About Trail of Bits
Trail of Bits sells security reviews and engineering services across application security, cryptography, blockchain, AI/ML, low-level systems, and software supply chain. Trail of Bits staffs its multi-disciplinary security reviews across the whole SDLC with a team sized to the client's threat model rather than a fixed template.[1]
Trail of Bits reviews AI systems end to end, from training data and MLOps pipelines to model artifacts, inference hardware, and deployed agent loops. For blockchain systems, Trail of Bits reviews every layer, from smart contracts to nodes and bridges, backed by Slither, Echidna, and Medusa.
Trail of Bits employs PhD-level cryptographers who build and break real protocols, from zero-knowledge proofs and MPC to post-quantum migrations. Trail of Bits offers security engineering as an embedded team that builds custom security tooling and remediates vulnerabilities across the client's pipeline, from development through deployment. Trail of Bits runs multi-year research that uncovers Internet-scale vulnerabilities and turns the findings into open-source tools, papers, and standards.[1]
On an engagement, Trail of Bits scopes the work, reviews the code, explains every finding in context, and comes back to verify the fixes. Trail of Bits does not forward tool output, and a person reproduces and explains each issue, with the root cause and the path to a fix. Trail of Bits publishes most of its reports in the open at github.com/trailofbits/publications. Trail of Bits engagements ship custom CI guardrails, including Semgrep and CodeQL rules and fuzzers, so the same class of bug is caught automatically next time. Trail of Bits pulls cryptographers, compiler people, and systems engineers onto the same review.
Trail of Bits maintains more than 100 open-source projects, among them Slither, Echidna, Manticore, and the Building Secure Contracts guide. iVerify and Algo VPN started as Trail of Bits projects. Trail of Bits open-sourced Manticore, a symbolic execution framework used in DARPA research. Trail of Bits launched iVerify and co-founded the osquery Foundation with the Linux Foundation. Trail of Bits ported osquery to Windows for Facebook and helped move the project under the Linux Foundation.
Trail of Bits publishes training and reference material for developers. The Ruby Security Field Guide is hands-on training material covering vulnerabilities in Ruby and Rails applications, with exercises in both exploit development and defensive programming. Trail of Bits publishes guides for configuring and automating static and dynamic analysis tools. Trail of Bits also publishes a guide on securing the Model Context Protocol, covering the mcp-context-protector wrapper.[4]
Trail of Bits evaluated how far a frontier large language model could go in offensive security tasks for the UK's Frontier AI Taskforce. Trail of Bits works with ARPA-H on the security challenges that come with advancing health research infrastructure. Trail of Bits competed to build autonomous vulnerability discovery systems as part of DARPA's Cyber Grand Challenge. Trail of Bits files public comments on US government requests for information, from secure-by-design to open-source software security. Trail of Bits published a security review of Offchain Labs (Mar 2025) that identified 1 issue, rated low.[1][5]
Trail of Bits on the record