Trail of Bits

Application Security

Threat modeling, code review & cloud assessments

Overview

We have been a recognized leader in software security for 10 years, with a long track record of helping our clients improve their security. We go beyond just finding bugs; we help secure the industry's most critical applications by focusing on deeply technical and detail-oriented assessments and by providing guidance to help you eliminate software vulnerabilities so you never see the same bug twice.

We publish research based on our work and have worked with the industry's leading organizations, such as Linux Foundation, Rook, and OPA, on technical and detail-oriented security assessments.

Through collaboration with open-source project teams via the Open Source Technology Improvement Fund (OSTIF) and the Open Technology Fund (OTF), we conduct threat modeling assessments and secure code reviews. Because of this partnership, we have made significant contributions to improve the security posture of the open-source community by reviewing projects, including the kernel release signing process in Linux, the cURL project, and PyPI.

Why work with Trail of Bits

  • 01

    Depth where it counts

    Lorem ipsum placeholder — replace with the app-sec differentiator. Likely angle: cryptographers, systems engineers, and ML researchers join app-sec engagements so threat models that cross domain boundaries actually get reviewed end-to-end.

  • 02

    We publish everything

    Methodologies, tools, and findings end up in public reports, papers, or open-source repos. The Testing Handbook (appsec.guide), our CodeQL rules, our Semgrep packs, and our public assessment reports are free for the industry to use — and for your team to learn from.

  • 03

    Deliverables your team can run with

    Every engagement ships fixes you can drop into CI — Semgrep and CodeQL rules tuned to your code, fuzzing harnesses, and short- and long-term SDLC recommendations your team can act on after we leave.

Services & deliverables

Design Assessment

Service

Our Design Assessment offers a focused one- to two-week security analysis of your system during the early design phase. We evaluate your security architecture to identify potential vulnerabilities and foundational weaknesses, helping you build a robust and resilient system from the ground up.

01
Proactive Vulnerability Prevention
02
Strategic Architectural Alignment
03
Early Risk Identification
04
Comprehensive Design Evaluation

A design review provides immediate feedback, minimizing project risks, saving development time and costs by reducing the need for late-stage refactoring.

Threat Modeling

Service

Our data-centric threat models provide a comprehensive risk assessment that identifies specific system risks and potential threat actors, both internal and external. We use a proven methodology to help you develop more secure applications and systems.

01
Security Control Maturity Assessment
02
Comprehensive Threat Landscape Mapping
03
Trust Zone Analysis
04
Threat Actor Profiling

Threat modeling helps you proactively identify risks, understand potential attack vectors, and develop targeted mitigation strategies.

Cloud/Infrastructure Assessment

Service

We evaluate the infrastructure used to deploy and operate cloud-hosted applications and environments. Our assessment identifies key threats and develops a comprehensive understanding of your cloud-native environment's security posture.

01
Advanced Automated Analysis
02
Container and Orchestration Security
03
Infrastructure Configuration Review
04
Cloud Deployment Risk Assessment

Our Cloud Assessment provides comprehensive security insights, helping you identify and mitigate infrastructure vulnerabilities before they become critical issues.

Comprehensive Code Assessment

Service

Our Comprehensive Code Assessment adopts a hybrid approach, combining manual review, static analysis, and dynamic testing to evaluate high-risk components across your entire project, including core code, infrastructure, front end, back end, APIs, and SDKs.

01
Strategic Security Improvement
02
Advanced Testing Methodologies
03
Multi-Language Vulnerability Analysis
04
Comprehensive Code Quality Evaluation

Our Comprehensive Code Assessment provides a holistic review of your system, delivering insights into potential vulnerabilities and architectural risks with actionable guidance for improving your project's security and integrity.

What ships with every engagement

Most pen-test firms hand you a PDF and walk away. Every Trail of Bits engagement ships a deliverable set your engineering team can plug into their workflow on day one and keep using long after we're gone.

Deliverable Trail of Bits Status Quo

Written findings report

Severity, difficulty, and exploit scenario for every finding.

✓ ✓

Short- and long-term SDLC recommendations

Not just bug fixes — process changes that prevent the next class of bug.

✓ —

Codebase maturity evaluation

Structured review of testing, documentation, access controls, and supply-chain hygiene.

✓ —

Exploit PoCs + code artifacts

Runnable demonstrations for each finding so your engineers can reproduce and verify fixes.

✓ Sometimes

CI-ready Semgrep / CodeQL rules

Custom static-analysis rules tuned to the patterns we found in your code.

✓ —

Fuzzing harnesses

Drop-in fuzzers your team keeps running after we leave.

✓ —

LLM and Claude-skill harnesses

Agent skills and prompts to help your team triage findings and pre-flight the next review.

✓ —

Live walkthrough + fix-review retest

We read out findings in person and re-test patches when they land.

✓ Sometimes

Open publication of generalizable findings

Novel issues turn into public research so the whole industry benefits.

✓ —

Comparison based on the standard published deliverables of the major application-security firms as of May 2026.

Public work

Public AppSec assessments

Browse library →
Public engagements
70
Person-weeks logged
391
Distinct groups
1
With effort reported
70

Recent public engagements

Date Engagement Client / group Effort
Apr 2026 PyPI Warehouse Technology Product Reviews 6 wks
Oct 2025 X XChat Technology Product Reviews 4 wks
Oct 2025 Edera Runtime Container Technology Product Reviews 4 wks
Aug 2025 Meta WhatsApp Private Processing Technology Product Reviews 12 wks
Jun 2025 Discord E2EE WebAssembly Technology Product Reviews 3 wks
May 2025 libVLC Technology Product Reviews 5 wks
Feb 2025 NATS Server Technology Product Reviews 6 wks
Dec 2024 Istio Ztunnel Technology Product Reviews 2 wks
Dec 2024 RubyGems.org Technology Product Reviews 5 wks
Nov 2024 Kraken Wallet In-App Browser Technology Product Reviews 4 wks

Get in touch

Book a technical office hours session

Book a complimentary one-hour meeting with one of our engineers to dive into a challenging technical issue, explore tooling options, and gain valuable insights directly from our experts. This session is purely technical — no sales talk, just a focused discussion that showcases our depth, talent, and capabilities.

Book a Session