Mindgard’s findings are evidence in the way smoke is evidence of a fire, and I think the identity can work the same way. Each finding becomes a short row of signs that says what was attacked and how, what it touched, how sure Mindgard is and where things stand now. The same parts build a second vocabulary for the people at Mindgard (department, years, place, what someone found or shipped), and they’re what the kaleidoscope is made of too.
Everything on this page comes from a real, public Mindgard record or paper unless it carries a placeholder tag. The family and impact we’ve given each record are our reading of its public title, so those are worth checking on your side.
Most of this system comes straight out of our session together on 10/29, so here it is in your words (and a few of mine), quoted from the transcript.
The idea is a handful of source shapes that eventually make everything, and the parts that hold up best come from electrical schematics. The system is a circuit and the attack is a fault in it, which suits a company whose whole job is finding the fault before someone else does. The parts fall into five families (points, wires, components, signals and bounds), so the grammar stays small and a new sign can be worked out from the families instead of invented from scratch.
Mindgard already draws a little like this, since the current brand guide uses lines for probes and attack paths. Schematics also have a long history as a code that looks closed until you learn a few symbols, after which it reads at a glance.
A few rules sit on top of the parts. The frame tells you what kind of thing you’re looking at (a square tile is a finding, a round coin is a person or the company), white only ever marks the fault (the probe, the leak or the escape), and each sign uses two to four parts from at least two families.
The top row is an earlier, simpler drawing of the attack families, and the bottom row is whichever form is chosen at the top of the page (Circuit, unless you’ve changed it). The meanings are the same in both.
Material Symbols draws one icon set at lots of settings (fill, weight, grade and optical size), and I wondered whether these signs could work the same way. The shapes and meanings stay fixed while four axes change how they’re drawn. Weight is the stroke, corners are sharp or round, fill draws areas solid or as outlines, and gap cuts a thin channel wherever two parts meet, so they sit side by side instead of fusing into one lump.
The bar at the top sets the style for the whole page, kaleidoscope included. It opens on the Default style (weight 3.5, sharp, solid, gap 1.5), and the presets below are a few other settings worth comparing.
Agentic misuse and prompt injection, with one axis changed from the current setting in each strip.
Circuit is the form the page opens on. It borrows the language of electrical schematics, where the system is a circuit and the attack is a fault in it, and that gives us curves where the symbols already have them (coils, hops, waves, broadcast arcs) without everything turning into a circle. The other rows draw the same thirteen signs in other form languages for comparison. I’d judge each one as a set, since a form language only works if it holds across all thirteen and not just its best sign.
The Form menu at the top switches the whole page over, ledger and kaleidoscope included, and the rendering axes work with every form.
These are the six categories I showed on 10/29: target, attack family, impact, severity, certainty and status. A finding is written in that order every time so a reader learns where to look, and when the record doesn’t fill a slot it stays visibly empty, which fits Stephanie’s point that “some of these don’t deserve a symbol”.
Code: . Two families joined by an arrow are a chain, so here the injection was the way in and the leak was what came out. The public write-up doesn’t give a severity, so that slot stays empty instead of us guessing.
Every public write-up records three dates, and one notch for each day between them gives a mark you can only draw from the real record.
These are the 15 most recent disclosures on mindgard.ai/learn/disclosures (page 1, as of 2026-11-02). On 10/29 I suggested that “part of the filtering could … be based around some of these things”, so you can click a sign to filter by it. Once the records are drawn as signs, you start to see patterns the titles hide.
Each row reads left to right in this order, and hovering over (or tabbing to) any sign shows what it means.
Upcoming records are drawn sealed. They show the target and status and hold everything else back, so a half-filled sign tells you the disclosure is still in progress. The counts come from page 1 of the Upcoming tab.
The Lancaster papers behind Mindgard use the same nouns, so a paper can be encoded the way a finding is, and then the research, the disclosures and the product all share one set of signs.
