Most security research lives in one of two worlds: academic work that's rigorous but disconnected from production systems, or vendor research that's marketing with footnotes. We operate in the gap between them. Our research programs tackle hard problems in program analysis, binary translation, symbolic execution, and AI security, and we build working systems that get tested against real-world constraints.

That's not aspirational language. Our Buttercup cyber reasoning system placed second at DARPA's AI Cyber Challenge, winning $3M and proving that automated vulnerability discovery can work at scale. Our EBOSS program builds enhanced software bills of materials that actually help maintainers triage and remediate vulnerabilities in C and C++ codebases.

We're reverse engineering medical device firmware for ARPA-H, finding vulnerabilities in infusion pumps and wearable devices before attackers do. And we're designing the evaluation scenarios that measure whether AI models can actually do security work, or just talk about it.

What makes this different from typical R&D shops: we don't treat research as separate from practice. The techniques we develop feed directly into our client engagements, our open-source tools, and the broader security community. When we publish at USENIX or ISSTA, it's because we solved a problem worth solving, not because we needed another line on a CV.