20+ years of AppSec R&D, from the lab to the market leader.
We started in research, built a commercial engine, and saw it acquired into the market leader. Since 2019 we’ve brought that experience to AppSec vendors of every size.
We’ve been on every side of an AppSec product.
Researchers, engine builders, founders, and part of the market leader. That is the experience we bring to every engagement.
- 2004–2010
Deep-tech SAST R&D
We started as researchers at UNSW and CSIRO (NICTA), working on core static analysis engines, formal methods, AI, compilers, cloud infrastructure, and programming languages.
- 2010–2019
Product development
We turned that research into a commercial static analysis engine for C and C++, acquired by Black Duck (Synopsys) and integrated into Coverity, then the market leader. Across those years we developed SAST rules, designed AppSec engines, built a custom rules engine, and shipped reporting and IDE plugins. We also led coding-standard compliance, set up an R&D centre, and helped grow the business several times over.
- 2019+
AppSec services
We founded Securisource to bring that experience to every AppSec vendor. Since then we have delivered 300+ security rules across 20+ languages and 100+ frameworks, and benchmarked products for vendors ranging from early-stage startups to more than half of Gartner’s Magic Quadrant Leaders.
- Today
AppSec and AI
Several research theses and applied SAST work in generative AI, and hands-on experience building agentic systems. Our in-house AI team builds rule generation, triage, AppSec data platforms, and context and memory for AI coding agents.
The engine, the product, and the market.
Most AppSec problems cross all three. We have deep experience in each.
Security research
Security rules and framework implementation, across 300+ rules and 100+ frameworks.
Programming languages
Fluent across all mainstream programming languages, with security rules delivered in more than 20.
Parser and compiler technologies
We have built the parser and compiler front ends that analysis tools depend on.
Program analysis
Deep expertise in SAST core development: analysis engines, formal methods, and custom rules engines.
Generative AI
Several research theses and applied SAST work in generative AI.
API and agentic design
Hands-on experience designing APIs and building agentic AI systems.
Full-stack development
We have built complete SaaS platforms, from cloud infrastructure to the user interface.
Plugin and IDE development
Developer plugins for VS Code, Eclipse, and other IDEs, and the reporting behind them.
Benchmarking
Evaluation in Python, JavaScript, C/C++, C#, Java, and PHP, with monitoring for regressions and continuous triage.
Competitor analysis
Detailed knowledge of how the major SAST tools compare with each other.
Industry standards
Consulting on OWASP, CERT, NIST, MISRA, ISO 26262, and C++ coding standards.
Product and market consulting
Customer voice and market lessons for product teams, and guidance on competitors and demand.
- 20+ yrs
- of AppSec R&D, from research lab to market leader
- 50%+
- of Gartner’s Magic Quadrant Leaders have worked with us
- 300+
- security rules delivered
- 100+
- frameworks across 20+ languages
Based in Sydney. Working worldwide.
Our team works remotely with clients around the globe, including:
- US
- UK
- Europe
- Singapore
- Israel
- Switzerland
Expertise on day one, not month six.
End‑to‑end delivery.
Self-contained delivery, including project management. We run the team and report against agreed delivery KPIs.
The right expert for each task.
We assign specialists from our pool to each task by fit, and change the mix as the work changes.
Close communication.
We work inside your process and tools, with monthly check-ins. Our longest partnership has run 5+ years with minimal attrition.
Both sides of the problem.
Engineers who think like security researchers. Researchers who ship like engineers.
No ramp-up.
We have done this work countless times, for many vendors. We know what to do and how to do it.
Tell us what you are building.
Email us and a senior practitioner will reply.