one up security
One Up Security, LLC is a privately held application security consulting firm based in Covina, California, providing manual vulnerability assessments, source code review, fuzzing, threat modeling, and security architecting services to Fortune 500 enterprises and startups.
- Company typePrivate
- Founded-
- HeadquartersCovina, United States
- Headcount—
- GTM typeB2B
- OfferingServices
What one up security does
One Up Security, LLC is a privately held application security consulting firm headquartered at 440 N Barranca Ave #3175 in Covina, California. The firm provides application and network security consulting to a client base that spans Fortune 500 enterprises and early-stage startups. Its service portfolio includes web, mobile, and desktop application security assessments, network parameter security assessments, source code review, fuzzing, cryptography use review, security architecting, security configuration review, and threat modeling.
The firm's underlying capability is built on manual security engineering rather than a proprietary software product. Engineers conduct white-box code review, dynamic testing, fuzzing, and structured threat modeling to identify vulnerabilities ranging from memory corruption bugs in embedded devices (e.g., Lexmark printers, TPEditor) to logic flaws and CRLF injection vulnerabilities in web applications and NAS firmware (e.g., Synology DS418play). The team has publicly disclosed multiple CVEs (including CVE-2020-16225 and CVE-2021-29084) and presented research at conferences such as BSides Rochester 2024. In July 2026, the firm published research applying Gemini 3.1 Pro to tune Opengrep static analysis rules, achieving a true-positive-to-false-positive improvement from 3.08%:1.94% to 41.54%:1.94% against OWASP's Python Benchmark.
The firm operates as a professional services business with a sales-led, direct consulting go-to-market. Revenue is generated through quote-based, multi-year consulting engagements, with pricing not publicly disclosed. Distribution is direct-to-client via website inquiry and email, supplemented by a research blog that functions as a top-of-funnel content marketing channel to demonstrate expertise and attract enterprise and startup clients. The firm currently has no disclosed funding rounds, partnerships, subsidiaries, patents, or awards.
one up security firmographics
Firmographics- Name
- one up security
- Legal name
- One Up Security, LLC
- Website
- https://oneupsecurity.com
- Company type
- Private
- Operating status
- Operating
- Short description
- One Up Security, LLC is a privately held application security consulting firm based in Covina, California, providing manual vulnerability assessments, source code review, fuzzing, threat modeling, and security architecting services to Fortune 500 enterprises and startups.
- Ownership category
- akta.pro rank
one up security industry classification
Industry- Product category
- Application Security Consulting
- NAICS
- Computer Systems Design Services (541512)
- SIC
- Services-Computer Programming, Data Processing, Etc. (7370), Services-Computer Integrated Systems Design (7373)
- akta.pro primary industry
- Application Security Engineering (DevSecOps, AppSec Remediation) (BPAEAFAI)
- akta.pro secondary industries
- Security Architecture & Engineering Advisory (Zero Trust, IAM, Network) (BPAKADAF), Security Governance, Risk & Compliance (GRC) Advisory (BPAKADAG)
Keywords
Where one up security is headquartered
LocationHeadquarters
- HQ city
- Covina
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
one up security business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations
Revenue model
- Security Consulting Services: The company generates revenue through providing application security consulting services, including security assessments and vulnerability testing for Fortune 500 companies and startups.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Other | Multi-year contract | Consulting services for security assessments |
Go-to-market motion1 record
Distribution channels1 record
Marketing channels1 record
one up security product offering
Product offeringCore offering
One Up Security, LLC is an application security consulting firm that provides hands-on vulnerability discovery and remediation services across web, mobile, and desktop applications, network configurations, source code, and cryptographic implementations. Its engineers conduct source code reviews, fuzzing, threat modeling, security architecting, and security configuration reviews, delivering actionable recommendations to help client teams mitigate vulnerability classes ranging from memory corruption on embedded devices to logic bugs in web applications.
Product overview
One Up Security, LLC is an application security consulting firm that provides a range of security assessment services. Their core offering is Application Security Consulting, which encompasses Web/Mobile/Desktop Application Security Assessments, Network Parameter Security Assessments, Source Code Review, Fuzzing, Cryptography Use Review, Security Architecting, Security Configuration Review, and Threat Modeling. They serve both Fortune 500 companies and startups, helping teams shift left by discovering and fixing critical vulnerabilities across memory corruption, logic bugs, and other security issues.
