Internal ICP & Landscape Brief

Internal.

A Zyxel NAS326 network-storage firmware image, 521AAZF4C0.bin, is 59,389,563 bytes and unpacks to 6,789 files. Reading it end to end names eighteen bundled components and eleven distinct published CVEs against them, the five jQuery versions folded onto one row:

component      version           files  CVEs
openssl        1.0.2h                2  CVE-2019-1559, CVE-2021-3711,
                                        CVE-2021-3712, CVE-2022-0778
busybox        1.19.4                4  CVE-2018-1000517, CVE-2021-42378,
                                        CVE-2022-30065
openssh        2.3.0                 2  CVE-2020-14145, CVE-2021-41617
openssh        6.7p1                 1  CVE-2020-14145, CVE-2021-41617
zysh           —                     8  CVE-2022-30525
firmware       V5.21(AAZF.4)         1  CVE-2020-9054
weblogin.cgi   —                     1  CVE-2020-9054
apache-httpd   —                 3,250
cups           —                    41
samba          —                    10
linux-kernel   3.10.39               2
bootstrap      3.1.1                 2
jquery         1.3.2 … 1.11.1        1 each
setuptools     7.0                   1

The most serious row needed no file opened at all. The container header declares its own version, V5.21(AAZF.4), and AAZF.4 through .6 carry CVE-2020-9054 — a pre-authentication OS command injection in weblogin.cgi, patched in AAZF.7. The rest come from version strings recovered out of the binaries, path patterns, web-library banners and a package manifest. Nothing was executed. Three of the eighteen — zysh, weblogin.cgi and the synthetic firmware row — are vendor-specific rather than upstream, which is the share of this bill of materials no public advisory feed will ever key on. The unpack also ledgers 894 recognised entries it did not descend into, by reason: 861 already-seen repeats, 30 with no extractor, 3 past the three-level depth limit — without which a partially covered image is indistinguishable from a fully covered one. Full mechanism in CVEs & SBOM.

That artifact is the product in miniature: unpack what a vendor actually ships, name what is inside it, and attribute known vulnerabilities to the named versions — statically, offline, on an embedded root filesystem no desktop RE workflow is built for.

Orientation

Market gap: unreadable binary behavior

The behavior of the compiled binaries an organization runs is not recorded anywhere the organization can read. Every organization runs thousands of them — system services and vendor agents on workstations, daemons on Linux servers, firmware inside the routers and appliances at the network edge, executables shipped by every third-party software vendor.

SOC analysts, threat-intel researchers, MSSP analysts, IR responders, firmware auditors and sectoral CERTs all hit the same wall. Understanding one binary means IDA or Ghidra and a specialist. The cheap move on an unknown binary is a VirusTotal hash lookup, which returns a reputation and no behavioral profile, capability map, or explanation.

On the enterprise side the same gap blocks every security decision involving software: vetting a vendor agent before it deploys to 10,000 endpoints, assessing the blast radius of a macOS or Linux upgrade, auditing the firmware on the network edge, surveying the supply chain. Hash lookups, reputation scores and vendor trust are what fill it, and none of them answer what a binary accesses, contacts, or collects.

Shipped capabilities

Analysis is static, offline and package-shaped: 58 loadable formats and 72 instruction sets in the workspace, 170 container identities on the unpack side, and a binary, firmware image, container or OS release ingesting as a single unit.

Formats and instruction sets

Format and architecture support is a compile-time set, so the workspace counts are not the counts in the shipped command-line and worker builds. Feed the shipped binary a .wasm or a .pyc and it answers unsupported or unrecognized binary format (expected Mach-O ..., PE ..., or ELF64-LE ...).

Identification is a separate, ungated layer: a default build still names all 170 format identities by magic, so it can name a .dex it cannot open.

Mach-O, ELF and PE32+ on arm64 / arm64e / x86_64 are first-class, and those reconstruct to a Rust project whose compilation is reported per binary as a measured result. Per-format and per-architecture breakdown in Architectures.

