Fissure Security FISSURESecurity
Fissure Security · Dallas, TX

The breaches you can’t explain come from the seam between your tools.

Every layer you own guards its own edge: identity, network, endpoint, mail. The content moving through them is nobody’s job. We build the layer that reads it.

See Subtext → Book a demo

Self-contained · air-gap ready · deterministic verdicts

The gap

Four strong layers. One question none of them asks.

Your stack decides who may touch data, where it may go, what may run, and who sent it. None of it decides what is actually inside the file crossing the line, so an authorized user, a clean-looking upload, or an ordinary-looking download walks payloads straight through.

IdentityWho are you?Authenticates the user. Says nothing about the bytes they carry.
NetworkWhere is it going?Routes and segments traffic. Blind to meaning inside an allowed channel.
EndpointWhat is running?Watches what executes on the device. A file that never runs still carries what it carries.
MailWho sent it?Scores senders, links, and known-bad attachments. Reputation, not content.
The seamWhat is inside it?No layer owns the content itself: the file as an AI, or an adversary, actually reads it.

AI made concealing that content a one-line prompt. We make reading it deterministic. The principles we hold that layer to: Zero Trust for Files.

What we build

One thesis. A growing line of products.

Each product takes the same idea and points it at a different seam: inspect the content itself, not the container it hides in.

Shipping Subtext Reduces text, image, audio, and video files to the text an AI would read, and returns a block / review / pass verdict. Self-contained, no cloud. Explore Subtext → Shipping Subtext for MCP The same engine at the tool boundary. Replaces the file tools your agent already calls, using the same names, so every byte of file content they return is inspected before the model reads any of it. Explore the MCP layer →
Who we are

A small shop for problems that are already here.

Fissure Security is an independent security research organization. We identify foundational gaps in the industry’s assumptions, prove them with working research, and propose the models that close them. Whenever possible, we publish the test files used in our research so anyone with a lab environment can reproduce the results against their own tooling. Research files that could enable malicious use are documented in the paper but not released.

Founded by Matt Boksa · Dallas, Texas

01 · Content, not container Read what’s inside A verdict is only as honest as what it actually inspected. We read the payload, not the wrapper around it.
02 · Deterministic Explainable every time The same file yields the same answer, with a reason you can audit. No model roulette, no black box.
03 · In the open Prove it yourself Where it’s safe to, we publish the evidence so you don’t have to take our word for anything.
Research files & test corporaSynthetic samples that demonstrate the seam. Scan them yourself. GitHub → Subtext vs. a frontier modelHead-to-head accuracy and speed on the same files. Benchmark →

See it block a file you build yourself.

The fastest way to understand what we do is to hand it something you’re sure is safe, and watch what it finds. Bring a file, or a use case.

No cloud account. No phone tree. A conversation and a container.

Book a demo → How Subtext works