What Recurity Labs does

Recurity Labs GmbH is an independent IT security consultancy headquartered in Berlin, Germany, founded in 2006 by Felix "FX" Lindner. The firm delivers specialist security services spanning reverse engineering (binary analysis using Zynamics tools), source code auditing across managed languages (PHP, Java, .NET, Python, Ruby, Go), system and penetration audits, security architecture design, protocol validation, and embedded/mobile/large-scale system security evaluations. Its client base spans finance, telecommunications, healthcare, government, and German KRITIS (critical infrastructure) sectors, including long-term engagements with MAN Energy Solutions since 2018, the Lernraum Berlin Moodle-based learning platform serving over 400 schools, and pro-bono work with the human-rights nonprofit HURIDOCS.

The consultancy operates with a team of approximately twelve deeply specialized consultants, most with at least a decade of security consulting experience and backgrounds spanning both industry and academia. The firm maintains a thought-leadership profile through recurring conference presentations at BlackHat, Chaos Communication Congress, DEFCON, IEEE Security & Privacy, HITB, and LangSec workshops, and has authored publications in Communications of ACM and NATO-sponsored research, alongside CVE disclosures for vendors including Microsoft, Cisco, Apple, and open-source projects. On March 17, 2025, Recurity Labs achieved ISO/IEC 27001:2022 certification of its Information Security Management System (Certificate Number 213693), strengthening its credentials for regulated-sector work.

Recurity Labs generates revenue through direct, project-based professional services engagements plus training programs (Source Code Audit Training and On-Site Training with small group sizes of 8–15 participants). The firm employs a sales-led, direct-engagement go-to-market model with no digital distribution, resellers, or marketplace presence, and pricing is quote-based and tailored per engagement. Recurity Labs is privately held with no disclosed institutional investors, no parent company, and no public revenue disclosure; following the passing of founder Felix "FX" Lindner on March 1, 2026, CEO Nico Lindner continues to lead the firm in line with the founder's stated wishes.

Name

Recurity Labs

Legal name

Recurity Labs GmbH

Website

https://recurity-labs.com

Company type

Private

Founded year

2006

Operating status

Operating

Headcount range

1–10 employees

Short description

Recurity Labs is an independent Berlin-based IT security consultancy founded in 2006, employing approximately twelve specialized consultants who deliver source code audits, penetration testing, reverse engineering, and security architecture services to enterprise clients in finance, telecom, healthcare, government, and German KRITIS sectors.

Ownership category

akta.pro rank

Product category

IT Security Consulting Services

NAICS

Testing Laboratories and Services (541380)

SIC

Services-Testing Laboratories (8734), Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Security Audits & Compliance (ISO 27001, SOC 2, PCI DSS, HIPAA, SOX) (BPAKADAC)

akta.pro secondary industry

Governance, Risk & Compliance (GRC) & Security Management (EDAOAIAG)

Keywords

• IT security consulting
• Penetration testing
• Source code audit
• Reverse engineering
• Vulnerability research

Headquarters

HQ city

Berlin

HQ country

Germany

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Others, Marketing or Sales

Revenue model

1. Security Consulting Services: Professional security consulting services including source code audits, penetration testing, design reviews, threat modeling, and security evaluations. Revenue is generated through project-based engagements with enterprise clients in regulated industries.
2. Training Programs: Security training programs offered on-site and remotely, covering source code auditing, embedded analysis/hardware, ARM64 exploitation, and secure coding. Training sessions conducted by expert consultants with small group sizes (up to 8-15 participants).

Pricing tiers

Go-to-market motion1 record

Distribution channels1 record

Marketing channels4 records

Core offering

Recurity Labs is an independent IT security consultancy providing specialized services in reverse engineering, source code auditing, system/penetration testing, and security architecture design. The firm also delivers technical training programs covering source code auditing and customized on-site security topics, supported by a team of twelve professional consultants operating under an ISO/IEC 27001:2022 certified Information Security Management System.

Product overview

Recurity Labs is an independent IT security consultancy offering a portfolio of specialized services rather than a unified software product. The core offerings include Reverse Engineering (binary analysis using Zynamics tools), Source Code Audits (for managed languages), System Audits (penetration testing, attack modeling, network assessments), and Design Services (architecture design, validation, and creation). These services are delivered through a team of twelve professional consultants with deep expertise in vulnerability research, secure development, and offensive security techniques. The company also provides training programs including Source Code Audit Training (covering PHP, Java, .NET, Python, Ruby, Go) and custom On-Site Training, along with ongoing Research outputs including publications, advisories, and their Lablog blog.