Container formats and extractors

The identify authority is a closed enum of 170 format identities, of which 112 route to a working extractor:

Two of the six gaps are a wiring decision rather than absent code: the .Z and Zlib extractors exist but are reachable only by name from carrier-aware paths, so a top-level signature hit on either is dropped as a ledgered skip. PEM certificates, PEM keys and OpenSSL enc blobs are crypto identities that route to an extractor rather than counting as inert markers.

Adding an identity fails to compile until the extractor question is answered explicitly, so no format falls through by omission. Budgets, path sanitization and the packed-to-payload verdict handoff are in Unpacking.

Packages as the unit of analysis

A binary, a firmware image, a Docker/OCI image or an entire OS distribution ingests as one package; every binary inside is analyzed and the package carries its own composition, SBOM and security rollup.

Storage is content-addressed, so 56,591 distinct binaries back those memberships — the same busybox present in three releases is one analysis and three membership rows.

Release harvesting runs off a checked-in catalog of 611 rows:

Binary and source CWE in one pass

Compiled binaries and the interpreted source bundled beside them are scanned on the same unpack, and both emit the same finding shape into the same store and the same SARIF 2.1.0 run. Compiled binaries get binary-level CWE findings from the IL taint and memory-safety engine. The interpreted source inside the same package — JavaScript, Python, PHP, Ruby, Go, Java, C#, Swift, Kotlin, Scala, Clojure, OCaml, Bash, Dockerfile, Terraform and more — gets source-level SAST findings. Where a catalog row names both engines it is literally the same rule firing, and that overlap is narrow:

Outside C, no rule spans both engines: every other language above gets source rules that stand alone. See Source SAST and Findings.

Library identification

Bundled libraries are named in shipped binaries even when stripped, across five signature surfaces, each giving up something different to survive a different loss:

That naming is what feeds the binary-level SBOM (CycloneDX 1.6 / SPDX 3.0) and its CVE attribution. Mechanism and per-architecture rates in Fingerprinting.

The shipped coverage command and the corpus-statistics API read 3 of the 6 bundled quad-hash corpora, omitting the ARM, MIPS and OpenWrt ones, so both under-count the signature database by 27%:

A buyer who runs the coverage command sees the right-hand column.

Malware detection and config extraction

The capability catalog is a 1,031-row classification of the pinned capa rule snapshot, and the verdict engine runs on Mach-O, ELF and PE against a 1,729-sample corpus:

DNA similarity clusters unknown samples against known families. UPX is unpacked natively so a packed sample is judged on its real payload. Config extraction has two paths that should not be conflated: the AmosStealer extractor, which recovers configs in production by statically replaying the sample's own obfuscation arithmetic over its constant tables, and the general bounded emulator over the analysis IL, whose mechanism is proven on fixtures and whose last real-corpus sweep recovered nothing. See Malware.

MCP agent tools

The MCP server exposes 48 tools: search, DSL query, per-function decompile, call-graph reachability with witness paths, package walking, SARIF export, and write-capable annotations.

Deployment models

Deployment runs from browser-only SaaS to an air-gapped pair of service binaries and an OEM embed.

Market signals

Two independently documented trends carry the thesis — macOS threat volume and enterprise Mac share are both rising — and a third sets a legal deadline for firmware SBOM on 11 December 2027.

