ObjectSecurity builds software and AI assurance tools for red teams, testers, DevSecOps and MLOps teams, mostly working on defence, industrial and mission-support systems. Its tools find vulnerabilities in compiled software and in AI models, so that teams responsible for high-consequence systems can fix weaknesses before they are exploited.
Much of its work has been carried out for U.S. government research programmes, and the tools are built to run where those programmes run, including fully offline networks.
At A Glance
| Vendor | ObjectSecurity |
|---|---|
| Category | Software and AI assurance, binary vulnerability analysis, access policy automation (R&D) |
| Deployment | Fully offline (on-premises or air-gapped), cloud or hybrid (BinLens) |
| Customers | U.S. Navy, U.S. Space Force, DARPA, DTRA, NIST |
| Founded | 2000 |
| Market classification | Authorisation |
What ObjectSecurity Does
Defence and industrial programmes often run software they did not write and cannot see the source for, and they increasingly field AI models whose failure modes are hard to test from the outside. ObjectSecurity’s tools address both gaps with deterministic analysis that produces evidence a team can act on. Rather than relying on a vendor’s assurances or on testing a system only from the outside, the tools look at the compiled code or the model internals directly. The capabilities grew out of multi-year government-funded R&D and have since been turned into fielded products.
Products
BinLens
BinLens is for testers and security engineers who need to assess firmware or applications delivered as binaries, with or without the matching source code. It combines symbolic execution, static analysis, disassembly and decompilation, and covers more than 30 CPU architectures and 50 binary file formats.
- Memory-safety findings such as overflows, out-of-bounds access and use-after-free
- Control-flow and exploit risks, including user-controlled redirection and dangerous functions
- Cryptographic weaknesses such as hardcoded keys, weak algorithms and low-entropy implementations
- Detection of known malware signatures
FortiLayer
FortiLayer is for teams deploying AI models who need more than black-box testing. It examines how each part of a model reaches its decisions, which reveals weaknesses that output-only testing cannot see, and gives white-box guidance for patching.
- Tests and hardens computer vision models
- Detects prompt injection and jailbreak attempts against LLMs
- Shows how a model can be tricked or misled
- Produces evidence for audits and compliance reviews
OpenPMF Zero Trust Access Policy Automation
OpenPMF generates security and access-control policies automatically from high-level models, so policy follows the system design rather than being written by hand. It is currently an advanced prototype in ObjectSecurity’s labs.
How It Works
| Component | What it does |
|---|---|
| BinLens deployment | BinLens runs fully offline, on-premises or air-gapped, or in cloud and hybrid environments, and can scale to large projects with optional clustering. It is packaged as ready-to-deploy VM images and as Docker and Kubernetes containers. |
| Analysis output | Results are evidence-backed, with the execution paths and traces behind each finding, so an engineer can confirm and triage it quickly. |
| Pipeline integration | BinLens reacts to GitHub and GitLab events and alerts users automatically when it finds a vulnerability. FortiLayer runs inside CI/CD, DevSecOps and MLOps pipelines. |
Company Background
| Founded | 2000. |
|---|---|
| Headquarters | San Diego, California, United States. |
| Leadership | Ulrich Lang, Founder and CEO. |
| Government work | More than 20 SBIR and STTR efforts across the Navy, Space Force, Army, Air Force, DARPA, DTRA, DHS, NIST, MDA and others, including a five-year BinLens licence for U.S. Navy NAWCAD. |
| Compliance | NIST 800-171 BASIC (CUI); SAM-registered small business. |
| Recognition | Included in Gartner research on innovations in securing AI; AFWERX finalist; more than 12 issued patents. |
Note: This overview is compiled from ObjectSecurity’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.