What is Trail of Bits?
Trail of Bits is a security research and consulting firm founded in 2012 and headquartered in New York City. On its services page it says that since 2012 it has secured the software, blockchains and cryptography that high-value targets run on, and that it pairs deep security research with an attacker's mindset before handing engineers the tooling to keep bugs from coming back.
The firm sells services in seven areas: software assurance, AI/ML security, application security, blockchain, cryptography, security engineering, and research and development. Its software assurance work is described as multi-disciplinary security reviews across the whole SDLC, with a team sized to the threat model rather than a fixed template. The site tells prospective clients to describe the software they need secured and contact the firm.
Trail of Bits publishes much of its research and tooling openly rather than keeping it proprietary. The site describes its library as security reviews, research, open-source tools and talks, and the firm maintains more than 100 open-source security tools, including Slither and Echidna for smart-contract analysis and Manticore for symbolic execution. It also runs Patch the Planet, an open-source security initiative in collaboration with OpenAI.
Key capabilities
- Security audits across application security, cryptography, blockchain and AI/ML.
- Security engineering and research and development services.
- Open-source tools such as Slither.
- Published research, talks and a blog.
Where Trail of Bits fits
- Software assurance Multi-disciplinary security reviews across the whole SDLC, with a team sized to your threat model.
- AI/ML security End-to-end reviews of AI systems, from training data and MLOps pipelines to model artifacts, inference hardware and deployed agent loops.
- Application security Deep code, cloud and architecture review that finds the root cause and the fix that retires the whole bug class.
- Blockchain Review of every layer of a blockchain system, from smart contracts to nodes and bridges, backed by Slither, Echidna and Medusa.
- Cryptography PhD-level cryptographers who build and break real protocols, from zero-knowledge proofs and MPC to post-quantum migrations.
- Security engineering An embedded team that builds custom security tooling and remediates vulnerabilities across your pipeline.
- Research and development Multi-year research that uncovers Internet-scale vulnerabilities and turns findings into open-source tools, papers and standards.
Reviews of Trail of Bits
Be the first to share your experience with Trail of Bits.
Write a review
Loading review form…
Alternatives to Trail of Bits
Bishop FoxBishop Fox is an offensive security company offering penetration testing, Continuous Security Testing delivered on its Cosmos platform and portal, red team exercises and AI security testing, and it publishes open-source tools such as Sliver and CloudFox.
BugcrowdBugcrowd runs bug bounty, vulnerability disclosure and penetration-testing-as-a-service programs through a managed platform and vetted researcher community.
HackerOneHackerOne supports vulnerability disclosure programs and bug bounty programs with defined researcher rules.