What we do
Driven by Research

We make security research a reality

We’ve written more than 80 peer-reviewed papers about building and breaking hardware, operating systems, language runtimes, compilers, web browsers, and cryptographic protocols—and our security research actually makes it to the real world. We’ve designed the low-level cryptography underlying Ethereum, Avalanche, and other chains, shipped software sandboxing in the Firefox browser, identified high-severity security vulnerabilities in systems like Google Chrome, and more.
Empowered by Know-how

We know a security problem when we see one…

Teams across the entire industry are forced to choose between security—keeping keys safe from attackers—performance—keeping keys available in memory—and convenience—keeping keys hidden from end-users. We’ve seen this tradeoff before: it’s there when crypto engineers fight their compilers to write safe, constant-time code, and it’s there when browser engineers begrudgingly render PDFs with unsafe libraries. As in these domains, the security-performance-convenience tradeoff in web3 reflects the limitations of existing tooling—it's not a fundamental law of nature.
Delivering Solutions

…and we know exactly how to fix it

We've exposed false security-* tradeoffs before. Our sandboxing systems let browser developers use fast (but unsafe) third-party libraries safely. Our verification tools let companies run untrusted code without worrying about attackers or huge runtime costs. And our compilers let crypto engineers write code in convenient, high-level languages—without giving up on low-level performance or security. We can fix key management with the same toolbox we’ve used before: information flow control, formal verification, compartmentalization, and battle-tested, intentionally simple cryptography.
Driven by Research

We make security research a reality

We’ve written more than 80 peer-reviewed papers about building and breaking hardware, operating systems, language runtimes, compilers, web browsers, and cryptographic protocols—and our security research actually makes it to the real world. We’ve designed the low-level cryptography underlying e.g., Ethereum and Avalanche, shipped software sandboxing in the Firefox browser, identified high-severity security vulnerabilities in systems like Google Chrome, and more.
Delivering Solutions

We know a security problem when we see one…

Something about this length: If X,Y,Z aren’t done correctly, you don’t actually get the security guarantees you think you do. Even though it’s simple, no one else can probably implement it correctly. Why are we the only people who can implement this correctly?

More more more more more more more more more more more more more more more more more.
Delivering Solutions

…and we know exactly how to fix it

As professors, we love complexity because it makes interesting research problems. As secure systems builders, we know that simple is better, because complex is hard to get right. We designed CubeSigner with the most ______ architecture and the most mature components. Something about Riad’s crypto. We’ve built on our expertise in information flow control to enforce secrecy and isolation, and are in the process of formally proving its security property.
Why us

We can solve this problem because

of our world-class backgrounds in…

Secure
systems

Our expertise is deploying systems that are safe against real attackers. We shipped the framework that protects millions of Firefox users from bugs in third-party libraries, built the first commercial system to isolate enterprise secrets from untrusted Node.js libraries, proved that production sandboxes actually keep users safe, and deployed privacy-enhancing tools to millions of Brave users. We care about ecosystem security, too: our team members have authored IETF and W3C specifications, serve on the Bytecode Alliance board and (formerly) the Node.js Security Working Group, and received the IEEE Cybersecurity Awards for Practice and a Test of Time award for influential academic research on security.

Bug finding

We also know how attackers find and exploit bugs in the wild. We’ve discovered over two dozen high-severity, bountied, or CVE-carrying bugs in Chrome and Firefox. We’ve developed exploits that exfiltrate passwords from Chrome’s Password Leak Detection tool and that reconstruct users’ browsing history in four major browsers. Finally, we've discovered vulnerabilities in modern processors.

Cryptography

We are experts in the theory and practice of cryptography. We were among the first researchers in practical zero-knowledge proofs, including the first hardware design and one of the fastest known provers. We designed and standardized the cryptographic primitives that power Ethereum, Avalanche, and many other blockchains, deployed privacy-preserving airdrops, developed cutting-edge compilers for ZK proofs and MPC protocols, built the fastest GPU implementations of AES and SHA3, and created domain-specific languages that prevent timing side channels. In short, our expertise runs the gamut from cutting-edge theory to low-level implementation.

