Whirly Labs | Code-Led Penetration Testing and Static Analysis

Why Whirly Labs?

Code, Not Just the Surface

We read your code as well as testing the running system. That way, we find the root cause of each vulnerability and every place it occurs, and keep false positives out of our reports.

Security assessments →

Built by Developers, for Developers

Many of our analysts worked as software developers before moving into security, and we have developed static analysis on the code property graph for years. We know what it takes to build and maintain software. We explain findings in your code, tell you which ones matter, and stay available while your team fixes them.

How we work →

The Technology Others Use

Whirly Labs was founded in 2023 and is led by the inventor of the code property graph, the program representation behind many modern code analysis tools, recognized with the IEEE Symposium on Security and Privacy Test of Time Award in 2024. He leads the development of the open-source platform Joern, and we build custom static analysis on it.

Custom static analysis →

Services

Our services are built around one goal: getting vulnerabilities fixed. Security assessments such as penetration tests find them in your code and help your developers fix them. Custom static analysis finds every instance and catches them if they return. An embedded security team stays with you as your software changes, and developer training helps your team avoid them in the first place.

Security Assessments

Penetration tests and code reviews that start from your code: we find vulnerabilities and their root causes, then work with your developers to get them fixed.

Learn more →

Custom Static Analysis

Static analysis built for your code base, which knows your frameworks and conventions, runs in your pipeline, and finds every instance of a vulnerability. Built on the code property graph, by the team that invented it.

Learn more →

Embedded Security Team

Our analysts work with your team on an ongoing basis, from reviewing your changes as they happen to serving as your product security or internal penetration testing team.

Learn more →

Developer Training

Hands-on training for your developers, built around your languages and frameworks: vulnerable code, how attackers exploit it, and how to fix it.

Learn more →

All services →

Software Due Diligence

In M&A and investments, much of what you pay for is software. Before you sign, we review its source code: for vulnerabilities an attacker could exploit, for the patterns behind them, and for whether it supports what you have been told. You learn whether you are paying for an asset or a liability while you can still act on it.

How We Work

Every assessment is designed around the developers who will fix its findings.

Understand the application

A kickoff with your developers, then a map of your code that shows where the risks are.
Find root causes

Code review with the code property graph, focused on what tools cannot decide.
Validate and prioritize

Nothing is reported without proof, and you learn which findings matter now.
Report for developers

Findings explained in your code, a feedback call, and 30 days of follow-up.
Fix it together Optional

Hands-on help with the fixes, from pull requests to joint sessions.
Retest and keep it fixed Optional

Every fix verified, and queries that catch the flaw if it returns.

The full process, and what you get →

AI, Led by Our Analysts

We built MAGE, our own AI harness, for what we call cyborg pentesting: our analysts lead, and AI does the grunt work. MAGE drives a real browser to turn suspected vulnerabilities into working exploits, and reports nothing that has not been proven exploitable and reviewed by an analyst. It runs on the inference you choose, and only if you want AI in your assessment.

Meet MAGE

Our Work

Our research finds vulnerabilities in widely used software, which we report responsibly to its vendors. We have found vulnerabilities in:

Microsoft

Linux

VLC Media Player

Cisco Systems

Squid Proxy

Graylog

Thinkst Canary

Pidgin

Vulnerabilities we found →

Research

Our methods come from our own research. The code property graph, introduced by our CEO in 2014, received the IEEE Symposium on Security and Privacy Test of Time Award in 2024. Our team keeps publishing and presenting. Highlights:

All research →

About

Whirly Labs is a privately held, independent, bootstrapped security consultancy with offices in Cape Town and Centurion. We are closely connected to the Computer Science Department of Stellenbosch University, and work with the security firms Recurity Labs, Secfault Security, and KMSEC on research and client projects.

Leadership Team