Differentiator

Problem solved

Functional benefit

Products and services

• Reverse Engineering Services Analysis of binary code without source access, including verification of security mechanisms, compiler output validation, interoperability assessment, malware analysis, and legacy system re-engineering. Delivered by consultants using Zynamics tooling from Halvar's team with over 25 years of combined reverse engineering experience.
• Source Code Audit (SCA) Independent review of source code to identify vulnerabilities, security issues, and quality defects in software products across managed languages (PHP, Java, .NET, Python, Ruby, Go). Supports vendors and customers in verifying development standards.
• System Audit Comprehensive security evaluation of IT systems including attack modeling, product audits, penetration testing, and network assessments to identify vulnerabilities under hostile conditions across applications, networks, and cloud environments.
• Architecture Services Design of software and system architectures tailored to customer requirements, focusing on secure-by-design principles, reliable operation, and defense-in-depth implementations.
• Validation Services Design review and validation services examining protocol specifications, security subsystems, cryptographic protocols, embedded communication links, and application designs for security, scalability, and reliability.
• Design Creation Services Research and development support for solving complex real-world problems, including roadmaps, factual data analysis, and proof-of-concept implementations working with software architects and developers.
• Source Code Audit Training Language-agnostic training program teaching participants to perform source code assessments on managed languages (PHP, Java, .NET, Python, Ruby, Go), identify vulnerabilities, and create proof-of-concept exploits. Conducted with small group sizes (up to 8-15 participants).
• On-Site Training Customized on-site training programs on all subjects within Recurity Labs' domain of expertise, tailored to specific client requirements and delivered on-site or remotely.

Quantifiable outcome

• ISO/IEC 27001:2022 certification achieved on March 17, 2025
• +4 more outcomes

Named customers3 records

Segments3 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature1 record

Partnerships

Three partnerships are on record, tiered minor.

• Secfault SecurityminorStrategic or Co-development PartnerRecurity Labs works in close cooperation with Secfault Security. Both companies mutually benefit from a long-term relationship, sharing skill-sets and experiences. The partners share a common background and aim to support each other in customer projects and research tasks.
• RootSysminorStrategic or Co-development PartnerRootSys and Recurity Labs share a history through numerous projects. RootSys complements Recurity Labs' expertise in Cloud security and hardening while also providing generic IT-Security consulting services such as penetration testing and AppSec.
• Whirly LabsminorStrategic or Co-development PartnerWhirly Labs is a security consultancy with focus on security automation and education. Led by a former Recurity Labs employee, they extend the team during high demand periods and assist with long-term security engagements focusing on secure software development.

Scale indicators2 records

Recent moves6 records

Expansion highlights4 records

Direct peers

• Bishop Fox: US boutique offensive security firm offering penetration testing, red teaming, and security assessments — directly comparable in service mix and boutique positioning.
• Atredis Partners: US boutique security consultancy focused on embedded systems, hardware, and software security assessments — comparable in niche reverse-engineering and embedded security expertise.
• Cure53: Berlin-based boutique IT security consultancy offering web/mobile penetration testing, source code review, and security research. Closely comparable in size, geography, and delivery model to Recurity Labs.
• Trail of Bits: US-based boutique security consultancy offering code audits, reverse engineering, and applied research — comparable service portfolio, premium reputation, and research-oriented culture.
• Security Research Labs (SRLabs): Berlin-based independent security research and consulting firm with comparable boutique positioning in penetration testing, IoT/embedded security, and telecom security research.
• Secfault Security: UK-based independent security consultancy; direct strategic partner of Recurity Labs with overlapping pen testing and hardware/IoT security offerings — comparable boutique competitor.
• RedTeam Pentesting GmbH: German boutique penetration testing firm with similar positioning in independent security audits, public pentest reports, and source code review for enterprise clients.
• ERNW Research GmbH: Heidelberg-based independent security consultancy specializing in network/infrastructure penetration testing, code review, and security architecture — a comparable German boutique competitor.

Broad incumbents

• NCC Group: Large UK-based security services and software resilience firm offering source code audit, penetration testing, and consulting at scale — represents the incumbent alternative to boutique firms like Recurity Labs.

Emerging players

• PortSwigger (Burp Suite): UK-based security tooling firm (Burp Suite) with adjacent offensive-security community and training programs; overlapping customer base of security researchers and pen testers, but productized rather than pure-services.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/0x41414141
• LinkedInlinkedin.com/company/recurity-labs-gmbh

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Recurity Labs