We make security research a reality
We know a security problem when we see one…
…and we know exactly how to fix it
We can solve this problem because
of our world-class backgrounds in…
Secure
systems
Our expertise is deploying systems that are safe against real attackers. We shipped the framework that protects millions of Firefox users from bugs in third-party libraries, built the first commercial system to isolate enterprise secrets from untrusted Node.js libraries, proved that production sandboxes actually keep users safe, and deployed privacy-enhancing tools to millions of Brave users. We care about ecosystem security, too: our team members have authored IETF and W3C specifications, serve on the Bytecode Alliance board and (formerly) the Node.js Security Working Group, and received the IEEE Cybersecurity Awards for Practice and a Test of Time award for influential academic research on security.
Bug finding
We also know how attackers find and exploit bugs in the wild. We’ve discovered over two dozen high-severity, bountied, or CVE-carrying bugs in Chrome and Firefox. We’ve developed exploits that exfiltrate passwords from Chrome’s Password Leak Detection tool and that reconstruct users’ browsing history in four major browsers. Finally, we've discovered vulnerabilities in modern processors.
Cryptography
We are experts in the theory and practice of cryptography. We were among the first researchers in practical zero-knowledge proofs, including the first hardware design and one of the fastest known provers. We designed and standardized the cryptographic primitives that power Ethereum, Avalanche, and many other blockchains, deployed privacy-preserving airdrops, developed cutting-edge compilers for ZK proofs and MPC protocols, built the fastest GPU implementations of AES and SHA3, and created domain-specific languages that prevent timing side channels. In short, our expertise runs the gamut from cutting-edge theory to low-level implementation.
Formal verification
We don’t just design and implement secure systems—we also prove them correct. To protect users from remote attackers trying to steal data or compromise machines, we’ve proven that parts of the Firefox just-in-time compiler and the Cranelift Wasm compiler do what they’re supposed to. We've proven that software and hardware crypto implementations are resistant to side channel attacks. And, our team includes core developers of foundational tools for proving correctness, tools that companies like Amazon and Certora rely on.
Secure
systems
Our expertise is deploying systems that are safe against real attackers. We shipped the framework that protects millions of Firefox users from bugs in third-party libraries, built the first commercial system to isolate enterprise secrets from untrusted Node.js libraries, proved that production sandboxes actually keep users safe, and deployed privacy-enhancing tools to millions of Brave users. We care about ecosystem security, too: our team members have authored IETF and W3C specifications, serve on the Bytecode Alliance board and (formerly) the Node.js Security Working Group, and received the IEEE Cybersecurity Awards for Practice and a Test of Time award for influential academic research on security.
Cryptography
We are experts in the theory and practice of cryptography. We were among the first researchers in practical zero-knowledge proofs, including the first hardware design and one of the fastest known provers. We designed and standardized the cryptographic primitives that power Ethereum, Avalanche, and many other blockchains, deployed privacy-preserving airdrops, developed cutting-edge compilers for ZK proofs and MPC protocols, built the fastest GPU implementations of AES and SHA3, and created domain-specific languages that prevent timing side channels. In short, our expertise runs the gamut from cutting-edge theory to low-level implementation.
Bug finding
We also know how attackers find and exploit bugs in the wild. We’ve discovered over two dozen high-severity, bountied, or CVE-carrying bugs in Chrome and Firefox. We’ve developed exploits that exfiltrate passwords from Chrome’s Password Leak Detection tool and that reconstruct users’ browsing history in four major browsers. Finally, we've discovered vulnerabilities in modern processors.
Formal
verification
We don’t just design and implement secure systems—we also prove them correct. To protect users from remote attackers trying to steal data or compromise machines, we’ve proven that parts of the Firefox just-in-time compiler and the Cranelift Wasm compiler do what they’re supposed to. We've proven that software and hardware crypto implementations are resistant to side channel attacks. And, our team includes core developers of foundational tools for proving correctness, tools that companies like Amazon and Certora rely on.
Cubist
leadership
Riad Wahby
Co-Founder & CEO
Riad is a member of the Electrical and Computer Engineering faculty at Carnegie Mellon University. He is a leading academic researcher on zero-knowledge proofs and their applications, and is also responsible for the design and specification of several cryptographic protocols that form the basis for the security of Ethereum, Avalanche, and many other blockchains.
Riad was previously a cryptographic researcher at Algorand, and spent a decade as an analog and mixed-signal integrated circuit designer at Silicon Labs. Riad received his SB and MEng in Electrical Engineering and Computer Science from MIT, and his PhD in Computer Science at Stanford, where he was supported by a Ripple Fellowship. His work was recognized with a Distinguished Paper award at WOOT 2023.
