Does your team use AI coding agents to write your software? How confident are you that the agent built what you actually intended, and that it didn’t introduce security vulnerabilities along the way? How can you check that the generated code complies with your security and privacy policies?
More and more developer teams now use AI agents to build complex software at scale and at speed. The bottleneck is specification and review, which requires domain expertise and is error-prone, allowing correctness bugs and security flaws to slip into the codebase. As frontier AI models get better at finding and exploiting vulnerabilities, there is a pressing need for methodologies to develop software systems that are secure-by-design and secure-by-default.
Formal verification — mathematically proving that software meets its specification — can be the answer. Large technology companies like Amazon and Apple now invest significant resources to verify their most critical systems. At Cryspen, we develop hax, an open-source verification toolchain that helps verify security-critical software at companies like Signal. Despite these landmark results, applying formal verification to industrial software remains too time-consuming and expensive for general use, and requires a new approach.
Funded by an EIC Transition Grant, Cryspen is now building Spectrum — a specification-driven software development toolsuite that dovetails with AI coding agents to help developers establish security and correctness guarantees from design to deployment. Spectrum builds upon our decades of research and experience in software and security verification, and judiciously uses AI agents to scale up these proven techniques so that they can be applied to real-world software.
We are actively developing Spectrum and working with our customers to test it on their code. Over the course of the project, we will release more information on our tools and how they can help companies develop innovative software at speed without sacrificing correctness, security, and privacy.
Follow our updates below, or get in touch to learn more.
