Trail of Bits
Elite security research firm specializing in source code review, blockchain auditing, and building industry-standard open-source security tools.
- Categories
- Penetration testing, Application security testing, Software supply chain and SBOM, Security consulting and vCISO
- Based in
- New York, United States
- Founded
- 2012
- Size
- 51-200 staff
- Ownership
- Private
About Trail of Bits
Trail of Bits is a security research and consulting firm founded in 2012. It reviews the software, blockchains and cryptography that high-value targets depend on. Clients come from defence, technology, finance and blockchain. The firm also runs multi-year research programmes and publishes most of its reports in the open. Its work covers six domains, including application security, cryptography, blockchain, AI and ML, low-level systems and software supply chain. Teams mix cryptographers, compiler specialists and systems engineers on the same review. Engagements are scoped to the client's threat model rather than a fixed template, and findings are reproduced and explained by a person. What sets it apart is a publish-first model. It maintains over 100 open-source projects and ships leave-behind tooling such as static-analysis rules and fuzzers so clients catch the same class of bug again. It also offers free technical office hours with an engineer.
Products
- SlitherA static analysis tool for Solidity and Vyper that ships with detectors and an API for writing custom checks.
- EchidnaA tool used in blockchain security reviews.
- MedusaA tool used in blockchain security reviews.
- ManticoreA symbolic execution framework released as open source and used in DARPA research.
- ButtercupAn AI-powered cyber reasoning system built for DARPA's AI Cyber Challenge and released as open source.
- iVerifyAn iPhone security product that began as a Trail of Bits project.