CISO Tribune

Vendor comparison · 2 companies

Trail of Bits vs Zenity

Trail of Bits sells security reviews and engineering services across application security, cryptography, blockchain, AI/ML, low-level systems, and software supply chain. Zenity sells an AI agent security platform built to govern how agents behave, not just what they say or generate. CISO Tribune files both under AI model and agent security. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Trail of Bits
  • Zenity
Trail of Bits vs Zenity: Products, Customers and Funding Compared
Trail of BitsTrail of Bits sells security reviews and engineering services across application security, cryptography, blockchain, AI/ML, low-level systems, and software supply chain.trailofbits.comZenityZenity sells an AI agent security platform built to govern how agents behave, not just what they say or generate.zenity.io
What it sells
  • Application Security[1][2][3]Code, cloud, and architecture review that finds the root cause and the fix for the whole bug class.
  • Blockchain[1][2][3]Review of every layer of a blockchain system, from smart contracts to nodes and bridges.
  • Cryptography[1][2][3]PhD-level cryptographers build and break real protocols.
  • AI Observability[5]Builds a live inventory of every agent across an organization's environment and tracks the data those agents access.
  • AI Security Posture Management (AISPM)[7]Evaluates configuration, permissions, and integrations before an agent goes live.
  • Boundaries[4][6][8]Evaluates every agent action in real time against an organization's rules and decides to let it through, block it, or shut the agent down.
  • AI Detection and Response (AIDR)[9]AIDR reads the full sequence of an agent's activity, detecting threats mapped to the OWASP LLM and MITRE ATLAS frameworks.
  • Zenity Security Assessment Hub[13]A set of 10 free, open-source tools built by Zenity Labs to help security teams identify and understand immediate risks.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
Not stated on its pages2021[2]
Ownership and funding
Not stated on its pagesPrivately held[3][6][17]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pages
  • September 23, 2026Zenity was named a Market Shaper in Gartner's inaugural Emerging Market Quadrant for AI Application Security.[15]
  • August 3, 2026Zenity announced a $125 million Series C round led by Norwest.[14]
  • June 17, 2026Zenity and Carahsoft announced a partnership under which Carahsoft serves as Zenity's Public Sector distributor.[17]
  • March 17, 2026Zenity announced general availability of runtime security controls for AI agents built on Microsoft Foundry.[16]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Trail of Bits describes review work for blockchain systems, covering smart contracts, nodes, and bridges. Trail of Bits describes security work on AI systems, from training data to deployed agent loops. Trail of Bits describes advising on the security challenges that come with advancing health research infrastructure.Zenity describes a global financial services firm and a global asset manager as organizations that write policy rules for agents. Zenity covers agents embedded in SaaS tools, home-grown agentic platforms in the cloud, and end-user devices. Zenity gives security and platform teams a single place to surface, enforce, and protect MCP usage.
Last verified
October 19, 2026November 9, 2026

Where they overlap

  • Trail of Bits and Zenity are both filed under AI model and agent security.

Where they differ, field by field

  • Trail of Bits's primary category is Security consulting and advisory; Zenity's is AI model and agent security.
  • Trail of Bits is also filed under Static application security testing and Software supply chain security. Zenity is also filed under AI governance.
  • Trail of Bits lists Application Security, Blockchain and Cryptography. Zenity lists AI Observability, AI Security Posture Management (AISPM), Boundaries, AI Detection and Response (AIDR) and Zenity Security Assessment Hub.
  • Zenity was founded in 2021.
  • Zenity is privately held.

What it sells: Trail of Bits

What Blockchain does[1][2][3]
Trail of Bits reviews every layer of a blockchain system, from smart contracts to nodes and bridges, backed by Slither, Echidna, and Medusa. Trail of Bits maintains Slither, Echidna, and Manticore alongside the Building Secure Contracts guide.
What Cryptography does[1][2][3]
Trail of Bits employs PhD-level cryptographers who build and break real protocols, from zero-knowledge proofs and MPC to post-quantum migrations. Trail of Bits pulls cryptographers, compiler people, and systems engineers onto the same review.

