546f7c239b67048d42ade6a6b87755d575245e
Results: Coverage, precision, and time, each with confidence intervals, whichever way the result falls. A null is a result.

The Question

An unauthenticated scanner is the established way a mid-market firm sees its own attack surface. This study asks whether an AI agent, given exactly the same access, sees more of it.

The Method

Lab C built two arms at strict access parity: a fixed-configuration unauthenticated scanner, and an AI agent restricted to the same network-adjacent vantage, with no credentials, no exploitation, and no writes permitted to either. The environment is synthetic and owned, so its true exposures are known by construction. The primary endpoint is coverage of those exposures. A coverage win counts only if precision holds inside a pre-registered guardrail, because an agent that reported everything would otherwise win on noise alone.

Publication Transparency

Coverage, precision, and time, each with confidence intervals, whichever way the result falls. A null is a result.

Pre-Registration Record

The protocol was pre-registered before any data existed, and anyone can verify this independently.

Protocol hash: 2e26176ee839c702d38100ff5d546f7c239b67048d42ade6a6b87755d575245e

Grid hash: 8933508f69d1c8b147effd55d4eafc36190c354cf3795984b7e04b539d654368

Block heights: 961781, 961784, 961836

Check This Yourself

Two separate checks, because they prove two separate things. The timestamp proof file shows that a specific string existed at a specific point in time. It says nothing about what that string is a hash of — that half comes from the protocol file and the verification script together, which show that the pre-registered string is the hash of the exact pre-registration we say it is. Neither file alone proves both; together they do.

# 1. Confirm the pre-registration record was timestamped
# (needs the ots CLI: pip install opentimestamps-client)
ots verify freeze_attestation.txt.ots

# 2. Confirm the pre-registered string is this protocol's hash
# (stdlib + PyYAML only, no bridgham-lab checkout needed)
python3 verify_protocol_hash.py protocol.yaml

Run ots verify and python3 verify_protocol_hash.py from the same directory as the downloaded files above. ots verify expects the target file (freeze_attestation.txt) alongside its .ots proof.

The pre-registered protocol is released alongside these hashes, and the file below is the exact text that was pre-registered.

Cite This Study

Bridgham Technology Institute. (n.d.). Agent vs. Scanner. https://bridghaminstitute.com/studies/s1