Peter Garraghan’s earlier work at Leeds and Lancaster looked at how large systems fail in ways that only show up over time (emergent failures, long-tail stragglers in cloud systems). That’s why status is a track and not a stamp, since a sign can move from published back to open when the system under it changes.
The signs and the patterns are meant to be one system, so this runs on the kaleidoscope library’s own engine (mindgardescope). The library works in steps (source, fold, ink, disturb and place), and here the source is the sentence itself. Its glyphs go into one eighth of the square, biggest first, with small copies filling the gaps, then the eighth is folded eight ways and inked, and the library’s flaw turns one quarter 90°.
The same finding gives the same pattern every time, and changing one slot changes the whole field, so a few small inputs can produce a huge range of patterns. White marks the attacking parts, light grey what was hit and mid grey the rest of the record. The greys are a neutral stand-in until the brand colours are set.
Code
This is the working, laid out like the library’s pipeline sheet. The pipeline belongs to the library and the source is the record, so any pattern can be traced back to the disclosure it came from.
This is the second layer I described on 10/29: “the department could have a symbol. The amount of time that they’ve been there could have a symbol. Like what state they’re in could have a symbol.” These marks are earned the same way finding signs are, so a notch is a year someone put in and a disclosure coin carries the sign of a record that person actually worked on. I think that’s what keeps it from sliding into mascots (“no pirates, no gnomes”).
Jim put the company at 36 people on 10/29, so six or seven marks probably cover it. We’ll need the real list, the office locations and who counts as founding from you.
I’d expect it to show up most on booths and covers and least in the product, where “I have a job to do in there.” Each mockup below uses the same signs with a different amount of explanation.
In the product the signs are small and one colour, with labels on hover. Peter Garraghan asked for severity to move, so high-severity marks pulse gently here.
The back is a kaleidoscope grown from the person’s own code (department, years and place), so no two cards match, and colleagues can read each other’s.
At Duo, a release team’s “den mother” made shirts just for that small team, and it’d be nice if a team at Mindgard could do the same in an afternoon with the release code, the targets the release covers and a dot for each person (with a ring for whoever organised it).
There’s a notch for every vulnerability Mindgard has reported, and the wall gets a new one whenever the public page does. We’d check the counts again before anything goes to print.
The key is public, which I think answers Julie’s question about whether unexplained signs could be a barrier. Nobody is locked out, and people who take the time to learn the key get a small reward for it. The booth could even hide one sentence in the kaleidoscope wall and give a coin to whoever decodes it, the way DEFCON badge puzzles work.
This is Stephanie’s idea from 10/29: explain more at the front and get cleverer further in, so the same sign carries less labelling the deeper a reader goes.
Nothing about ● ■ ◆ means easy, medium or hard, yet skiers read trail signs at a glance, and Mindgard’s own ◇ △ ○ severity marks already work the same way. Hobo signs and the coloured paint marks utility crews spray on streets are codes too, obscure until you’ve learned a few marks and easy to read after that. This system keeps a small, closed set of marks in the same order every time, so a reader can work out the rest from a handful.
Smoke means fire because fire made it, which Peirce called an index, and the whole system rests on that idea, since a sign can only exist where there’s a record. Every finding sign points at a dated record, every notch at a real day or year and every disclosure coin at a disclosure someone actually worked on, which is also why a slot with no data stays empty.
Stonemasons cut personal marks into their stones, Scouts sew on the badges they earned and hacker conferences hand out badges with puzzles built in, and challenge coins already get passed around in security culture. A mark like that means something to the person holding it because it can’t be bought and only a colleague can read it, and the inside code works the same way.
This is my answer to Stephanie’s “not stagnant” and Fergal’s “vernacular”. The key is published, and a new target or department gets built from the same parts and takes the next free place in its slot, so old signs keep their meaning. A vernacular grows out of people using a code, so it has to be easy enough for other teams to pick up and make their own shirts with.
The other forms only redraw targets and attack families, since Circuit is the one we’re taking forward. Next we’ll probably try these at real sizes on a disclosure page and a slide, and see how they hold up.