• macOS threat volume. Red Canary's 2025 Threat Detection Report observed roughly 400% more macOS threat detections in 2024 than 2023. By 2025, infostealers accounted for ~30% of all macOS malware detections — Atomic, Poseidon (rebranded mid-2025 as Odyssey), Banshee, Cuckoo, MacSync, Phexia, DigitStealer.
• The paste-and-run pivot. After Apple closed a popular Gatekeeper bypass in September 2024 (95% of 2024's stealer infections happened before that patch; 5% after), adversaries moved to paste-and-run lures — curl | bash, shell plus AppleScript. The binary that lands on the endpoint is downloaded on demand and rarely sits in hash-reputation corpora.
• Enterprise Mac share. Per IDC, Apple Mac shipments grew ~11% in 2025 against an industry average of ~3.3%; US enterprise Mac share has reached ~23%, growing faster than the PC market.
• Supply-chain security adoption. Per Gartner (cited in ReversingLabs' 2025 coverage), 85% of enterprise software-engineering teams will have deployed SSCS tools by 2028, up from 60% in 2025.
• Objective-See's 10th annual Mac Malware roundup (Patrick Wardle, published January 2026 covering 2025) confirms stealers as the dominant new-malware category. The macOS indicator rules are seeded from the 2025 edition.
• Firmware regulatory floor. The EU Cyber Resilience Act applies in full 11 December 2027 — every connected product on the EU market needs a machine-readable SBOM and documented vulnerability handling. US EO 14028 imposes parallel SBOM requirements on federal procurement. Public incidents keep the appliance-audit market hot: Zyxel firewall RCE (CVE-2023-28771) chained against 22 Danish energy companies in SektorCERT-tracked attacks in late 2023, Cisco IOS XE mass-RCE waves, Volt Typhoon edge-device persistence.

Buyer archetypes

Fifteen archetypes buy different capabilities out of the same pipeline.

Mac-focused MDR / EDR

Names. Huntress, Red Canary, Jamf Protect, Iru (formerly Kandji), Mosyle, Sophos MDR, Expel.

Pain. Their static macOS analysis is hash reputation plus signing state plus runtime telemetry. The pre-execution question — what can this specific unknown binary do — is almost universally unanswered.

Lead with. Behavioral profile before execution: 457 BSD syscalls and 62 Mach traps resolved, 1,209 Apple framework and runtime symbols across 54 dimensions (1,105 of them recognised, 91.4% — the shortfalls are named per framework, worst at the Swift runtime's 2 of 51), a ten-domain Apple capability map built from entitlement, framework and syscall evidence together, code-signature entitlements read without running anything, and the XPC surface. DSL queries over the corpus and a per-type anomaly flag on top.

What 1,105 of 1,209 measures. A word-boundary search for each symbol name across the dispatch sources — the name is referenced somewhere that routes on it. Quotable as coverage breadth, not as per-symbol semantics.

Motion. SaaS or OEM-embed.

Firmware & IoT vendors

Names. Networking and edge — Zyxel, Asus, TP-Link, Netgear, D-Link, Ubiquiti. Enterprise — Cisco appliances, Juniper, Fortinet, Palo Alto, Sonicwall, Check Point. Storage and NAS — Synology, QNAP, Asustor. Industrial gateways, SBC OEMs, white-label appliance builders.

Pain. CRA forces a machine-readable SBOM plus vulnerability handling on every connected product by 11 December 2027. Most OEMs have no clean inventory of what is bundled in their own firmware, let alone CVE attribution against it. Internal RE audits by hand and misses things.

Lead with. One pipeline: unpack the firmware, CWE findings on every extracted binary and on the interpreted source bundled alongside (JavaScript, Python, PHP, shell — most firmware ships plenty), SBOM with CVE attribution at both the component and firmware-header layers, and a release-over-release package diff naming every added, removed and changed binary between two image versions, with per-row verdict, highest CVE severity and KEV flag.

Worked vendor: Zyxel. Both proprietary carriers (2RDH and SIG) are first-class format identities, and eight firmware-version rules are in place:

The NAS326 image is also the fixture behind two curated detectors: an unauthenticated-CGI shape, and an open-redirect on weblogin.cgi's Location: http://%s/zyxel/loginwrap.html?redirectto=%s template. 5 of that image's 16 Apache CGIs link the libgcgi request-parsing helper, which reads the request internally: weblogin.cgi and export-cgi never call getenv themselves, setuser.cgi uses the library and getenv. The detector fires on either signal rather than requiring both.

Rule limits. A firmware version rule is a version substring and a CVE list, and nothing else — no vendor or product field, so the product column above is editorial. Any firmware whose declared version contains V4.6 is attributed CVE-2023-28771 regardless of who made it, and the substring is bare, so V4.6 also matches a hypothetical V4.65. Each rule needs a published vendor advisory naming a range, so the table grows one vendor at a time.

