Seeing the Intention: The Warning Came Before the Deployment

Project Umbral — An experiment in Cognitive Biohacking, artificial intelligence, and the exploration of cybersecurity risks before they materialize.

What if we could explore a cybersecurity risk before the technology involved had even been deployed?

Not by predicting the future. Not by exploiting a vulnerability. And certainly not by claiming to know what hasn't happened yet.

But by approaching a problem from a perspective that conventional security assessments might not immediately consider.

This is the story of Project Umbral, one of our early experiments with Intention, an initiative developed within Grupo Oruss' Division 81.

And it began with a conversation.

A cybersecurity exercise without a system to attack

We invited a technology company specializing in software engineering for financial institutions to participate in an experimental research session.

The company worked in an environment where cybersecurity, availability, and operational reliability were essential.

We weren't there to perform a penetration test.

Instead, we wanted to explore something less conventional: the uncertainties surrounding technological decisions that had not yet been implemented.

During a video call, we discussed their infrastructure, security concerns, and upcoming changes. We asked about potential risks they were unsure of. Not necessarily known vulnerabilities, but areas where something might be overlooked.

At one point, a member of their technical team mentioned that they were preparing to deploy new Web Application Firewalls (WAFs) to protect services and domains associated with their clients.

The deployment was scheduled for the following weeks. Nothing unusual. Just another security improvement.

But that detail caught our attention.

The infrastructure was about to change. What risks might emerge from that change? Humans? Machines? Just some strange situation?

That became the focus of our experiment.

What do we mean by "Seeing the Intention"?

Most cybersecurity assessments begin with something tangible.

An application. A server. An API. A configuration. A network.

We examine what exists, analyze its behavior, test its controls, and look for weaknesses. However, technological environments are never static.

Organizations constantly introduce new components, expand architectures, change configurations, and make decisions that reshape their exposure.

Before those changes happen, there is something else worth examining: the intention behind them.

What is the organization planning to do? What dependencies will those decisions introduce? What might happen when a new technology interacts with an existing environment? And what risks could emerge from something nobody has configured yet?

This is one of the questions we're exploring through Intention.

At Grupo Oruss, we describe our experimental approach as Cognitive Biohacking.

It brings together trained human teams, cognitive exploration, physical elements used to support reflective processes, and artificial intelligence to develop and interpret alternative hypotheses.

AI helps us examine the available context, explore relationships, and analyze possible scenarios.

Human specialists interact with the physical elements, interpreting and analyzing signals that deserve further investigation.

It is an experimental approach, not a predictive system. But it gives us another way to question what we believe we know.

And sometimes, the questions themselves can be valuable.

A small crack in a new structure

Following our conversation with the client's technical team, we conducted an Intention research exercise. We considered the upcoming deployment, the surrounding technical environment, and the information shared during our discussion.

The concern was not necessarily a major vulnerability or a fundamental weakness in the security technology itself.

It was something smaller.

A potential crack in the way new components might be introduced, configured, or connected. Something that could easily be overlooked because everyone was focused on the larger infrastructure.

The technology itself might be sound. The problem could emerge from the way it was implemented.

• We communicated that concern to the client.
• We hadn't identified a specific misconfiguration, and we couldn't point to an exact WAF rule or defective component.
• The new infrastructure wasn't operational yet.
• What we had was a hypothesis: pay particular attention to the smaller integration details during deployment.

Then we continued with our work.

Fifteen days later!

Approximately two weeks afterward, the client contacted us.

Their new security infrastructure had been deployed.

But something unexpected had happened.

The team experienced operational problems involving the newly implemented components. Some of the behavior was concerning enough that they initially suspected malicious activity.

Were they being attacked?

After investigating the situation, they discovered that the problem wasn't an external cyberattack.

It was associated with configuration and integration issues introduced during deployment.

According to an engineer familiar with the incident, the implementation had been performed by technical personnel who were not deeply specialized in the deployed technology.

Certain configuration inconsistencies affected the expected operation and performance of the environment.

In other words, the security infrastructure had introduced its own operational problems.

The client remembered our earlier warning.

And so did we.

Was this a prediction?

That's the obvious question.

And it's one we should approach carefully.

Intention hadn't identified the exact configuration error before it existed.

We hadn't known which specific component would behave unexpectedly or how the incident would unfold. What happened was more limited, but still interesting.

Before deployment, our experimental process had led us to highlight potential weaknesses arising from the integration and configuration of new components. After deployment, the client experienced an operational incident consistent with that general category of risk.

The sequence was striking enough for both teams to revisit our earlier conversation.

But a single case cannot establish predictive accuracy. Configuration mistakes are also a recognized risk in technology deployments, and their occurrence alone does not prove an unusual predictive capability.

What interested us was the role Intention had played in directing attention toward that possibility before any technical evidence of the eventual problem existed.

That is a question worth investigating further.

Cognitive Biohacking meets cybersecurity

For more than two decades, our work at Grupo Oruss has focused on offensive cybersecurity: understanding systems, identifying weaknesses, and validating technical risks through ethical hacking and penetration testing.

Intention represents a different line of exploration.

We are interested in the relationship between human cognition, alternative approaches to problem-solving, artificial intelligence, and technical investigation.

Cognitive Biohacking is the name we use for this experimental combination.

Our aim is not to replace established security methodologies.

We want to explore whether different cognitive approaches can help specialists consider scenarios that might otherwise receive less attention.

In Project Umbral, the result was not a discovered exploit.

It was a warning about a possible future risk, followed by an operational problem that aligned with the concern we had communicated.

That experience gave us a reason to keep asking questions.

Beyond the Visible

Project Umbral taught us something that extends beyond cybersecurity.

Sometimes we spend so much time examining what already exists that we pay less attention to the consequences of what is about to change.

• A new firewall.
• A new integration.
• A new cloud service.
• A new authentication mechanism.
• An employee with bad intentions
• A professional saboteur

Every technological and human decision, introduces relationships and dependencies that deserve careful consideration.

Perhaps the next step in security research is not simply to analyze more data.

Perhaps it also involves learning to ask different questions about the data, decisions, and uncertainties already in front of us.

That is what we're exploring with Intention.

Not claiming to see the future, but investigating what we might not yet be looking at.

And perhaps that is where seeing the intention begins.

About Project Umbral: Project Umbral is an anonymized account of an experimental research exercise conducted by Grupo Oruss.

Intention is an expanded research initiative. Its prospective hypotheses support technical verification, without claiming scientifically validated predictive capabilities. Simply because the future is constantly evolving. ;)

Grupo Oruss | Division 81 — Intention Research

Explore Intention and Cognitive Biohacking.

Embedded content

"Innovation doesn't begin when we find an extraordinary answer, but when we dare to investigate a question that still seems strange."