Formal verification

We don’t just design and implement secure systems—we also prove them correct. To protect users from remote attackers trying to steal data or compromise machines, we’ve proven that parts of the Firefox just-in-time compiler and the Cranelift Wasm compiler do what they’re supposed to. We've proven that software and hardware crypto implementations are resistant to side channel attacks. And, our team includes core developers of foundational tools for proving correctness, tools that companies like Amazon and Certora rely on.

Secure
systems

Our expertise is deploying systems that are safe against real attackers. We shipped the framework that protects millions of Firefox users from bugs in third-party libraries, built the first commercial system to isolate enterprise secrets from untrusted Node.js libraries, proved that production sandboxes actually keep users safe, and deployed privacy-enhancing tools to millions of Brave users. We care about ecosystem security, too: our team members have authored IETF and W3C specifications, serve on the Bytecode Alliance board and (formerly) the Node.js Security Working Group, and received the IEEE Cybersecurity Awards for Practice and a Test of Time award for influential academic research on security.

Cryptography

We are experts in the theory and practice of cryptography. We were among the first researchers in practical zero-knowledge proofs, including the first hardware design and one of the fastest known provers. We designed and standardized the cryptographic primitives that power Ethereum, Avalanche, and many other blockchains, deployed privacy-preserving airdrops, developed cutting-edge compilers for ZK proofs and MPC protocols, built the fastest GPU implementations of AES and SHA3, and created domain-specific languages that prevent timing side channels. In short, our expertise runs the gamut from cutting-edge theory to low-level implementation.

Bug finding

We also know how attackers find and exploit bugs in the wild. We’ve discovered over two dozen high-severity, bountied, or CVE-carrying bugs in Chrome and Firefox. We’ve developed exploits that exfiltrate passwords from Chrome’s Password Leak Detection tool and that reconstruct users’ browsing history in four major browsers. Finally, we've discovered vulnerabilities in modern processors.

Formal
verification

We don’t just design and implement secure systems—we also prove them correct. To protect users from remote attackers trying to steal data or compromise machines, we’ve proven that parts of the Firefox just-in-time compiler and the Cranelift Wasm compiler do what they’re supposed to. We've proven that software and hardware crypto implementations are resistant to side channel attacks. And, our team includes core developers of foundational tools for proving correctness, tools that companies like Amazon and Certora rely on.

Who we are

Cubist
leadership

Riad Wahby

Co-Founder & CEO

Riad is a member of the Electrical and Computer Engineering faculty at Carnegie Mellon University. He is a leading academic researcher on zero-knowledge proofs and their applications, and is also responsible for the design and specification of several cryptographic protocols that form the basis for the security of Ethereum, Avalanche, and many other blockchains.

Riad was previously a cryptographic researcher at Algorand, and spent a decade as an analog and mixed-signal integrated circuit designer at Silicon Labs. Riad received his SB and MEng in Electrical Engineering and Computer Science from MIT, and his PhD in Computer Science at Stanford, where he was supported by a Ripple Fellowship. His work was recognized with a Distinguished Paper award at WOOT 2023.

Riad Wahby
Riad Wahby
Co-Founder & CEO

Assistant Professor, Electrical & Computer Engineering at CMU

PhD, Computer Science at Stanford University

Ann Stefan

Co-Founder & COO

Ann is an accomplished strategy executive who spent seven years as a fintech COO in a high-risk consumer segment. For the majority of her career, she has focused on new market expansion, product development, and rapid scaling in early-stage SaaS and fintech companies. She has a rare breadth of technical and management experience spanning risk, product, sales, marketing, customer support, and government contracts.

Her core expertise centers around payment processing, online payments fraud prevention, and anti-money laundering programs, gained from years of building and running a fintech risk team and product in-house. She received a BS in Chemical-Biological Engineering from MIT and is on the Board of Directors for First Generation Alumni of MIT.

Ann Stefan
Ann Stefan
Co-Founder & COO

Former fintech COO

BS, Chemical-Biological Engineering at MIT

Fraser Brown

Co-Founder & CTO

Fraser is an Assistant Professor at Carnegie Mellon University’s School of Computer Science (Software and Societal Systems Department). Her research focuses on security and program correctness, from verifying (parts of) production systems to automatically finding exploitable bugs in real codebases; for example, her tools have found many zero-day bountied bugs and CVEs in the popular Chrome and Firefox browsers.