Motion. Air-gap deployable, no GUI. Per-engagement, annual site license, or OEM-embed.

OT / ICS security

Names. Claroty, Nozomi Networks, Armis, Dragos, Microsoft Defender for IoT, Forescout (eyeInspect), Tenable OT.

Pain. Asset-discovery and protocol-anomaly products know what is on the network but not what is inside the firmware running on those assets. Customers increasingly ask the OT vendor for the CVE-and-CWE story on the firmware they are actually operating, not just the asset inventory.

Lead with. Firmware unpack plus binary analysis as an upstream data feed. They own asset and network context; openbinary supplies firmware truth.

Motion. Data-feed or OEM-embed.

Developers & CI/CD (DevSecOps)

Names. Platform-engineering, AppSec and release-engineering teams inside any org shipping compiled software — desktop apps, agents, SDKs, drivers, embedded binaries. Reached through CI integrations (GitHub Actions, GitLab CI, Jenkins, Buildkite) and the REST API, not a named-account sales motion.

Pain. Source SCA reads manifests and lockfiles; it never inspects the artifact that ships. A build can regress every binary-layer property and nothing in the pipeline notices: a hardening flag flips off, the shipped binary's real dependency set drifts from the declared SBOM, junk accumulates (unexpected data segments, leftover debug strings, embedded secrets), version and publisher metadata is wrong, or the artifact ships unsigned. None of it is visible until someone reverse-engineers the release.

Lead with. Hardening posture is measured per binary and emitted as findings, not inferred from a build flag. Across a public corpus of 56,591 distinct binaries — 53,434 of them carrying analysis results, and 271 that analyze to an empty one:

Those are all ELF rules. The parallel posture.pe.* rules — unsigned, no ASLR, no CFG, no GS cookie — fire in single digits corpus-wide, because the corpus is Linux and BSD releases, so PE hardening posture is implemented and effectively unmeasured.

A canonicalised hash over those bits changes when posture changes, which is the regression signal. Alongside it: CWE findings and CVE attribution, real-vs-declared SBOM drift with CycloneDX 1.6 / SPDX 3.0 export, declared-vs-used consistency flags, a secrets scan, signing and publisher verification, and the package diff as the release-gate report. REST API, JSON and SARIF 2.1.0 straight into GitHub code scanning. This is the producer side of the supply chain, distinct from the consumer-side vetting in Supply-chain security.

Motion. Self-serve and usage-based at the bottom, expanding to a team or org license.

Container & cloud-native image vendors

Names. Teams shipping a whole image rather than a single binary — Docker / OCI publishers, base-image and golden-image builders, ISVs distributing containerized products, internal platform teams. Same "audit everything inside the artifact" shape as firmware, different carrier.

Pain. Container scanners (Trivy, Grype, Docker Scout, Aqua, Sysdig, Prisma Cloud, Wiz) read OS package databases and language lockfiles inside the image. The compiled binaries the image actually executes — vendored static libraries, custom daemons, downloaded-at-build executables, anything not installed by a package manager — are a blind spot: no CWE findings, no hardening posture, no real SBOM, no signing check at the binary layer.

Lead with. A docker save / OCI tarball goes through the same pipeline as firmware: every executable inside gets binary-level CWE findings, SBOM with CVE attribution, hardening posture and a secrets scan, at the layer the package manifest cannot see. One report across the whole image, plus an image-to-image diff (tag to tag, or against the upstream base).

Motion. Air-gap deployable, OEM-embeddable, or a CI gate alongside the existing image scanner rather than replacing it.

Enterprise app inventory & SBOM (CRA)

Names. Product-security, compliance and procurement teams at any enterprise placing connected products on the EU market or attesting to the software it ships and runs — CRA-regulated manufacturers, plus regulated operators (energy, finance, healthcare, public sector) building an authoritative application inventory. Often reached through the same channel as the firmware-vendor and developer motions.

