Trail of Bits

To combine high-end security research with a real-world attacker mentality to reduce risk and fortify code.

Founded in 2012 by three expert hackers with no investment capital, Trail of Bits has grown into a premier cybersecurity research and consulting firm that secures some of the world's most targeted organizations and critical infrastructure. The company combines high-end security research with a real-world attacker mentality to solve complex security challenges before they can be exploited. Rather than standard checklist testing, Trail of Bits excels in deep manual analysis, custom security tooling development, and original research that advances the entire security industry. With over 100 employees working remotely across every time zone, the firm serves clients ranging from DARPA to major blockchain protocols, focusing on areas like cryptography, AI/ML security, application security, and blockchain technology. The company operates at the intersection of academic-grade research and practical engineering, regularly publishing findings at top conferences and releasing open-source tools to democratize security knowledge.

Products

Trail of Bits provides high-end cybersecurity consulting, research, and security engineering services across software assurance, reverse engineering, cryptography, and blockchain security. The company audits complex systems for high-profile clients and develops specialized security tools including Crytic (a continuous assurance platform for smart contracts) and the Cyber Reasoning System. Trail of Bits also incubated iVerify, a mobile device security and threat-hunting platform that provides threat detection without requiring Mobile Device Management. The firm is a prolific contributor to the open-source community, regularly releasing vulnerability detection tools, fuzzers like Ruzzy and gosentry, and code analyzers like Trailmark.

Funding

Trail of Bits remains a bootstrapped, privately held firm that has grown organically without traditional venture capital funding. The company received a $1.16 million PPP loan in 2020 and has achieved estimated annual revenues between $50 million and $100 million. Instead of raising capital for itself, Trail of Bits has incubated and spun out successful security products, most notably iVerify, which raised a $4 million seed round in 2023 and a $12 million Series A in June 2024, with Trail of Bits participating as an investor.

Recent news

In April 2026, Trail of Bits discovered and exploited memory safety and logic vulnerabilities in Google's Rust zero-knowledge proof (zkVM) code, successfully forging a proof to demonstrate unique security risks in zkVM systems.

Technology

As an AI-native security firm, Trail of Bits primarily uses Rust, C++, and Python for software development, with supplementary work in Go and Java. Engineers work extensively with compiler technologies, binary analysis, and program analysis to build security frameworks, interacting closely with low-level systems and memory management. The team utilizes AI development tools like Claude Code and Cursor to accelerate development. Secure implementation is maintained through CI/CD pipelines and GitHub Actions. The company also works with blockchain technologies using Solidity, and employs functional programming languages like OCaml and Haskell for specialized security tasks.

Benefits

Trail of Bits offers a remote-first culture with competitive salaries ($125,000-$185,000) plus performance-based bonuses. Health benefits are fully company-paid with zero monthly premiums, including health, dental, vision, disability, and life insurance. The 401(k) plan includes a 5% match, and employees get 20 days of flexible paid vacation plus four months of parental leave. Additional perks include a $1,000 work-from-home stipend, $750 annual learning and development allowance, and $10,000 relocation assistance for those moving to NYC. The company sponsors fully-funded all-team celebrations with travel and accommodation, and matches philanthropic donations up to $2,000 annually.