Trail of Bits

Trail of Bits is a cybersecurity research and consulting firm specializing in software assurance, cryptographic verification, and securing emerging technologies. Founded in 2012 by security experts Dan Guido and Nick Percoco, the company has established itself as a leader in high-stakes security assessments for critical infrastructure, financial technology, and blockchain ecosystems. Its work combines deep technical research with practical consulting, often resulting in the public release of innovative open-source software tools and influential security research papers.

History

The company was founded in New York City by Dan Guido, a former member of the NYU Tandon School of Engineering's Offensive Security, Incident Response and Internet Security (OSIRIS) Lab, and Nick Percoco, previously the Chief Technology Officer at Rapid7. Early growth was fueled by contracts with major technology firms and government agencies, including the Defense Advanced Research Projects Agency (DARPA). A significant milestone was its acquisition by Cigital in 2015, which later merged with Synopsys's Software Integrity Group; however, the original founders repurchased the company in 2019 to return it to independent operation. This period solidified its reputation for tackling complex security challenges in areas like binary analysis and smart contract security.

Services

Trail of Bits provides a suite of advanced security services focused on proactive risk reduction. Core offerings include secure code review and architecture assessment for applications spanning embedded systems, mobile applications, and enterprise software. The firm is particularly renowned for its cryptography engineering audits, evaluating implementations of protocols like Transport Layer Security and zero-knowledge proof systems. Its blockchain security practice conducts comprehensive reviews of smart contract code, consensus mechanisms, and decentralized finance (DeFi) protocols for clients such as the Ethereum Foundation and Coinbase. Additional services include cloud security assessments, incident response preparedness, and developing custom security testing tools.

Notable projects and research

The company has been involved in several high-profile security initiatives and published groundbreaking research. It performed the security assessment for the Libra blockchain project initiated by Meta Platforms. Researchers from Trail of Bits have uncovered critical vulnerabilities in widely used software like the Chrome browser and the Windows operating system, often presenting findings at major conferences like Black Hat and DEF CON. A landmark research project, "The SoK: Security of Machine Learning as a Service," systematically analyzed the attack surface of platforms like AWS SageMaker and Google Cloud AI Platform. The firm also contributed to the National Security Agency's (NSA) guidance on securing software-defined networking.

Security tools and open-source contributions

Trail of Bits maintains and has released numerous influential open-source security tools. These include Binary Ninja plugins for reverse engineering, the Algo VPN deployment tool, and Manticore, a symbolic execution framework for analyzing EVM bytecode and x86 binaries. Other significant tools are Slither, a static analysis framework for Solidity, and Crytic, a continuous security analysis platform for smart contracts. These contributions are frequently integrated into the workflows of other security firms and independent researchers, amplifying their impact on the broader information security community.

Corporate culture and impact

The firm fosters a culture deeply rooted in academic rigor and practical hacker ethics, encouraging employees to publish research and contribute to the open-source software community. This approach has positioned Trail of Bits as a key bridge between academic cybersecurity research and industry application. Its work has directly influenced security standards and best practices within the blockchain industry and for cryptographic library developers. Through its public reports, tools, and presentations at venues like USENIX Security Symposium, the company has played a substantial role in elevating the security posture of critical open-source projects and complex software ecosystems worldwide.

Category:American companies established in 2012 Category:Computer security companies Category:Companies based in New York City