Pain. The CRA applies in full 11 December 2027; US EO 14028 imposes parallel SBOM duties on federal procurement. Most enterprises have no authoritative inventory of the compiled apps and embedded components they ship or operate. Source SCA covers the code they wrote — not the binaries they buy, the third-party artifacts they bundle, or the scripts riding inside an image. The result is an SBOM that stops at the manifest and a deadline with nothing to evidence against.

Lead with. One estate-wide inventory at the artifact layer: every app, firmware image and container, every compiled binary and bundled script inside, with a CRA-grade SBOM, CVE attribution, binary-and-source CWE findings, and a per-release diff. Scan the portfolio once, diff each release, export the SBOM the regulation asks for. Distinct from the Mac-fleet CISO motion, which is endpoint posture — this is the compliance inventory of the software an enterprise ships and operates.

Version-precision ceiling. Only 69.6% of the bundled quad-hash signatures carry a version precise enough to answer a CVE range. It does not generalise to the other four surfaces: the 1,236,310-entry FLARE corpus and the trained .pat packs record no version at all, so a library named through either is named without one. State it before a buyer tests it.

Motion. On-prem or SaaS; annual site license priced by estate size.

Binary-centric threat intel platforms

Names. Three platforms, none of which publishes pricing:

Lead with. Depth their platforms do not carry — macOS entitlements and XPC surface, resolved call-site signatures, capa-aligned indicators with ATT&CK, plus firmware SBOM with CVE.

Motion. Two live paths:

• Upstream data feed / OEM. Partner motion on the depth above.
• Category overlap at the high end. Expanding into fleet retroactive hunt puts Stairwell in the same room as the closest analog.

Malware research / CTI

Names. Kaspersky GReAT, Mandiant Intel (Google TI), Microsoft Threat Intelligence, ESET Research, Trend Micro, CrowdStrike Intelligence, Cisco Talos, Recorded Future, Flashpoint, Intel 471.

Pain. Mac malware coverage is thinner than Windows across most incumbents. Senior researchers use IDA, Ghidra or Binary Ninja for deep dives. The gap is triage at scale and ATT&CK coverage rollups that feed intel products.

Lead with. DNA similarity search and the capa-aligned capability catalog pre-tagged with ATT&CK, with UPX unpacked natively so packed samples are judged on the real payload. JSONL export as a licensable feed.

Do not overclaim. Static config extraction is a demo on AmosStealer and a research collaboration on anything else — the general emulator path has never recovered a config from a corpus sample. No recall number off the 1,729-sample corpus is quotable to a Windows- or Linux-focused team: 1,336 of those samples are Mach-O and exactly 1 is ELF.

Motion. License to research teams or as a data product.

RE / audit firms

Names. NCC Group, Trail of Bits, Leviathan, Include Security, Atredis, Doyensec, Assetnote, Synack, and boutiques.

Pain. The working premise is that mechanical triage eats most of an engagement's hours at rates the client increasingly resists. No engagement has been instrumented to confirm the share, so it is a hypothesis to test in the first three conversations, not a figure to quote back.

Lead with. Reconstruction to a Rust project with typed interfaces, XPC protocol traits and per-function confidence scores, with the compile result reported rather than promised, plus audit-matrix — per-XPC-entry verifier and privileged reachability with a dominance flag.

Motion. Per-seat or per-engagement licensing.

Endpoint security vendors (OEM-embed)

Names. CrowdStrike Falcon, SentinelOne, Palo Alto Cortex XDR, Microsoft Defender for Endpoint, Sophos, Jamf Protect, Iru, Mosyle.

Pain. Their macOS static analysis is a score, not an explanation.

Lead with. No GUI, bolts into an agent. Rust apart from five linked C and assembly libraries the host inherits, named in Known limits — AWS-LC crypto first among them, and the first thing a vendor's build team will check. Commit to no size or latency figure: the shipped build is 208 MB and takes 0.56–0.74 s on a 154 KB Mach-O, and the trimmed-corpus build an agent would actually embed does not exist yet.

Motion. Longest sales cycle of any archetype; highest LTV.

Supply-chain security tools

Names.

