static analysis

Aarno Labs is an MIT-founded computer security research lab founded in 2015 by MIT researchers. The team of experts in formal methods, program analysis, and dynamic instrumentation focuses on retrofitting security on legacy systems and devices, vulnerability discovery, high-assurance binary patching, and supply-chain protection. They have received 14 DoD, DARPA, and ARPA-H research grants with combined funding over $35M.

AI/MLbinary patchingdynamic analysisdynamic instrumentationformal methodsprogram analysisruntime protectionsoftware correctnesssupply chain securityvulnerability discoveryvulnerability remediation

AdaCore provides commercial software development tools and support for high-integrity software in Ada/SPARK, C/C++, and Rust. With over 30 years of experience, it offers IDEs, toolchains, static and dynamic analysis tools, formal methods, and certification-ready technology for safety-critical and mission-critical systems across industries including aerospace, defense, rail, automotive, space, medical, and security.

automated unit testingconsultingcustom developmentcustom portscustom runtimesdynamic analysisformal verificationfuzzingmentorshipmulti-language building and debuggingtraining

Adaptt builds the evidence and control plane that lets defense programs adopt AI inside disconnected enclaves. Its first module, Ratify, assesses policies and system evidence against NIST SP 800-53 and 800-171 on a single workstation inside the boundary with no external network egress, with every finding cited to its source and every decision made by a named person. Adaptt is building a platform for the secure software lifecycle.

AI assessment against NIST SP 800-53 and 800-171air-gapped/network-none operation with egress guardaudit loggingbehavioral equivalence checkslocal model serving on workstation-class hardwarepolicy enginerole-based accesstest adequacy scoringworkflow engine

ArmorxAI is an AI-powered cybersecurity company that protects organizations against ransomware attacks. Its platform proactively monitors indicators to detect, inoculate, or isolate ransomware threats in milliseconds on Windows endpoints and servers, and includes post-attack alerting with SIEM integration. ArmorxAI is an NSF SBIR Phase I and II award winner with patent-pending intrusion detection and anti-ransomware technology.

AI-based intrusion detectionalert notificationanti-ransomware protectionbehavioral fingerprintingfile pattern analysisheuristic modelsprocess analysisSIEM integration

AppStudio35 is a software development team specializing in mobile app development, with over 15-20 years of experience developing for embedded devices, desktop applications, and many other platforms. They offer mobile app development, web solutions, custom software, validation and verification, automation and release engineering, and professional staffing services.

CI/CD pipelinescustom software developmentmobile app developmentnightly buildsQA testingsecurity scanningstaffingValidation and Verificationweb development

Astradian Technologies LLC is a veteran-owned small business headquartered in New Mexico that builds software, simulations, and prototypes for defense programs, government labs, and engineering teams. Founded in December 2023, it offers build and release engineering, DevSecOps, HPC consulting, LLM consulting, and PostgreSQL services.

build and release engineeringCI/CD pipelinesDevSecOpsFortran modernizationGPU portingHPC consultingLLM pipeline developmentPostgreSQL consultingprototypingsimulation software development

Canvass Labs is a San Diego-based AI/ML software company developing tools for secure code analysis, vulnerability discovery, and legacy software modernization. It combines static analysis, dynamic testing, fuzzing, code intelligence, and AI-assisted review into a human-in-the-loop workflow for high-trust software environments. The company works through government R&D, teaming partnerships, and selected commercial engagements.