What it sells: Zenity

What AI Observability does[5]
AI Observability is Zenity's discovery and visibility layer for AI agents. Data Lens surfaces sensitive files and pages that are both frequently accessed and broadly exposed across agents.
What AI Security Posture Management (AISPM) does[7]
AISPM evaluates configuration and permissions for agents embedded in platforms like Microsoft Copilot Studio, ChatGPT Enterprise, and Salesforce Agentforce. AISPM applies stricter enforcement in production and more flexible policy in development or sandbox environments.
What Boundaries does[4][6][8]
Boundaries is Zenity's runtime enforcement engine. A rule written once in Boundaries is enforced on Copilot, ChatGPT Enterprise, Agentforce, Bedrock, coding agents, and homegrown builds. Boundaries includes a built-in AI assistant that turns a plain-language request into a working rule.
What AI Detection and Response (AIDR) does[9]
AI Detection and Response (AIDR) is Zenity's runtime security layer for AI agents. AIDR detects direct and indirect prompt injection and blocks execution before the agent acts on them. AIDR breaks every agent interaction into individual steps and groups them by thread in a single activity table.
What Zenity Security Assessment Hub does[13]
The Zenity Security Assessment Hub is built by Zenity Labs. The tools take a Red-Team approach to visualize threats across Microsoft 365, with a focus on 365 Copilot, Copilot Studio, and Power Platform.

Questions about Trail of Bits and Zenity

What do Trail of Bits and Zenity sell?
Trail of Bits sells Application Security, Blockchain and Cryptography. Zenity sells AI Observability, AI Security Posture Management (AISPM), Boundaries, AI Detection and Response (AIDR) and Zenity Security Assessment Hub.
Are Trail of Bits and Zenity in the same category?
They share AI model and agent security. Trail of Bits's primary category is Security consulting and advisory and Zenity's is AI model and agent security.
When were Trail of Bits and Zenity founded?
Zenity was founded in 2021.
Who owns Trail of Bits and Zenity?
Zenity is privately held.
Who are Trail of Bits and Zenity sold to?
Trail of Bits describes review work for blockchain systems, covering smart contracts, nodes, and bridges. Zenity describes a global financial services firm and a global asset manager as organizations that write policy rules for agents.
What have Trail of Bits and Zenity announced recently?
September 23, 2026: Zenity was named a Market Shaper in Gartner's inaugural Emerging Market Quadrant for AI Application Security.

About Trail of Bits

Trail of Bits sells security reviews and engineering services across application security, cryptography, blockchain, AI/ML, low-level systems, and software supply chain. Trail of Bits staffs its multi-disciplinary security reviews across the whole SDLC with a team sized to the client's threat model rather than a fixed template.[1]

Trail of Bits reviews AI systems end to end, from training data and MLOps pipelines to model artifacts, inference hardware, and deployed agent loops. For blockchain systems, Trail of Bits reviews every layer, from smart contracts to nodes and bridges, backed by Slither, Echidna, and Medusa.

Trail of Bits employs PhD-level cryptographers who build and break real protocols, from zero-knowledge proofs and MPC to post-quantum migrations. Trail of Bits offers security engineering as an embedded team that builds custom security tooling and remediates vulnerabilities across the client's pipeline, from development through deployment. Trail of Bits runs multi-year research that uncovers Internet-scale vulnerabilities and turns the findings into open-source tools, papers, and standards.[1]

On an engagement, Trail of Bits scopes the work, reviews the code, explains every finding in context, and comes back to verify the fixes. Trail of Bits does not forward tool output, and a person reproduces and explains each issue, with the root cause and the path to a fix. Trail of Bits publishes most of its reports in the open at github.com/trailofbits/publications. Trail of Bits engagements ship custom CI guardrails, including Semgrep and CodeQL rules and fuzzers, so the same class of bug is caught automatically next time. Trail of Bits pulls cryptographers, compiler people, and systems engineers onto the same review.

Trail of Bits maintains more than 100 open-source projects, among them Slither, Echidna, Manticore, and the Building Secure Contracts guide. iVerify and Algo VPN started as Trail of Bits projects. Trail of Bits open-sourced Manticore, a symbolic execution framework used in DARPA research. Trail of Bits launched iVerify and co-founded the osquery Foundation with the Linux Foundation. Trail of Bits ported osquery to Windows for Facebook and helped move the project under the Linux Foundation.

