Red Balloon Security

What Red Balloon Security does

Red Balloon Security is a private embedded device and firmware security company founded in 2011 by Dr. Ang Cui out of Columbia University's Intrusion Detection Lab and headquartered in New York. The company develops device-level security solutions that protect embedded systems in critical infrastructure — including programmable logic controllers (PLCs), protection relays, building management systems, automotive ECUs, printers, and network equipment — without requiring source code access or hardware modifications. Its core product, Symbiote Defense, is a runtime protection technology injected into host binaries that continuously checks firmware and memory integrity, preventing unauthorized code execution. The portfolio is augmented by Autotomic Binary Reduction (ABR) and Binary Structure Randomization (BSR) for firmware hardening, OFRAK (Open Firmware Reverse Analysis Konsole) as the underlying binary analysis and modification framework (released publicly in 2022), RASPUTIN for automated hardware reversing (launched May 2025), and Bitwise for FPGA assurance. The platform supports Linux, Android, VxWorks, QNX, Cisco IOS, and multiple RTOS environments across ARM, MIPS, PowerPC, x86, and AVR architectures.

The company generates revenue through subscription-based licensing of its embedded security technology stack combined with professional services delivered by dedicated security engineers. Pricing is quote-based and not publicly disclosed, sold via a consultative enterprise sales motion anchored by a "Request a Demo" funnel. Customers split between commercial Fortune 500 enterprises (HP, Cisco, Siemens, Rockwell, Bosch, Rivian, DENSO, Aptiv) and federal agencies (U.S. Air Force, NAVSEA, DoD, DARPA, DHS, AFRL, In-Q-Tel). Notable engagements include 4M+ HP enterprise printers running 80B+ hours with zero security failures and deployment of Symbiote Embedded Defense at the Plum Island Animal Disease Center under a DHS SBIR Phase III contract. The company's distribution is direct enterprise and government sales, with OFRAK additionally offered under a community license to drive developer ecosystem adoption and pipeline into commercial OFRAK Pro licensing.

The firm's reputation is anchored by research-driven credibility: published vulnerability discoveries include Thrangrycat (Cisco Trust Anchor bypass, 2019), critical Siemens S7-1500 PLC vulnerabilities (2023), and Kratos NGC-IDU CVE-2023-36670. Awards include the DEFCON Pwnie Award for Most Under-hyped Research (2019), the SBA Tibbetts Award for SBIR achievements (2020), and Popular Science "Greatest Tech of 2016." Total disclosed venture funding is $21.9 million from a Series 2 in April 2018 led by Bain Capital Ventures with In-Q-Tel, Greycroft, Abstract, American Family Ventures, and Bossa Invest, alongside an earlier undisclosed round from Pritzker Group Venture Capital in 2015.

Name

Red Balloon Security

Legal name

Red Balloon Security

Website

https://redballoonsecurity.com

Company type

Private

Founded year

2011

Operating status

Operating

Headcount range

11–50 employees

Short description

Red Balloon Security is a private embedded device and firmware security company founded in 2011, serving U.S. federal agencies and Fortune 500 OEMs across defense, automotive, industrial, and critical infrastructure with proprietary Symbiote runtime defense, OFRAK binary analysis, and RASPUTIN hardware reversing platforms.

Ownership category

akta.pro rank

Product category

Embedded Device Security Software

NAICS

Custom Computer Programming Services (541511)

SIC

Services-Computer Programming Services (7371), Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Security, Anti-Cheat, DRM & Integrity Tools (MPAFAFAN)

Keywords

• Embedded device security
• Firmware protection software
• Runtime defense platform
• Binary analysis tools
• Critical infrastructure cybersecurity

Headquarters

HQ city

New York

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Embedded Security Solutions (Firmware Hardening & Runtime Defense): The company generates revenue through licensing and deployment of its embedded security technology stack including Symbiote Defense, firmware hardening services, and runtime monitoring solutions. Revenue is derived from enterprise contracts with critical infrastructure operators and government agencies requiring ongoing security protection for embedded devices.
2. Security Consulting Services: Provides dedicated security engineers who consult with customer security teams on every project, backed by world-class team of experts. Includes assistance in developing new security protections meeting organizational needs.

