Trail of Bits
Trail of Bits is an independent security research, engineering, and consulting firm that secures software, blockchains, and AI systems. It combines high-end security research with an attacker mentality, publishes research and open-source tools, and aims to raise the security bar for the wider field.
At a Glance
- Defense and government agencies
- Technology companies and software vendors
- Financial institutions and fintech
- Blockchain, cryptocurrency, and smart-contract protocols
- +3 more
AI Tools by Trail of Bits
(2)
Brotli Checker
Brotli Decoder Vulnerability Scanner
coop
Disposable VMs for AI Agents
Discussions
No discussions yet
Be the first to start a discussion about Trail of Bits
Latest News
Trail of Bits published an analysis challenging 1Password's AI patching benchmark and released post-patch-validation and review-walkthrough agent skills.
Trail of Bits introduced Patch the Planet, a joint initiative with OpenAI; its first week reported hundreds of bugs, 64 pull requests, and 51 issues across 19 open-source projects.
Trail of Bits published How We Made Trail of Bits AI-Native (So Far), describing its AI operating model and open-sourcing much of its skills infrastructure.
Trail of Bits announced that Buttercup won second place and a $3 million prize in DARPA's AI Cyber Challenge finals; Buttercup found vulnerabilities across 20 CWE categories and applied 19 patches.
Products & Services
Research-led security reviews, application and blockchain security, cryptography, AI/ML security, security engineering, and R&D for high-stakes software and systems.
Static analysis for Solidity and Vyper with built-in detectors and an API for custom checks.
Property-based, grammar-driven fuzzer for Ethereum smart contracts that tests whether contracts satisfy invariants.
Symbolic-execution engine for binaries, smart contracts, and WebAssembly programs.
Market Position
Trail of Bits positions itself as a research-led security consultancy rather than a scanning vendor: it concentrates senior engineers on difficult, multidisciplinary problems, publishes most audit work, and leaves clients with tools and guardrails. Its open-source portfolio and public research differentiate it from conventional consultancies; Growjo lists Halborn among comparable competitors.
Leadership
Founders
Dan Guido
CEO and co-founder. Previously worked at the Federal Reserve Bank of New York, iSEC Partners, and the NSA (Tailored Access Operations and Information Assurance Directorate); he also served as NYU Tandon's first Hacker in Residence and taught cybersecurity.
Alexander (Alex) Sotirov
Co-founder and current Co-CEO. Security researcher whose previous roles included Determina and VMware; known for work on MD5-collision certificate authorities, Windows exploitation mitigations, and Heap Feng Shui.
Dino Dai Zovi
Co-founder and cybersecurity innovator/entrepreneur. Previously held security leadership roles at Endgame, Two Sigma Investments, Matasano Security, Block, Cash App, and Square; also co-founded Capsule8, won the first Pwn2Own contest, and co-authored security books including The iOS Hacker's Handbook.
Executive Team
Dan Guido
CEO
Co-founder; previously worked at NSA, the Federal Reserve Bank of New York, and iSEC Partners.
Alexander Sotirov
Co-CEO
Co-founder and security researcher; previously worked at Determina and VMware.
Founding Story
Trail of Bits launched in 2012 in response to what its founders saw as a knowledge-hoarding problem in security: firms kept solutions secret while the same vulnerabilities recurred across organizations. The initial vision was to solve hard problems once, turn the work into tools and research, and release those outputs publicly rather than keeping them proprietary.
Business Model
Revenue Model
Project-based professional services: paid security audits, consulting, custom security engineering, research and development, and government/DARPA contract work. The company also publishes and maintains open-source tools and public-good projects rather than relying on those tools as subscription products.
Target Markets
- Defense and government agencies
- Technology companies and software vendors
- Financial institutions and fintech
- Blockchain, cryptocurrency, and smart-contract protocols
- AI/ML companies and critical AI infrastructure
- Open-source maintainers and foundations
- Pre-release and continuous security assessment of applications and infrastructure
- Smart-contract and blockchain protocol auditing
- Cryptographic protocol, library, and post-quantum cryptography review
- AI/ML model, agent, and AI-enabled system security
- Fuzzing, symbolic execution, reverse engineering, and vulnerability research
- Software supply-chain, dependency, package, and CI/CD security
- DARPA
- ARPA-H
- Government agencies and financial institutions