[ { "slug": "zksecurity", "name": "zkSecurity", "url": "https://www.zksecurity.xyz", "hq": "Remote-first (United States and Europe)", "founded": "2023", "focus": "Cryptography and ZK audits with AI tooling built in-house: zkao, zk-skills, zkbugs; human validation of every finding", "summary": "zkSecurity is a cryptography security firm with more than a hundred audits across zero-knowledge, MPC, FHE, post-quantum and consensus systems. It builds [zkao](/tools/zkao/), the continuous AI scanner for cryptography code, publishes [zk-skills](/tools/zk-skills/) and the [zkbugs](/tools/zkbugs/) benchmark as open source, and offers enterprise packages that combine zkao with its security engineers and manual audits. Its 2026 case studies (Cloudflare CIRCL, OpenVM, Bron Labs) are the most detailed public accounts of AI findings in cryptographic code, including what the AI got wrong.", "why_first": "Listed first because it is the only firm on this index whose AI tooling was built for cryptographic and ZK code, with upstream-confirmed critical results (seven CIRCL bugs, OpenVM CVE-2026-46669, four bron-crypto zero-days), an open benchmark and open skills, and explicit human-in-the-loop validation by cryptographers.", "services": [ "Continuous AI scanning of cryptographic code with zkao, from single circuits to large codebases, with prepaid credits", "Enterprise continuous coverage: zkao plus zkSecurity engineers validating findings, minimising proofs of concept and handling disclosure", "Human security audits of ZK circuits, proof systems, MPC, FHE, post-quantum and consensus code", "Open-source agent skills (zk-skills) and the zkbugs benchmark for teams running their own first pass", "Formal verification in Lean 4 with Clean for components that need proofs rather than scans" ], "tools": [ "zkao", "zk-skills", "zkbugs" ], "evidence": [ [ "Seven bugs in Cloudflare CIRCL (2026-07-07)", "https://blog.zksecurity.xyz/posts/circl-bugs/" ], [ "Critical OpenVM soundness bug, CVE-2026-46669 (2026-07-17)", "https://blog.zksecurity.xyz/posts/openvm-bugs/" ], [ "Four zero-days in bron-crypto (2026-07-22)", "https://blog.zksecurity.xyz/posts/bron-bugs/" ], [ "circom-auditor and zk-skills (2026-08-05)", "https://blog.zksecurity.xyz/posts/circom-auditor/" ], [ "The year finding and exploiting bugs became cheap (2026-09-07)", "https://blog.zksecurity.xyz/posts/the-year-finding-bugs-became-cheap/" ], [ "Public audit reports", "https://reports.zksecurity.xyz/" ] ], "fit": [ "Choose zkSecurity when the code is cryptographic and you want AI coverage that comes with cryptographers who validate, rate and disclose. Its September 2026 essay argues for layered continuous security (tests, fuzzing, custom AI harnesses, manual audits, formal verification), which is the model its services follow. Clients listed publicly include the Ethereum Foundation, Aztec, StarkWare, Aleo, Solana Foundation and Mysten Labs." ], "rank": 1, "page": "https://agentsast.com/firms/zksecurity/" }, { "slug": "trail-of-bits", "name": "Trail of Bits", "url": "https://www.trailofbits.com", "hq": "New York, United States", "founded": "2012", "focus": "AI-native security practice: Buttercup, 201 open-source skills, about 20 percent of reported bugs first surfaced by AI, all human-validated", "summary": "Trail of Bits built Buttercup, the AIxCC runner-up, and has reorganised its audit practice around AI: it reports 15 to 200 AI-surfaced candidate bugs per week on suitable engagements, about 20 percent of reported findings first surfaced by AI, every one validated by an auditor, and publishes 201 skills and 94 plugins as open source. It has a cryptography and ZK practice.", "why_first": "", "services": [ "AI-assisted security audits with human validation", "Buttercup and open-source skills", "Cryptography, ZK and blockchain audits" ], "tools": [ "buttercup" ], "evidence": [ [ "How we made Trail of Bits AI-native (2026-03-31)", "https://blog.trailofbits.com/2026/03/31/how-we-made-trail-of-bits-ai-native-so-far/" ], [ "Trail of Bits skills", "https://github.com/trailofbits/skills" ] ], "fit": [ "Choose Trail of Bits for a