Assistant Professor, Electrical & Computer Engineering at CMU
PhD, Computer Science at Stanford University
Ann Stefan
Co-Founder & COO
Ann is an accomplished strategy executive who spent seven years as a fintech COO in a high-risk consumer segment. For the majority of her career, she has focused on new market expansion, product development, and rapid scaling in early-stage SaaS and fintech companies. She has a rare breadth of technical and management experience spanning risk, product, sales, marketing, customer support, and government contracts.
Her core expertise centers around payment processing, online payments fraud prevention, and anti-money laundering programs, gained from years of building and running a fintech risk team and product in-house. She received a BS in Chemical-Biological Engineering from MIT and is on the Board of Directors for First Generation Alumni of MIT.
Former fintech COO
BS, Chemical-Biological Engineering at MIT
Fraser Brown
Co-Founder & CTO
Fraser is an Assistant Professor at Carnegie Mellon University’s School of Computer Science (Software and Societal Systems Department). Her research focuses on security and program correctness, from verifying (parts of) production systems to automatically finding exploitable bugs in real codebases; for example, her tools have found many zero-day bountied bugs and CVEs in the popular Chrome and Firefox browsers.
Fraser also works on compilation; in collaboration with CEO Riad and others, she developed the CirC compiler for cryptographic proof systems. Fraser received her BA in English and MS and PhD in Computer Science from Stanford, where she was supported by an NSF graduate research fellowship. Her work has been recognized with Distinguished Paper awards at IEEE Security & Privacy 2023 and WOOT 2023.
Assistant Professor, School of Computer Science at CMU
PhD, Computer Science at Stanford University
Deian Stefan
Co-Founder & Chief Scientist
Deian is an Associate Professor of Computer Science and Engineering at UC San Diego, where he co-leads the Security and Programming Systems groups. His research lies at the intersection of security and programming languages; he is particularly interested in building secure systems that are deployed in production. He was a co-founder of Intrinsic, a runtime security startup acquired by VMware in 2019.
His work has been recognized with a Most Influential Paper award (ICFP 2022), a Cybersecurity Award for Practice (IEEE 2022), Distinguished Paper awards (POPL 2019, USENIX Security 2020, ICFP 2020, POPL 2021, IEEE Security & Privacy 2023, ASPLOS 2023), an NSF CAREER award, and a Sloan Fellowship. He received his BE and ME in Electrical Engineering from Cooper Union and an MS and PhD from Stanford, where he was supported by an NDSEG graduate research fellowship.
Associate Professor, Computer Science & Engineering at UCSD
PhD, Computer Science at Stanford University
John Renner
Founding Engineer
At Cubist, John focuses on the design of developer tool interfaces. He received his PhD in Computer Science from UC San Diego, where he developed programming languages and tools to provide automated security guarantees to developers; during this time, he created CT-Wasm, a standards-track proposal to bring secure cryptography to WebAssembly.
John has also worked on internal developer tools at Google and on language-level testing support as a member of the Rust team at Mozilla.
PhD, Computer Science at UCSD
Aleksandar Milicevic
Founding Engineer
At Cubist, Aleksandar focuses on developer tools. Previously, he worked as a Principal Software Engineer at Microsoft, where he led the development of various low-level Linux-specific solutions like process sandboxing and filesystem virtualization. He was also a key contributor to a novel build system that leverages those solutions to automatically add caching and distribution to any existing build.
Aleksandar received his PhD in Computer Science from MIT in 2015. His thesis focused on designing declarative programming paradigms with the goal of building correct and robust software more easily.
PhD, Computer Science at MIT
Andres Nötzli
Founding Engineer
At Cubist, Andres focuses on compilation infrastructure. He has worked on compilers and databases, and is an expert in the design and implementation of SMT solvers; during his PhD at Stanford, Andres was one of the core developers of the cvc5 solver, an automated reasoning tool that is used extensively in industry and academia.
Prior to Stanford, Andres received his MS in Computer Science at EPFL. He has also worked on verification tools at the Amazon AWS Automated Reasoning Group, and contributed to Facebook's RocksDB, a high performance key-value store.
PhD, Computer Science at Stanford University
The experts we rely on for advice
Professor at Stanford University
Co-Director at Stanford Center for Blockchain Research
Professor at Stanford University
Co-Director at Stanford Center for Blockchain Research
Co-Founder at Stellar Development Foundation
Associate Professor at Stanford University
Co-Founder at Coverity (acquired by Synopsis)
Professor at UCSD
Tech & Venture at Family Office
Former CTO of Autograph