Pricing tiers

Go-to-market motion1 record

Distribution channels4 records

Marketing channels8 records

Core offering

Red Balloon Security sells proprietary firmware-level runtime protection (Symbiote Defense) and binary analysis software (OFRAK) for embedded devices used in critical infrastructure, defense, automotive, industrial control, and electrical grid systems. The platform injects integrity-monitoring code into host firmware without requiring source code access or hardware modifications, supports multiple operating systems and processor architectures, and is licensed to enterprises and U.S. federal agencies alongside professional security consulting services.

Product overview

Red Balloon Security offers a unified embedded device security platform centered on Symbiote Defense technology. The core offering combines firmware hardening tools (ABR for binary reduction and BSR for structure randomization) with runtime protection via injected Symbiote payloads. OFRAK serves as the underlying firmware analysis and modification framework, enabling automated unpacking, analysis, and repacking of device binaries. RASPUTIN provides automated hardware reversing capabilities. The Symbiote Suite extends protection with real-time network monitoring. Security Consulting services support deployment and customization. The platform is OS-agnostic and supports multiple instruction set architectures including ARM, MIPS, PowerPC, x86, and AVR.

Differentiator

Problem solved

Functional benefit

Brands

• OFRAK: Open Firmware Reverse Analysis Konsole - A binary analysis and modification platform for unpacking, analyzing, modifying, and repacking firmware images. Released publicly in August 2022.
• Symbiote
• FRAK
• ABR
• BSR
• RASPUTIN

Products and services

• Symbiote Defense Symbiote Defense is a firmware-level runtime protection technology that continuously checks the integrity of code and memory at the firmware level on embedded devices. A few kilobytes of injected code monitors specific policies and sends alerts when unauthorized code or commands attempt to execute. The technology operates across all device layers from hardware through bootloader, OS, and application, and prevents unauthorized code execution without requiring source code access or hardware modifications. Designed for enterprise and government customers operating embedded devices in critical infrastructure.
• OFRAK (Open Firmware Reverse Analysis Konsole) OFRAK is a binary analysis and modification platform that combines unpacking, analyzing, modifying, and repacking firmware images across many embedded firmware formats. Supports compressed filesystems, compressed and checksummed firmware, bootloaders, and RTOS/OS kernels. Provides unified interface for interacting with disassemblers including angr, Binary Ninja, Capstone, Ghidra, and IDA Pro. Released publicly at DEF CON 30 in August 2022. Used by enterprise security teams and embedded device researchers.
• RASPUTIN RASPUTIN is an automated hardware reversing platform that combines advanced automation with human oversight (human-on-the-loop) to revolutionize hardware analysis and firmware extraction. Designed for security researchers and enterprise teams needing to extract and analyze firmware from physical embedded devices where source code is unavailable.
• Bitwise (FPGA Assurance) Bitwise is a platform for analyzing and reverse-engineering device binaries and FPGA bitstreams to uncover hidden risks, verify security claims, and accelerate security analysis. Targets enterprise teams that need assurance over FPGA implementations in critical infrastructure and defense electronics.
• Security Consulting Services Expert embedded security consulting services providing enterprise and government customers with access to dedicated engineers and world-class security experts for assessing device hardware and firmware security, identifying vulnerabilities, and deploying Red Balloon Security solutions. Includes assistance in developing new security protections meeting organizational needs.
• Firmware Hardening (ABR + BSR Suite) Firmware Hardening combines Autotomic Binary Reduction (ABR) and Binary Structure Randomization (BSR) technologies. ABR is an automated process that identifies and removes extraneous code from host firmware not utilized in the device's functioning or memory, freeing space for Symbiote injection and reducing attack surface. BSR uses analytic functions to restructure the binary layout of code and data inside firmware with links that preserve functionality while creating a new sequence. Sold as part of the firmware hardening offering for embedded device manufacturers and operators.
• Symbiote Suite (Runtime Monitoring) The Symbiote Suite provides real-time monitoring and visibility into networks of embedded devices with unified monitoring, alerts, forensic analysis, and zero false positives. Extends Symbiote Defense with centralized situational awareness across deployed device fleets for enterprise security operations and critical infrastructure operators.