Trail of Bits publishes training and reference material for developers. The Ruby Security Field Guide is hands-on training material covering vulnerabilities in Ruby and Rails applications, with exercises in both exploit development and defensive programming. Trail of Bits publishes guides for configuring and automating static and dynamic analysis tools. Trail of Bits also publishes a guide on securing the Model Context Protocol, covering the mcp-context-protector wrapper.[4]

Trail of Bits evaluated how far a frontier large language model could go in offensive security tasks for the UK's Frontier AI Taskforce. Trail of Bits works with ARPA-H on the security challenges that come with advancing health research infrastructure. Trail of Bits competed to build autonomous vulnerability discovery systems as part of DARPA's Cyber Grand Challenge. Trail of Bits files public comments on US government requests for information, from secure-by-design to open-source software security. Trail of Bits published a security review of Offchain Labs (Mar 2025) that identified 1 issue, rated low.[1][5]

Trail of Bits on the record

Sources

Trail of Bits full record

  1. [1]trailofbits.comTrail of Bits · trailofbits.com · undated page, accessed October 19, 2026 · Tier A
  2. [2]About · Trail of BitsTrail of Bits · undated page, accessed November 10, 2026 · Tier A
  3. [3]Services · Trail of BitsTrail of Bits · undated page, accessed November 10, 2026 · Tier A
  4. [4]Ruby Security Field Guide — Guide · Trail of BitsTrail of Bits · undated page, accessed November 10, 2026 · Tier A
  5. [5]Offchain Security Council Rotation · Trail of BitsTrail of Bits · undated page, accessed November 10, 2026 · Tier A

Zenity full record

  1. [1]AI Agent Security and Governance | Zenity AI Security PlatformZenity · undated page, accessed September 27, 2026 · Tier A
  2. [2]Zenity announces strategic investment led by m12Zenity · zenity.io · undated page, accessed September 27, 2026 · Tier A
  3. [3]Zenity raises 38m series b funding round to secure agentic aiZenity · zenity.io · published October 29, 2024 · Tier A
  4. [4]AI Agent Security & Governance Platform for the Enterprise | ZenityZenity · undated page, accessed October 30, 2026 · Tier A
  5. [5]AI Observability | Zenity AI Security PlatformZenity · undated page, accessed November 10, 2026 · Tier A
  6. [6]AI Agent Security | Model Context Protocol (MCP) | ZenityZenity · undated page, accessed November 10, 2026 · Tier A
  7. [7]AI Security Posture Management | Zenity AI Security PlatformZenity · undated page, accessed November 10, 2026 · Tier A
  8. [8]Runtime Boundaries | Zenity AI Security PlatformZenity · undated page, accessed November 10, 2026 · Tier A
  9. [9]AI Detection and Response (AIDRZenity · undated page, accessed November 10, 2026 · Tier A
  10. [10]Agentic Identity & Access Management: Zenity AI Security PlatformZenity · undated page, accessed November 10, 2026 · Tier A
  11. [11]Securing Financial Services AI | Zenity, Microsoft & SlalomZenity · undated page, accessed November 10, 2026 · Tier A
  12. [12]Company | Zenity | Secure AI Agents EverywhereZenity · undated page, accessed November 10, 2026 · Tier A
  13. [13]Zenity Security Assessment Hub | Zenity | Secure AI Agents EverywhereZenity · undated page, accessed November 10, 2026 · Tier A
  14. [14]Zenity Raises $125 Million to Secure the Era of 1 Billion AI AgentsZenity · published August 3, 2026 · Tier A
  15. [15]Zenity Named a Market Shaper in Gartner’s Inaugural Emerging Market Quadrant for AI Application SecurityZenity · published September 23, 2026 · Tier A
  16. [16]Zenity Announces Availability of Inline Agent Runtime Security for Agents Built on Microsoft FoundryZenity · published March 17, 2026 · Tier A
  17. [17]Zenity and Carahsoft Bring AI Agent Security and Governance to Federal, State and Local AgenciesZenity · published June 17, 2026 · Tier A

Spot a factual error? Request a correction.