Lead with. Library and function recognition spans five independent signature surfaces, so a bundled library is named in a shipped binary even when the symbol table is gone — which is what turns a stripped vendor artifact into a binary-level SBOM with CVE attribution. Quad-hash is the tier whose versions are precise enough to answer a CVE range, and its largest single source is a BSD corpus contributing 842,583 signatures over 505 libraries; the enterprise CRA-inventory motion turns this into its own ICP.

IR firms

Names. Mandiant (Google), Kroll, CrowdStrike Services, Stroz Friedberg, Volexity, Secureworks IR.

Lead with. Air-gap install, scan the victim's system, then diff the whole system against a known-good baseline — added, removed and changed binaries surface implants and tampering directly, with per-row verdict enrichment on the diff.

Motion. Per-engagement license. Low-ACV, high-velocity, repeating.

Enterprise CISOs with Mac fleets

Names. Cross-industry.

Lead with. Vendor-agent vetting, macOS upgrade impact, supply-chain audit.

Motion. Frequently reached through the MDR / security-vendor channel rather than direct.

Government, defense, intel

Names. DoD component teams, CISA, Sandia, Los Alamos, FVEY partners, three-letter agencies.

Lead with. Two binaries, no cloud, air-gap deployable. The vulnerability corpus is a separately shipped artifact that goes stale at exactly the rate the operator refreshes it; everything outside vulnerability matching runs offline.

Motion. Site-license via cleared channel partners.

Cyber insurance underwriters

Names. Resilience, Coalition, At-Bay, Corvus, Beazley.

Lead with. Quantified fleet-risk data feed.

Motion. Experimental. One underwriter win, rest follow.

Competitive landscape

Direct overlap is confined to artifact scanning, firmware SBOM tooling, and — on expansion into fleet retroactive hunt — binary-centric threat intel. The rest of the landscape is adjacent, orthogonal, or downstream.

Differentiators

Six capabilities have no equivalent in any adjacent tool.

• Decryption without execution. A bounded interpreter replays a sample's own string and config decryptor over the analysis IL, so recovered plaintext costs no detonation, no network and no sandbox. It runs on the IL rather than a per-CPU model, so an x86 loader and its ARM or MIPS sibling take one code path. Sandboxes get the same plaintext by detonating. What is proven today is the narrow half — hash-resolved API names, dlopen and objc_getClass string arguments, jump-table bases, and UPX payloads unpacked natively so the verdict lands on the real payload. Full C2-config recovery is proven on fixtures and on AmosStealer's static replay path, not yet on an arbitrary corpus sample.
• Output shape. A Rust crate with typed interfaces, XPC protocol traits and per-function confidence scores. Whether a given crate compiles is measured and reported alongside class coverage, method coverage, lift ratio and a count of unrecovered operations — never asserted. The closest alternative elsewhere is C pseudocode that does not compile and does not claim to. Everything findings-shaped also exports as SARIF 2.1.0, straight into GitHub code scanning, DefectDojo and CI gates, including a whole-firmware merged run with one artifact per analysed member.
• Cross-OS depth plus unpack at scale. macOS depth nothing else carries (entitlements, XPC, resolved call sites, the ten-domain capability map, audit-matrix); the same pipeline on ELF and PE32+ in the shipped build, with DEX, WASM and SEP64 as build options no shipped artifact currently enables; 112 container identities routing to 109 working extractors feeding it. Stairwell, ReversingLabs and Intezer have scale. Firmware SBOM tools have unpack. None have all three.
• Whole-package scan plus release-over-release diff. A binary, firmware image, Docker/OCI image or entire OS distribution ingests as one package. Any two versions then diff side by side, with per-row verdict, CVE severity and KEV enrichment. Container scanners diff package manifests; this diffs the actual compiled artifacts, across firmware, containers and distros, in one tool.
• Binary and source CWE in one unpack. SAST tools read source they are pointed at; binary-CWE tools read compiled artifacts; firmware and SBOM tools inventory components. All three run on the same unpacked image here, so nothing inside an artifact falls through the gap between source and binary tooling.
• Deployment envelope. Air-gap deployable, no cloud, no GUI. Closes shapes cloud-only and GUI-only competitors structurally cannot.

