Skip to main content

Research & Development

Papers, government research, open source

Overview

Our applied research builds open-source tools that make low-level software vulnerabilities easier to find and understand, spanning binary translation, fuzzing, symbolic execution, fault injection, and compilers. We prototype the security tools of tomorrow under DARPA and ARPA-H programs and commercial commissions, then release the results through our blog, Empire Hacking, and peer-reviewed conferences.

Security improves fastest when the science behind it is shared, so we share it.

Why work with Trail of Bits R&D

  • 01

    Research that becomes the standard

    Our tools end up in everyone's pipelines: Manticore, osquery, Slither, Echidna, Medusa, Buttercup. DARPA AIxCC finalists and ARPA-H awardees. When our research lands, it doesn't sit in a paper; it becomes the way the rest of the industry works.

  • 02

    We publish everything

    Peer-reviewed papers, open-source releases, blog write-ups, and public datasets are the default output. The Trail of Bits blog, our publications repo, and Empire Hacking are all free for the community, and your team gets the same artifacts you'd commission us to build.

  • 03

    Prototypes that ship to production

    We don't stop at proofs of concept. Research projects come with the engineering rigor to be deployed, maintained, and extended: peer-reviewed by a second engineer, documented end-to-end, integration-tested before handoff.

Services & deliverables

What ships with every research engagement

Most research vendors publish a paper and call it done. Every Trail of Bits R&D engagement ships a research artifact your team can actually run.

Deliverable Trail of Bits Typical research vendor

Peer-reviewed publication

Submission-quality paper or technical report.

✓ ✓

Open-source release

Permissively licensed code, plus the build and test infrastructure.

✓ Sometimes

Working prototype + documentation

Not just a paper, but a runnable artifact with the engineering rigor for handoff.

✓ —

Reproducibility package

Datasets, configs, and scripts so an outside team can reproduce results.

✓ —

CI integration patterns

Where applicable, the research deliverable ships with the patterns your team needs to integrate it.

✓ —

Productization roadmap

Short- and long-term recommendations for taking the prototype to production.

✓ —

Knowledge transfer + live walkthroughs

Our team trains yours so the work continues after we leave.

✓ Sometimes

Comparison based on the typical output of research vendors and academic-style engagements, as of 2026.

Get in touch

Book a technical office hours session

Spend a free hour with one of our engineers on a specific technical problem: an architecture you're unsure about, a tool you want to stand up, a finding you can't reproduce. No pitch and no sales engineer, just a working session with someone who does this every day.

Book a session