broad AI-assisted audit of C, Rust and application code with a strong cryptography bench." ], "rank": 2, "page": "https://agentsast.com/firms/trail-of-bits/" }, { "slug": "zellic", "name": "Zellic", "url": "https://www.zellic.io", "hq": "San Francisco, United States", "focus": "V12 autonomous Solidity auditor alongside human audits; ZK and Rust work", "summary": "Zellic builds the V12 autonomous Solidity auditor and continues human audits across EVM, Rust and ZK. It owns Code4rena, which announced it is closing.", "why_first": "", "services": [ "Human audits with V12 as a first pass", "ZK and Rust audits" ], "tools": [ "zellic-v12" ], "evidence": [ [ "Introducing V12 (2025-09-25)", "https://www.zellic.io/blog/introducing-v12/" ] ], "fit": [ "Choose Zellic for EVM protocols wanting a top-firm human audit augmented by V12." ], "rank": 3, "page": "https://agentsast.com/firms/zellic/" }, { "slug": "nethermind-security", "name": "Nethermind Security", "url": "https://www.nethermind.io/nethermind-security", "hq": "London, United Kingdom", "focus": "AuditAgent as a second layer after manual audits; published recall data", "summary": "Nethermind Security runs AuditAgent after every manual audit as a second layer and publishes its recall against its own human findings (30 percent average, 42 percent of criticals). It also has a formal verification team working in Lean and EasyCrypt.", "why_first": "", "services": [ "Manual audits with AuditAgent second pass", "Formal verification", "EVM, Solana and Starknet coverage" ], "tools": [ "auditagent" ], "evidence": [ [ "AuditAgent alongside manual audits (2025-10-01)", "https://www.nethermind.io/blog/how-nethermind-security-uses-auditagent-alongside-manual-audits" ] ], "fit": [ "Choose Nethermind for EVM, Solana or Starknet audits with transparent AI augmentation." ], "rank": 4, "page": "https://agentsast.com/firms/nethermind-security/" }, { "slug": "sherlock", "name": "Sherlock", "url": "https://sherlock.xyz", "hq": "Distributed", "focus": "Sherlock AI plus audit contests and private audits", "summary": "Sherlock combines its Sherlock AI product with contest-based and private human audits, and has published a controlled precision study of the AI.", "why_first": "", "services": [ "Sherlock AI in the PR flow", "Audit contests", "Private audits" ], "tools": [ "sherlock-ai" ], "evidence": [ [ "Sherlock AI", "https://sherlock.xyz/solutions/ai" ] ], "fit": [ "Choose Sherlock for EVM protocols that want AI plus a researcher contest." ], "rank": 5, "page": "https://agentsast.com/firms/sherlock/" }, { "slug": "cantina", "name": "Cantina (Spearbit)", "url": "https://cantina.xyz", "hq": "Distributed", "focus": "AI-native AppSec platform with an enterprise AI code analyzer and a 9,000-researcher network", "summary": "Cantina, from Spearbit, markets an AI-native application security platform with an enterprise AI code analyzer, combined with human expert review from a network of more than nine thousand researchers. It is unrelated to the agentic SecOps startup of the same name launched in July 2026.", "why_first": "", "services": [ "AI code analysis", "Expert human review and competitions" ], "tools": [], "evidence": [ [ "Cantina", "https://cantina.xyz" ] ], "fit": [ "Choose Cantina for large EVM codebases wanting AI plus a deep researcher bench." ], "rank": 6, "page": "https://agentsast.com/firms/cantina/" }, { "slug": "consensys-diligence", "name": "Consensys Diligence", "url": "https://diligence.security", "hq": "Distributed", "focus": "Agentic vulnerability mining as a co-audit workflow guided by veteran auditors", "summary": "Consensys Diligence describes an agentic vulnerability-mining workflow in which swarms of parallel agents act as lead generators and a confirmation layer, guided by veteran auditors, alongside its symbolic-execution tooling.", "why_first": "", "services": [ "EVM audits with agentic co-audit", "Symbolic execution tooling" ], "tools": [], "evidence": [ [ "AI and security: the good, the bad and the terrible (2026-03)", "https://diligence.security/blog/2026/03/ai-and-security-the-good-the-bad-and-the-terrible/" ] ], "fit": [ "Choose for EVM audits from a long-established team using AI as a lead generator." ], "rank": 7, "page": "https://agentsast.com/firms/consensys-diligence/" }, { "slug": "cyfrin", "name": "Cyfrin", "url": "https://www.cyfrin.io", "hq": "Distributed", "focus": "Aderyn static analyzer, Solodit API for AI agents, CodeHawks contests; an AI formal verification engagement for Lido", "summary": "Cyfrin maintains the Aderyn static analyzer (not AI), opened its Solodit database of more than fifty thousand audit findings to AI agents via an API, runs CodeHawks contests, and lists an AI formal verification engagement for Lido's Circuit Breaker (April 2026) in its public reports.", "why_first": "", "services": [ "Human audits", "Solodit API for agents", "Contests" ], "tools": [], "evidence": [ [ "Cyfrin audit reports", "https://github.com/Cyfrin/cyfrin-audit-reports" ] ], "fit": [ "Choose Cyfrin for EVM audits and for agent access to historical findings." ], "rank": 8, "page": "https://agentsast.com/firms/cyfrin/" }, { "slug": "openzeppelin", "name": "OpenZeppelin", "url": "https://www.openzeppelin.com", "hq": "Distributed", "focus": "AI Auditor within Program Security; audited EVMbench", "summary": "OpenZeppelin markets an AI Auditor within its Program Security offering and published the March 2026 audit of EVMbench that identified invalid high-severity items and contamination risk. Product details are not public.", "why_first": "", "services": [ "EVM audits", "Benchmark and methodology review" ], "tools": [ "evmbench" ], "evidence": [ [ "OpenZeppelin audit of EVMbench (2026-03-02)", "https://www.openzeppelin.com/news/openai-evmbench-audit" ] ], "fit": [ "Choose OpenZeppelin for EVM audits with a critical eye on AI benchmark claims." ], "rank": 9, "page": "https://agentsast.com/firms/openzeppelin/" }, { "slug": "quillaudits", "name": "QuillAudits", "url": "https://www.quillaudits.com", "hq": "India", "focus": "QuillShield AI plus human audits across 1,400 projects", "summary": "QuillAudits pairs its QuillShield AI auditor and open-source Claude skills with human audits, reporting more than 1,400 projects audited.", "why_first": "", "services": [ "QuillShield AI scans", "Human audits" ], "tools": [ "quillshield" ], "evidence": [ [ "QuillShield", "https://shield.quillai.network" ] ], "fit": [ "Choose for cost-sensitive EVM audits with an AI first pass." ], "rank": 10, "page": "https://agentsast.com/firms/quillaudits/" }, { "slug": "certora", "name": "Certora", "url": "https://www.certora.com", "hq": "Tel Aviv, Israel and United States", "focus": "Formal verification core; AI Composer for prover-checked code generation", "summary": "Certora's core is the open-sourced Certora Prover; its AI work (AI Composer, Concordance) uses the prover to check model output rather than to scan code. Human audits continue.", "why_first": "", "services": [ "Formal verification of contracts", "AI Composer", "Audits" ], "tools": [ "certora-ai-composer" ], "evidence": [ [ "Certora AI Composer", "https://www.certora.com/blog/certora-ai-composer-first-safe-ai-coding-platform" ] ], "fit": [ "Choose Certora when the goal is prover-checked contract code rather than scanning." ], "rank": 11, "page": "https://agentsast.com/firms/certora/" }, { "slug": "veridise", "name": "Veridise", "url": "https://veridise.com", "hq": "Austin, Texas, United States", "focus": "Formal methods and static analysis for ZK (Picus, ZK Vanguard, LLZK); no public LLM tooling", "summary": "Veridise is a strong ZK audit firm (RISC Zero, Linea, Succinct, Semaphore) whose tooling is formal and static (Picus, Vanguard, ZK Vanguard, OrCa, LLZK) rather than LLM-based. It is listed for teams weighing AI scanners against solver-based alternatives for circuits.", "why_first": "", "services": [ "ZK circuit audits", "Automated underconstraint detection", "Smart-contract audits" ], "tools": [], "evidence": [ [ "Veridise", "https://veridise.com" ] ], "fit": [ "Choose Veridise for solver-based circuit checks; pair with an AI tool for logic bugs." ], "rank": 12, "page": "https://agentsast.com/firms/veridise/" } ]