Known limits

Eleven limits are measured, and each is better stated in the room than found by the buyer.

Latency is seconds, not milliseconds, and load-sensitive. Measured on an Apple M4 Pro with the shipped CLI, end to end — process start, corpus load, findings, malware DNA and report rendering:

Per-function analysis is Rayon-parallel and competes for every core, so the large-binary figure is a core-availability claim as much as a time claim — hedge it in a demo on a shared box. Much of the small-binary figure is one-time corpus loading: the bundled FLIRT and malware-DNA corpora do not finish loading until 0.45 s into the 0.58 s /bin/ls run, and a server deployment pays that once by keeping a pool of pre-warmed workers. The analysis cost itself scales with code size and is not a fixed budget. No sub-200 ms figure survives measurement on the shipped path, so latency is pitched as "seconds, not a reverse-engineering engagement", never as a millisecond number.

Binary size is dominated by signature data. The single-file CLI is 208,551,056 bytes: 24.5 MB of machine code and 175 MB of __const, almost all of it the bundled signature corpora (53 MB of trained FLIRT .pat packs alone). No feature flag currently drops that data, so any OEM-embed conversation needs a build that omits the tiers the host does not use. Do not quote a size figure until that build exists.

The embed is not dependency-free. The command-line build's normal dependency graph links five C and assembly libraries:

An OEM embedding the engine inherits all five, so "Rust" describes the analysis code and not the linked artifact. A host with its own crypto policy or an approved-components list asks about AWS-LC before any technical evaluation starts.

Air-gap is not free of external data. The advisory corpus is deliberately not bundled. An operator fetches it with openbinaryd update-vulndb — roughly five minutes for the initial cvelistV5 clone, then OSV per-ecosystem JSON, the CISA KEV catalog and FIRST EPSS scores, auto-refreshed on a 24-hour interval; the ingest shells out to the system git binary. An internal https mirror base URL can replace the canonical source URLs wholesale, which is the supported shape for a network-isolated site; in a SCIF with no mirror it becomes a shipped-in artifact with an operational refresh process. The curated firmware-version and component rules are compiled in and do work offline, so the NAS326 CVE-2020-9054 hit needs no network — but the OSV-backed half of CVE attribution goes stale at exactly the rate the operator refreshes it. Everything outside vulnerability matching is offline.

Versions are not always CVE-comparable. 93.2% of the bundled quad-hash signatures carry a version string, but many are a bare ABI-major integer mined from a soname — 3, from libcrypto.so.3 — which cannot satisfy a range like "before 3.0.14" because it has no minor or patch segment to order. Counting only multi-segment, range-comparable versions the figure is 69.6%, and on x86_64 — where most vulnerability questions get asked — it is 64.1%. Where the version is only an ABI-major, the library is named and the CVE match falls back to the range's own major.

Apple userland has no body-hash coverage. The Mach-O body-hash corpus is XNU kernels only: 3,797 distinct function names stored across 11 per-SoC kernel images, all from one OS build — macOS 26.1 (25B78). No Apple system dylib, and no Apple library version, is in any bundled corpus.

The malware corpus is skewed by construction. Any aggregate recall or precision number read off it describes a macOS-stealer corpus with a Windows tail, not a balanced sample of malware:

684 samples carry an AmosStealer label; the next largest labelled groups are AgentTesla (27), Medusa (21), Heodo and Formbook (20 each); 328 are unlabelled.

Emulator config extraction has never fired on a corpus sample. An instrumented sweep of 103 samples in July 2026 recovered data from 0 of the 86 that completed analysis; the extraction driver seeded a function's literal constants and nothing else, so a real prologue's sub sp, sp, #N diverged on operation 1, before the run reached the loop the candidate was selected for. A separate sweep of five UPX-packed samples through the entry-point driver returned 0 of 5, diverging at operation 31 on a stack-relative load, because the stack contents are never seeded. A concrete stack and frame pointer are now seeded, which addresses the first cause; neither sweep has been re-measured. Extraction is also gated off the standard ingest path — it runs for direct callers of the analyzer, the CLI's full mode and the ML retrain path. The one family extractor working in production, AmosStealer, is a static byte replay in the detection crate rather than emulator output, and the structured-config plugin names the record layout it parsed, not an attributed real-world family, because no in-the-wild corpus backs a family claim for that shape. Demo it on AmosStealer; do not promise it on a prospect's sample.