Quantifiable outcome

• 150 billion device hours protected with zero in-field exploits
• +3 more outcomes

Named customers16 records

Segments5 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability2 records

Feature9 records

Partnerships

Two partnerships are on record, tiered core and flagship.

• Department of Homeland Security (DHS)coreStrategic or Co-development Partner · 1 January 2021DHS-funded research through SBIR Phase III contract at Plum Island Animal Disease Center (PIADC) to deploy advanced on-device security with real-time detection on production-network building controllers.
• DARPA (Defense Advanced Research Projects Agency)flagshipStrategic or Co-development Partner · 1 January 2018Red Balloon Security participated in the RADICS (Rapid Attack Detection, Isolation and Characterization Systems) program, working closely with device manufacturers, electrical utilities, and US Government agencies to deploy cybersecurity software on mission-critical devices in the electrical grid. Participated in multiple full-scale exercises defending a RADICS-created power grid from mock attackers.

Scale indicators5 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• RunSafe Security: RunSafe Security provides firmware hardening and runtime protection for embedded systems using binary randomization and code diversification techniques. Highly comparable to Red Balloon's Symbiote runtime defense and BSR (Binary Structure Randomization), serving overlapping customers in defense, industrial, and critical infrastructure.
• Karamba Security: Karamba Security offers embedded security for connected vehicles and IoT devices, including runtime integrity protection and vulnerability prevention. Direct comparable to Red Balloon in automotive embedded security (Rivian, DENSO, Aptiv, Bosch) and IoT device protection.
• Sternum: Sternum provides embedded runtime security and observability for IoT and connected devices, with focus on IoT manufacturers needing drop-in security. Comparable to Red Balloon's Symbiote runtime defense in protecting connected/IoT devices from firmware-level attacks.
• Argus Cyber Security: Argus Cyber Security (acquired by Continental AG) provides automotive cybersecurity solutions for in-vehicle networks, ECUs, and connected car services. Direct peer in the automotive embedded security space, serving similar automotive OEM and Tier-1 customers as Red Balloon's Rivian, DENSO, Aptiv, and Bosch.
• Claroty: Claroty provides OT/ICS cybersecurity for critical infrastructure operators (energy, water, manufacturing). Highly comparable to Red Balloon's Industrial & BMS and Electrical Grid customer segments, with overlapping product positioning around protecting OT devices like PLCs, RTUs, and protection relays.
• Nozomi Networks: Nozomi Networks delivers OT and IoT visibility, threat detection, and asset intelligence for critical infrastructure and industrial operators. Direct peer in serving industrial/BMS, electrical grid, and OT customers, with similar focus on protecting OT devices like Red Balloon's Siemens S7-1500 PLCs and Rockwell systems.
• NCC Group: NCC Group provides cybersecurity consulting and product services, with a dedicated IoT/embedded security practice that performs firmware security assessments and penetration testing. Comparable to Red Balloon's Security Consulting services and vulnerability discovery work on commercial embedded products.
• Bishop Fox (Faraday): Bishop Fox acquired Faraday Security in 2023, adding IoT/embedded security services to their offensive security portfolio. Comparable to Red Balloon's consulting and binary analysis offerings for embedded/IoT devices, with similar productization of internal security research tools.

Broad incumbents

• CrowdStrike: CrowdStrike's Falcon platform includes IoT and OT security modules that compete with Red Balloon in adjacent enterprise accounts. A broad-incumbent player with significantly larger sales reach and platform capabilities, including Falcon for IoT/OT security.
• Palo Alto Networks: Palo Alto Networks offers IoT Security (built on the Zingbox acquisition) and OT Security solutions as part of its broader platform. A broad incumbent competing for the same enterprise OT/IoT security budgets as Red Balloon, with significantly greater resources and platform bundling.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/redballoonsec
• GitHubgithub.com/redballoonsecurity
• YouTubeyoutube.com/@RedBalloonSecurity
• LinkedInlinkedin.com/company/red-balloon-security

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds2 records

Investors7 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Red Balloon Security