Cigital

Cigital
Name	Cigital
Type	Private
Industry	Software security
Founded	1992
Fate	Acquired
Headquarters	San Jose, California
Products	Static analysis, security consulting, training
Parent	Synopsys (acquirer)

Cigital Cigital was a software security firm focused on application security, secure development lifecycle consulting, and static analysis tools. The company worked with technology firms, financial institutions, government agencies, and software vendors to identify and remediate vulnerabilities in applications and development processes. Cigital combined consulting, training, and research to influence industry practices across the software and information technology sectors.

History

Cigital was founded in 1992 and operated through periods influenced by developments such as the rise of the World Wide Web, the dot-com boom, and the expansion of regulatory frameworks like the Health Insurance Portability and Accountability Act and the Sarbanes-Oxley Act. Over time it engaged with organizations including Microsoft, IBM, Oracle Corporation, Apple Inc., and Google as both collaborators and clients. The firm evolved alongside movements such as the Open Web Application Security Project and research outputs from institutions like Carnegie Mellon University and MIT. Cigital's growth intersected with industry events such as the RSA Conference, the Black Hat Briefings, and DEF CON, and it contributed to discussions at the National Institute of Standards and Technology and the United States Department of Defense.

Services and Products

Cigital provided services including secure code review, penetration testing, vulnerability assessment, and secure development lifecycle (SDL) consulting. The company delivered training programs for developers and security teams that drew from curricula used by Google, Microsoft, Intel, and Amazon.com. Products and tool integrations addressed static application security testing (SAST) and dynamic analysis, interfacing with platforms from GitHub, GitLab, Atlassian, and Jenkins. Cigital's offerings were used by enterprises in sectors represented by JPMorgan Chase, Bank of America, Citigroup, Wells Fargo, Visa Inc., and Mastercard. The firm also aligned service delivery with compliance frameworks from PCI DSS, ISO/IEC 27001, and NIST Special Publication 800-series guidance.

Research and Contributions

Cigital contributed to application security research, publishing guidance on common vulnerability classes identified in software projects and participating in community efforts like OWASP Top Ten and scholarly venues such as the IEEE Symposium on Security and Privacy and the ACM Conference on Computer and Communications Security. Cigital researchers collaborated with academics from Stanford University, University of California, Berkeley, Cornell University, and Harvard University on studies related to static analysis, secure coding, and automated vulnerability detection. The firm's work referenced techniques and tools pioneered by researchers affiliated with Bell Labs, SRI International, Lawrence Berkeley National Laboratory, and DARPA programs. Cigital published case studies addressing threats tracked by organizations like CERT Coordination Center and vulnerabilities cataloged in the Common Vulnerabilities and Exposures initiative.

Corporate Structure and Acquisitions

Cigital operated with executive leadership engaging boards and partnerships with industry leaders and venture entities connected to firms such as Sequoia Capital, Accel Partners, and Intel Capital. The company engaged in mergers and acquisitions and was ultimately acquired by a larger software and semiconductor tooling company. The acquisition drew interest from competitors and partners in the software security market including Veracode, Checkmarx, Fortify (software), Coverity, Synopsys, and Qualys. Post-acquisition integration involved teams with backgrounds from Red Hat, VMware, Symantec, McAfee, and Trend Micro.

Notable Projects and Clients

Cigital conducted engagements for technology vendors, financial services firms, and government agencies. Client and project references connected to companies and institutions such as Microsoft Azure, Amazon Web Services, Google Cloud Platform, Salesforce, SAP SE, Siemens, General Electric, Boeing, Lockheed Martin, Northrop Grumman, U.S. Department of Defense, and National Aeronautics and Space Administration. The firm supported projects involving large-scale software from Oracle Database, PostgreSQL, MySQL, and middleware from Red Hat Enterprise Linux distributions. In the enterprise security space, Cigital worked on initiatives related to identity platforms like Okta, Ping Identity, and Active Directory deployments.

Awards and Recognition

Cigital and its personnel received recognition at industry conferences and from professional organizations. Awards and mentions came in contexts such as the RSA Conference Program Committee, speaker slots at Black Hat USA, accolades in trade publications like SC Magazine and InfoWorld, and contributions honored by standards bodies such as ISO and IEEE Computer Society. Individual researchers and consultants from the firm were cited in peer-reviewed venues including ACM Digital Library publications and received invitations to testify or brief stakeholders associated with Congress of the United States committees and international forums hosted by the European Commission.

Category:Software security companies