AI/ML software developmentcode intelligencedynamic testingfuzzinghuman-in-the-loop reviewLLM-assisted reasoningsecure refactoringvulnerability triage

Choose K builds production-grade private and secure computation solutions tailored to use cases by leveraging multi-party computation (MPC), homomorphic encryption (HE), trusted execution environments (TEE), and post-quantum (PQ) primitives. They build the protocols, tooling, and systems for production-ready workflows, and develop privacy-enhancing tools for cryptocurrency wallet and smart contract ecosystems, post-quantum cryptography assessment, and encrypted workflows in finance.

confidentiality analysisconfidential matching and order bookshomomorphic encryption (HE)multi-party computation (MPC)post-quantum (PQ) cryptographyprotocol and tooling developmenttrusted execution environments (TEE)

clearAvenue is a solution-focused systems integration company offering solutions based on innovative tools, technologies and processes. It has a track record of providing innovative solutions to multiple federal and commercial clients, with commendations for collaboration to ensure mission success. It designs, develops and deploys enterprise applications and specializes in microservices-based systems integration, Agile DevOps deployment, secure software development, cybersecurity, cloud enablement and deployment, mobile app development and health informa

Agile/DevOps (Scrum, Kanban)cloud enablement and deploymentCybersecuritydynamic analysisenterprise application developmentHealth informaticsmobile app developmentSecure Software Development Lifecycle (SSDLC)Systems IntegrationTest-Driven Development

Commercial Computer Systems (CCS) applies the scientific method to the development of computer-intensive systems, a practice it has followed since 1976. CCS offers the simpleXecutive methodology, including REAL blueprints, REAL language, and SIMPLEX static and dynamic analysis tools, to help architects, developers, engineers, and designers model and optimize embedded systems before coding. CCS also provides consulting and training services.

consultingdynamic analysisembedded system designperformance modelingSystems Engineeringsystem simulationtraining

Delphos Labs is an AI platform that analyzes compiled software without source code or symbols, using static and dynamic analysis. It runs purpose-built models and a full analysis pipeline to explain what a program does, identify risks, and return plain-language findings. Security leaders and analysts use it to approve software, triage threats, and investigate before software enters their environment. Analysis is done through controlled emulation, never by running software on customer systems.

AI-powered reverse engineeringbehavioral analysisCPU emulationdecompilationdynamic analysisdynamic emulationMalware Analysissupply chain tampering detectionVulnerability Research

Eclypsium is a cybersecurity company that protects critical software, firmware, and hardware in enterprise and national infrastructure. Founded in 2017 by Yuriy Bulygin and Alex Bazhaniuk, it provides a platform for visibility, vulnerability assessment, integrity monitoring, and remediation across endpoints, servers, network devices, AI infrastructure, and enterprise IoT, addressing hardware supply chain risk.

automated firmware updatebehavioral analysisbinary analysiscompliance reportingdevice cleansing and data sanitizationfirmware analysisintegrity and change monitoringRESTful APIsVulnerability assessment

EED-Engineering is a quality software and hardware engineering firm in Denver, Colorado, formed over twenty-five years ago to leverage the systems, software, and electrical engineering and process-based management skills of its associates. It provides reliable engineering services focused on real-time embedded systems development, including systems engineering, software engineering, and verification and validation using the LDRA tools for Aerospace, Defense, Automotive, Transportation, Telecommunications, Industrial Automation, and Medical Electronics.

DO-178B/C documentationdynamic analysiselectrical hardware designembedded systems developmentISO 9000/CMMILDRA tool suiteMCDC analysisMISRAPerl scriptingrapid prototypingsoftware engineeringstructural coverage analysisSystems Engineeringunit testingverification and validation

Emenda has over 15 years' experience in the verification and validation (V&V) of safety-critical embedded systems, with expertise in certification to functional safety standards such as DO-178C, IEC 61508, ISO 26262, IEC 62304 and EN 50128. It provides static analysis software tools, customised training, and support integrating static analysis tools and automated tests throughout the software development lifecycle.

CI/CD and DevOps automation integrationcustom rules developmentfunctional safety certification supportstandards gap analysistrainingverification and validation

Karambit.AI provides product security compliance software that streamlines product release, compliance, and software updates by performing static analysis to detect and verify the integrity of software safety, cybersecurity, and functionality behaviors prior to deployment without source code. Its Software Bill of Behaviors capabilities bring transparency to the software supply chain, and its mission is to stop software supply chain attacks.

automated reportingbehavior detection from binaries without execution or source codebehavior differential analysisCI/CD pipeline monitoringmalware detection