UPX unpacking has a named blind spot. The unpacker locates the block chain by searching for a literal UPX!. Commodity Linux malware routinely zeroes exactly that magic while the layout still runs — so the samples flagged for deliberately defeating upx -d are precisely the ones this cannot unpack. They stay a ledgered skip plus a packing signal.

Source SAST is broad and shallow. Run against the 966 scorable marker-annotated gap fixtures, 241 pass:

There is no cross-file dataflow — analysis is per file, so a taint flow crossing a module boundary is a miss — no framework routing emulation, no scope typing outside Python, JavaScript and PHP, and any source file over 8 MB is skipped whole rather than truncated, which silently blanks minified bundles. The skip is indistinguishable from a clean scan: an oversize .py whose second line is os.system(input()) returns language python and zero findings. Rust has a walker crate wired to nothing and Solidity has fixtures with no walker at all. Sell it as breadth over the scripts nobody else reads inside a firmware image, never as a Semgrep or CodeQL replacement on a source repository.

The package diff is path-and-verdict, not posture. It returns added, removed and changed binaries by path, with optional per-row verdict, highest CVE severity and KEV flag, and a count of attached SBOM components. It does not yet return a component-level delta list or a per-hardening-flag regression column; those are assembled from the per-binary posture findings and the hardening hash, not read off the diff.

Pricing and deal shape

Pricing is by deployment model, not per-seat, and every range below is a hypothesis rather than an observed transaction.

Value anchors (estimates, not observed transactions). Manual RE of a single binary is commonly quoted at 2–5 days at $300–600/hr, or roughly $5K–$20K. A 5-person in-house RE team runs past $1M/year. Stairwell and ReversingLabs disclose no deal sizes.

References

Links verified April 2026.

macOS threat landscape

• Red Canary — 2025 Threat Detection Report (Mac Malware trends)
• Red Canary — Distinguishing Atomic, Odyssey, and Poseidon stealers on macOS
• Objective-See — The Mac Malware of 2025 (Patrick Wardle)
• Palo Alto Unit 42 — Stealers on the Rise: A Closer Look at a Growing macOS Threat
• Malwarebytes — Macs targeted by infostealers in new era of cyberthreats

Competitor / landscape

• Huntress — Managed EDR for macOS
• Huntress — Managed EDR expands to macOS (May 2024)
• Stairwell — Core launch (December 2024)
• Stairwell — Intelligent Analysis / SIA launch (May 2025)
• Stairwell — Hidden Malware Report (September 2025)
• ReversingLabs — Titanium Platform overview
• ReversingLabs — 2025 Gartner Market Guide for SSCS
• Intezer — Genetic Malware Analysis
• Kandji → Iru rebrand (October 2025)
• Endor Labs — Supply Chain Security platform

Enterprise Mac market

• Computerworld / IDC — Macs reach 23% share in US enterprises
• IDC data via MacDailyNews — Apple Mac Q3 2025 13.7% growth

Firmware, IoT, regulatory

• EU — Cyber Resilience Act (Regulation 2024/2847), applies 11 December 2027
• ENISA — Cyber Resilience Act overview
• SektorCERT — The attack against Danish critical infrastructure (Zyxel CVE-2023-28771)
• CISA — Cisco IOS XE web UI vulnerabilities advisory

SBOM, build integrity, CI/CD

• CycloneDX — SBOM specification overview
• SPDX — specifications (ISO/IEC 5962)
• CISA — Software Bill of Materials (SBOM) resource hub
• NTIA — The Minimum Elements for an SBOM
• SLSA — Supply-chain Levels for Software Artifacts framework
• US Executive Order 14028 — Improving the Nation's Cybersecurity