Skip to content

Trail of Bits

Summary

Trail of Bits is a cybersecurity consulting firm (140 employees as of March 2026, operating for 14 years) led by Dan Guido. In March 2026, they published a detailed account of transforming from 5% AI adoption to a full AI-native operating system over one year, resulting in auditors finding 200 bugs/week (up from 15), 94 plugins, 201 skills, 84 specialized agents, and measured $8M/rep/yr sales revenue. Most of their tooling has been open sourced.

Key Facts

  • Founded: ~2012 (14 years of audit knowledge as of 2026)
  • Size: 140 employees as of March 2026
  • Leadership: Dan Guido (CEO/founder)
  • Domain: Application security auditing, blockchain security, penetration testing
  • AI adoption milestone: From 5% on board to AI-native operating system in ~1 year
  • Open source: trailofbits/skills, trailofbits/skills-curated, trailofbits/claude-code-config, trailofbits/claude-code-devcontainer, trailofbits/dropkit, trailofbits/slither-mcp

AI Transformation

Trail of Bits' AI transformation is one of the most detailed real-world case studies of an AI-native organization. Key elements:

  • Built a maturity matrix with visible levels and real consequences
  • Wrote an AI Handbook explaining the risk model, not just listing rules
  • Run adoption hackathons as a management system
  • Created internal and external skills repos with compounding domain expertise
  • Implemented sandboxing as default (Dropkit for macOS, devcontainer option)
  • Connected agents to real tools via MCP (e.g., Slither MCP server)

AI-Native Results

  • 94 plugins, 201 skills, 84 specialized agents, 29 commands, 125 scripts, 414+ reference files
  • 15 bugs/week → 200 bugs/week in supported engagements
  • ~20% of bugs now initially discovered by AI
  • Sales team: $8M/rep/yr (industry benchmark $2-4M)
  • About 95% of employees on board with AI initiative

Open Questions

  • How will Trail of Bits handle the consulting billing model disruption ("if some auditors outperform others by orders of magnitude, that correlation breaks")?
  • What's the long-term architectural coherence of a fully agent-influenced codebase?

Sources