British software supply chain security startup RevEng.AI says it has raised $15 million in early-stage funding after developing technology similar to Anthropic PBC’s Mythos model and working out a way to put it to good use.

The startup, officially known as Binary AI Ltd., wants to help organizations use its technology to analyze software at the binary level so they can determine what it’s made up of, such as the executables, firmware and third-party programs, without needing access to the source code. Its foundational model is called BiNet, and similar to Mythos, its goal is to identify cyberthreats within these binaries so they can be fixed before they’re exploited.

Founder and Chief Executive James Patrick-Evans said the BiNet model was trained alongside the elite cybersecurity units of a number of allied governments and also some top commercial security firms. Its purpose is to dig up hidden vulnerabilities and backdoors that may have been purposely placed in widely-used software.

He wants to put the technology to good use and help fix the integrity of software supply chains. According to Patrick-Evans, software supply chain attacks are now one of the most consequential risks facing enterprises and critical infrastructure providers.

That’s because these organizations are almost certainly reliant on some kind of software that they have not built or fully inspected themselves, meaning they have no idea how vulnerable it is. The challenge is that once software has been compiled into a machine-executable format, the components are no longer easily visible, making it difficult to identify the blind spots within it.

With BiNet, RevEng.AI gives companies a way to check there is no malicious or high-risk functionality embedded inside by reverse-engineering the machine-executable code that organizations see.

Patrick-Evans said there’s an even greater urgency to do this with the rise of artificial intelligence coding bots, which are increasingly generating and modifying vast amounts of software.

“In a world where AI increasingly writes the code, the only universal source of truth is the executable binary files that actually run on machines,” he said. “RevEng gives organizations an independent way to verify software at the binary level before it is released, bought, or deployed. This is critical because much of the software being built today is never reviewed or seen by a human, making it untrustworthy. It needs to be automated, and that’s exactly what RevEng delivers.”

Though it doesn’t provide any numbers, RevEng.AI insisted that it has seen “strong demand” for its platform from both enterprises and defense organizations. The BiNet model integrates into existing security workflows and software delivery pipelines to enable proactive verification of newly-written code before it’s shipped into production environments.

Today’s Series A round was led by the NATO Innovation Fund and saw participation from Sands Capital, In-Q-Tel, IQ Capital and Episode One.

NATO Innovation Fund Senior Associate David Ordonez said securing software supply chains is vital for both national and economic security. Everything from banks to energy grids to transportation systems and hospitals, is reliant on third-party software, he pointed out.

“RevEng.AI gives organizations the ability to understand what is actually inside the software they rely on, even when that software is closed-source or delivered by third parties,” he said. “It closes a critical gap in software supply chain security and strengthens the resilience of the systems our societies depend on.”

Image: RevEng.AI