Trail of Bits Software Assurance

Software Assurance is a security assessment service from Trail of Bits that combines specialists across application security, blockchain, cryptography, and AI/ML into a single engagement. Engagements are staffed based on the client's threat model rather than a fixed template, and follow a structured process: scope and team assembly, discipline-led parallel reviews, cross-discipline integration passes targeting the seams between disciplines (e.g., auth and crypto, ML pipeline and supply chain), root-cause analysis, and remediation guidance. Deliverables include a written findings report with severity, difficulty, and exploit scenarios; short- and long-term SDLC recommendations; codebase maturity evaluation; exploit proof-of-concepts and code artifacts; custom Semgrep and CodeQL rules tuned to the codebase; fuzzing harnesses; LLM and Claude-skill harnesses for triage; and a live walkthrough with fix-review retesting. The company publishes methodologies, tools, and findings publicly, including open-source tools such as Slither, Echidna, and Medusa, and resources like ZKDocs, the Testing Handbook, and Building Secure Contracts. Communication during engagements happens through a shared chat channel (e.g., Slack) with weekly status syncs between client and Trail of Bits teams.