ReversingLabs is a security company that analyses files and software packages to find malware, tampering and other hidden threats. Its customers are software producers and buyers who need to know what is inside the code they ship or install, and security operations teams that inspect large volumes of files every day.
The problem it addresses is that most software arrives as compiled code that buyers cannot inspect, and attackers increasingly hide inside trusted packages and updates rather than in obvious malware.
At A Glance
| Vendor | ReversingLabs |
|---|---|
| Category | Malware analysis, threat intelligence and software supply chain security |
| Deployment | On-premises appliance, containerised service, and cloud deployment on AWS EKS |
| Agentic AI | Admission control and runtime file inspection for AI agent sandboxes with NVIDIA |
What ReversingLabs Does
Commercial and third-party software usually arrives without source code, which makes it hard to check. ReversingLabs inspects compiled binaries directly, so a package can be assessed whether or not its source is available. The same analysis serves two audiences. Software teams use it to catch problems in what they build and buy before release or deployment. SOC teams use it to inspect files arriving from the web, email and endpoints, to investigate suspicious samples, and to look up the reputation of a file or destination.
Products
Spectra Assure
Spectra Assure is for software producers and the enterprises that buy their software. It analyses compiled packages, components and third-party dependencies and gives early, actionable feedback before software ships or is installed. Findings cover malware and known vulnerabilities, evidence of tampering or unauthorised changes, exposed secrets or credentials, risky behaviours, weak code hardening and licensing issues.
Spectra Detect
Spectra Detect handles high-speed, high-volume inspection of large files. It is aimed at organisations that need to scan everything arriving from the web, email, endpoints, file shares and cloud storage, not just a sample.
Spectra Analyze
Spectra Analyze gives SOC analysts a malware lab on demand. It runs automated static and dynamic analysis on a sample and supports search and threat hunting across results.
Spectra Intelligence
Spectra Intelligence supplies reputation data drawn from the company’s corpus of goodware and malware. Teams query it through an OpenAPI specification or consume it as TAXII 2.1 feeds, and a browser extension brings it, together with Spectra Analyze, into the analyst’s browser.
File Inspection Engine And T1000
The File Inspection Engine is a containerised service that returns real-time scanning verdicts, for teams that want analysis embedded in their own systems. The T1000 serves organisations that must keep lookups on premises, holding an up-to-date local copy of Spectra Intelligence.
How It Works
| Component | What it does |
|---|---|
| Spectra Core | Spectra Core is the analysis engine that examines files across the products. The same engine underpins supply chain checks in Spectra Assure, high-volume inspection in Spectra Detect and sample analysis in Spectra Analyze. |
| Deployment | Delivery depends on the product: the T1000 is an on-premises appliance, the File Inspection Engine runs as a container, and Spectra Detect can be deployed on AWS EKS using documented step-by-step instructions. |
| Pipelines | Analysis can be automated in CI/CD pipelines, so each build is checked before release. Verdicts flow to Splunk and QRadar, and reputation data can be consumed in OpenCTI. |
Agentic AI Capabilities
Sandbox Admission Control
With NVIDIA, Spectra Assure analyses every sandbox image and SKILL.md bundle at the binary level. Only approved digests reach the registry from which NVIDIA OpenShell builds agent sandboxes, and packages and models come from an internal repository gated by Spectra Assure and the Catalog add-on.
Runtime Inspection
The File Inspection Engine runs as OpenShell supervisor middleware and checks outbound request bodies before credentials are injected. When a blocked agent asks for new network access, a ReversingLabs reviewer checks the destination’s reputation before the rule is approved. A governance interceptor stops policy from being quietly weakened later. Runtime inspection and the governance interceptor are in pilot.
Security Operations
Approved hashes become the NVIDIA DOCA Argus allowlist, and decisions, telemetry and verdicts flow to the SIEM alongside reputation data.
Company Background
| Leadership | Mario Vuksan, co-founder and CEO. |
|---|---|
| Funding | A 2021 Series B led by Crosspoint Capital Partners, with existing investor ForgePoint Capital and new investor Prelude, a Mercato Partners fund. |
| Recognition | Included in the inaugural Gartner Magic Quadrant for Software Supply Chain Security. |
Note: This overview is compiled from ReversingLabs’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.