Software Binaries Obscure Developer Intent. This Startup Reconstructs It.
Software is the backbone of modern life. It powers everything from smartphones to the infrastructure that underpins global finance and national security. Yet, despite its ubiquity, understanding what it actually does once it’s running remains one of cybersecurity’s hardest problems.
“When developers write software, they write it in source code,” explains James Patrick-Evans, founder of cybersecurity startup RevEng.AI. “But source code alone is useless. To actually run the software, you need to turn that code into an executable, which pulls in all the components, dependencies and system instructions needed to make it work.”
The result is a binary — a dense sequence of ones and zeros that strips away the context of how software was built or what it’s meant to do.
“You lose a lot of information in that process,” Patrick-Evans says. “The source code contains instructions about how it was pieced together, how the software will run, what will actually happen. But normally, in any kind of real-world scenario, you don’t have access to it.”
This makes security analysis incredibly difficult. To identify vulnerabilities, malicious components or hidden backdoors, experts are often forced to reverse-engineer software binaries without seeing how the code was written or what it includes. It’s a laborious and imprecise task — and one that’s becoming increasingly untenable as threats intensify.
RevEng.AI is trying to change that. The startup has built what it says are the world’s largest AI models “dedicated to picking apart all kinds of software and understanding what’s inside of it” — how it was put together and whether it might be doing something it’s not supposed to.
“Our model is using the same techniques that Google and OpenAI use,” says Patrick-Evans. “But instead of understanding language or images, it understands software.”
This work began during his PhD at Royal Holloway, University of London. “We started developing machine learning models to help us actually try and identify what the software was doing,” he says. “That then grew and grew. We had lots of changes in the new-slash-old AI space around 2013 to 2015, and then we developed AI models that could actually digest and develop this machine understanding of how that software was pieced together and what was actually going on.”
The realisation that this could become more than a research tool came gradually. “I don’t think I can pinpoint a specific ‘aha’ moment,” he says. “But over a week or two, I realised that the research we were doing was working — and it had far wider implications. At the time, I was working by myself as a PhD student. But I thought that if we could come together as a team and have a whole bunch of people working towards the same shared goal, we could do this at scale. We could solve problems that people are spending awful amounts of time on — being hit by ransomware attacks, cyberattacks, all the time, when there’s no need.”
That vision turned into a company with the help of Conception X, Europe’s leading deeptech venture programme for PhD founders. “Conception X played an absolutely pivotal role,” Patrick-Evans says. “It helped shape the growth of the company — getting funding, putting the pitch deck together, getting the business off the ground.”
Today, RevEng.AI is a team of 18 and has raised £4.7 million from investors including Sands Capital, In-Q-Tel, IQ Capital and Episode 1.CX2
What the team is building addresses a growing industry problem, with key applications in sectors that demand the highest security standards — defence, financial services and telecommunications among them.
Software supply chains have become more complex, relying on hundreds or thousands of third-party packages. “We have software which is often not wholly created by developers,” Patrick-Evans says. “If there’s one compromise anywhere in there, it can destroy its integrity.”
Right now, it comes down to trust. “You have to trust that [a piece of software] is going to do something you want it to do, and not something you don’t want it to do,” he says. “But in reality, you have no idea. You just have to trust the developer. And that’s a problem.”
“Our solution can take any piece of software and identify any good or bad or potentially weak component inside of that — and this really fundamentally changes the game.”
For technical founders looking to follow a similar path, Patrick-Evans says that persistence is key. “You’re going to face a lot of people who are going to tell you that you’re wrong, and you have to have that knowledge and drive to keep on going through the tough times — because there are absolutely tough times.” Ultimately, what carries you through, he says, is belief: in your product and its ability to change people’s lives.