Differentiator
Problem solved
Functional benefit
Products and services
- Web, Mobile, and Desktop Application Security Assessments
Quantifiable outcome
- Improved True Positive to False Positive ratio in static analysis from 3.08%:1.94% to 41.54%:1.94% through LLM-tuned rules
Companies that use one up security
Customer profileNamed customers2 records
Segments2 records
Ideal customer profiles2 records
one up security technology and API
TechnologyTechnology focussed No
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Feature6 records
one up security partnerships and signals
Strategic signalScale indicators1 record
Recent moves4 records
Expansion highlights3 records
one up security competitors and assessment
Company assessmentDirect peers
- Trail of Bits: Boutique application security consultancy known for original research, CVE disclosures, and high-end crypto and binary analysis work. Closely mirrors One Up Security's research-led AppSec consulting model and Fortune 500 / startup client mix.
- Cure53: Small, highly specialized penetration testing and application security firm based in Berlin, serving enterprise clients. Comparable as a boutique AppSec consultancy offering source code review, web/mobile assessments, and cryptography review.
- Bishop Fox: Application and network security consulting firm with similar service offerings (penetration testing, source code review, security assessments) and enterprise client base. Directly comparable as a mid-size AppSec consultancy.
Broad incumbents
- NCC Group: Global cybersecurity services firm offering application security assessments, code review, and threat modeling at scale. Comparable in service scope but much larger, publicly listed, and serving a broader enterprise market.
- Synopsys (Software Integrity Group): Large vendor offering application security testing services, static analysis, and consulting (including the former Cigital). Overlaps with One Up Security's AppSec assessment and source code review offerings at much greater scale.
- HackerOne: Bug bounty and vulnerability disclosure platform serving enterprises. Thematically related as a vulnerability discovery channel, though it operates a platform model rather than direct consulting.
Emerging players
- PortSwigger (Burp Suite): Vendor of Burp Suite, a leading web application security testing platform. Related as an AppSec tooling provider whose products are used by consultancies like One Up Security in their web/mobile assessments.
- Bugcrowd: Crowdsourced security testing platform connecting organizations to security researchers for vulnerability discovery. Adjacent to One Up Security's vulnerability assessment services but delivers via researcher crowds rather than in-house engineers.
Market position
Strengths4 records
Weaknesses4 records
Competitive moat3 records
Key risks6 records
Key highlights6 records
Customer concentration
one up security social profiles
Digital presenceone up security financial estimates
Financial estimateRevenue estimate
Valuation estimate
one up security leadership team
Management profileNumber of profiles
Profiles1 record
one up security funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
one up security M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about one up security
What does one up security do?
One Up Security, LLC is an application security consulting firm that provides hands-on vulnerability discovery and remediation services across web, mobile, and desktop applications, network configurations, source code, and cryptographic implementations. Its engineers conduct source code reviews, fuzzing, threat modeling, security architecting, and security configuration reviews, delivering actionable recommendations to help client teams mitigate vulnerability classes ranging from memory corruption on embedded devices to logic bugs in web applications.
Is one up security a public or private company?
one up security is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was one up security founded?
one up security was founded in -1.
Where is one up security based?
one up security is headquartered in Covina, United States, in the North America region.
How does one up security make money?
One revenue line is on record: security Consulting Services.
Who are one up security's main competitors?
Direct peers on record are Trail of Bits, Cure53 and Bishop Fox. Broad incumbents are NCC Group, Synopsys (Software Integrity Group) and HackerOne. Emerging players are PortSwigger (Burp Suite) and Bugcrowd.
Does one up security have an API?
No public API is recorded for one up security.
What industry is one up security in?
one up security's product category is Application Security Consulting. Its primary akta.pro industry code is BPAEAFAI, Application Security Engineering (DevSecOps, AppSec Remediation), with a secondary code of BPAKADAF, Security Architecture & Engineering Advisory (Zero Trust, IAM, Network). Its NAICS code is 541512 and its SIC code is 7370.