Fraser also works on compilation; in collaboration with CEO Riad and others, she developed the CirC compiler for cryptographic proof systems. Fraser received her BA in English and MS and PhD in Computer Science from Stanford, where she was supported by an NSF graduate research fellowship. Her work has been recognized with Distinguished Paper awards at IEEE Security & Privacy 2023 and WOOT 2023.

Fraser Brown
Fraser Brown
Co-Founder & CTO

Assistant Professor, School of Computer Science at CMU

PhD, Computer Science at Stanford University

Deian Stefan

Co-Founder & Chief Scientist

Deian is an Associate Professor of Computer Science and Engineering at UC San Diego, where he co-leads the Security and Programming Systems groups. His research lies at the intersection of security and programming languages; he is particularly interested in building secure systems that are deployed in production. He was a co-founder of Intrinsic, a runtime security startup acquired by VMware in 2019.

His work has been recognized with a Most Influential Paper award (ICFP 2022), a Cybersecurity Award for Practice (IEEE 2022), Distinguished Paper awards (POPL 2019, USENIX Security 2020, ICFP 2020, POPL 2021, IEEE Security & Privacy 2023, ASPLOS 2023), an NSF CAREER award, and a Sloan Fellowship. He received his BE and ME in Electrical Engineering from Cooper Union and an MS and PhD from Stanford, where he was supported by an NDSEG graduate research fellowship.

Deian Stefan
Deian Stefan
Co-Founder & Chief Scientist

Associate Professor, Computer Science & Engineering at UCSD

PhD, Computer Science at Stanford University

John Renner

Founding Engineer

At Cubist, John focuses on the design of developer tool interfaces. He received his PhD in Computer Science from UC San Diego, where he developed programming languages and tools to provide automated security guarantees to developers; during this time, he created CT-Wasm, a standards-track proposal to bring secure cryptography to WebAssembly.

John has also worked on internal developer tools at Google and on language-level testing support as a member of the Rust team at Mozilla.

John Renner
John Renner
Founding Engineer

PhD, Computer Science at UCSD

Aleksandar Milicevic

Founding Engineer

At Cubist, Aleksandar focuses on developer tools. Previously, he worked as a Principal Software Engineer at Microsoft, where he led the development of various low-level Linux-specific solutions like process sandboxing and filesystem virtualization. He was also a key contributor to a novel build system that leverages those solutions to automatically add caching and distribution to any existing build.

Aleksandar received his PhD in Computer Science from MIT in 2015. His thesis focused on designing declarative programming paradigms with the goal of building correct and robust software more easily.

Aleksandar Milicevic
Aleksandar Milicevic
Founding Engineer

PhD, Computer Science at MIT

Andres Nötzli

Founding Engineer

At Cubist, Andres focuses on compilation infrastructure. He has worked on compilers and databases, and is an expert in the design and implementation of SMT solvers; during his PhD at Stanford, Andres was one of the core developers of the cvc5 solver, an automated reasoning tool that is used extensively in industry and academia.

Prior to Stanford, Andres received his MS in Computer Science at EPFL. He has also worked on verification tools at the Amazon AWS Automated Reasoning Group, and contributed to Facebook's RocksDB, a high performance key-value store.

Andres Nötzli
Andres Nötzli
Founding Engineer

PhD, Computer Science at Stanford University

Our Advisors

The experts we rely on for advice

Dan Boneh
Dan Boneh
Advisor

Professor at Stanford University

Co-Director at Stanford Center for Blockchain Research

David Mazières
David Mazières
Advisor

Professor at Stanford University

Co-Director at Stanford Center for Blockchain Research

Co-Founder at Stellar Development Foundation

Dawson Engler
Dawson Engler
Advisor

Associate Professor at Stanford University

Co-Founder at Coverity (acquired by Synopsis)

Ranjit Jhala
Ranjit Jhala
Advisor

Professor at UCSD

Cody Berlin
Cody Berlin
Advisor

Tech & Venture at Family Office

Former CTO of Autograph