Skip to content
Edictum Labs, home
About

A founder-led
security practice.

Edictum Labs is an independent, research-led offensive security practice working remotely across Europe. It does slow, detailed technical work and says plainly what it found.

Form
Independent · founder-led
Base
Europe · Remote
Why it exists

Depth is the whole point.

Most security work is organised for coverage and throughput. The deepest findings come from the opposite: time and focus on one system, and curiosity about how it works.

Edictum Labs was founded to work that way by default. The work is narrow by choice. A few questions at a time, each followed until it ends in a proof or a disproof.

The standard is to understand a system well enough to say something true about it, and then say exactly how much of it we proved.

How it works

Small, senior, and direct.

The person you write to is the person who does the research.

There is no layer of account managers, no handoff, and no incentive to manufacture findings. The practice is open to working with others on the questions it is already chasing: joint vulnerability research, coordinated disclosure, tooling, papers or talks, and open-source work on Edictum.

Arnold Cartagena founded the practice and leads it. It stays small on purpose.

Principles

What the work is held to.

01

Depth over coverage

A scanner checks each part against patterns it already knows. The bugs we look for sit between parts, so we read how the parts fit together.
02

Evidence over assertion

In our write-ups, every claim carries its evidence state: executed, observed, repeated, or only read in source. What we did not show, we mark as not demonstrated.
03

Causes over symptoms

A patched instance is not a solved problem. When one path has the check, we look for the sibling paths that do not, so the fix can cover all of them.
04

Clarity over theatre

A write-up says what the evidence shows and what it does not: lab or production, known bug or new one, what ran and what we only read.
Beyond the Labs

A separate product project.

Alongside the Labs, the founder builds Edictum, a separate open-source product for runtime governance of AI agents. It is not a Labs service.

The research and the product stay apart. Research is never a sales channel for Edictum.

Projects

Edictum

Runtime governance for AI agents. It checks each tool call in your own process, before the tool runs. A separate product, built independently of the Labs' research.

About Edictum
Location

Europe, remote.

The practice works remotely, on Central European Time, with collaborators across Europe and beyond.

We work remotely by default, and meet in person in Europe when a collaboration needs it.

Collaboration

Working on the same questions?

Write to arnold@edictum.ai about a collaboration, or see the contact page for every option. The person who replies does the research.

Open to
Joint research · Disclosure · Tooling
Reply
Direct, from the researcher
Location
Europe · Remote