TrustedThings

TrustedThings symbol

TrustedThings helps organisations find and prioritise security and privacy flaws in complex digital systems before they become breaches or expensive remediation projects. We draw on organisational insight to help make this process more effective and work to drive business value.

Led by Shaanan Cohney, Toby Murray, and Thuan Pham, the collaboration turns deep security research into automated testing tools for APIs, software deployments, embedded systems, and other products that are too complicated to check by hand.

The team combines academic depth with a delivery track record: award-winning publications, a provisional patent, government and industry-funded projects, and joint supervision of students building software security capability.

Team

Researchers and PhD students

Masters students

Matthew Pham, Runzhou (Ryan) Chen, Han Perry, Xiaocong Zhang, Qingyun Wu, Michael Maxwell Wenn, Haodong Gu, Zachary Duthie, and Simon Kelly.

Undergraduate students

Fane Ye and Ray Zhang.

Research

What we work on

  • Finding vulnerabilities in software products that are too complex or fast-moving for manual review alone.
  • Detecting excessive data exposure in Web services before sensitive information leaks to the wrong users.
  • Testing Web APIs, network protocols, and embedded systems even when documentation is incomplete or behaviour depends on hidden state.
  • Building automated tools that learn from real software artefacts, code reviews, and system behaviour to generate better security tests.
  • Turning advanced fuzzing research into practical methods that partners can apply to difficult security testing problems.

Activity

Shared supervision and project work

  • Joint PhD and Masters supervision, shared tool-building, and partner-linked project work in automated software security.
  • Recent student work spanning Web API security testing, protocol reverse engineering, and security tests guided by source code and code review.

Open problems

Current research flavour

  • Metamorphic and differential oracles for excessive data exposure and authorisation failures.
  • End-to-end Web API fuzzing without complete specifications, including dependency inference and state setup.
  • Stateful protocol fuzzing for systems with hidden state, long sessions, and brittle message grammars.
  • Program-structure, source-code, and code-review-guided fuzzing that turns human design intent into search guidance.
  • Evaluation methods for vulnerability discovery tools: reproducible benchmarks, bug triage, and evidence that findings matter.

Outcomes

Selected publications, patent, and recognition

Funding

Joint support

CSA, Research Contract for 2x Masters Projects

$110,000 AUD · 2024 · with Van Thuan Pham and Toby Murray

Defense Science Technology Group, Research Contract for Student Supervision

$30,000 AUD · 2024 · with Van Thuan Pham and Toby Murray

Feedback-Guided Security Testing for Embedded Systems

University CIS Competitive Grant · $35,000 AUD · 2023 · with Van Thuan Pham and Toby Murray

Media

Shaanan Cohney