Whirly Labs

Whirly Labs is a security consultancy that works with your developers to get vulnerabilities fixed. Founded in 2023 and led by Fabian Yamaguchi, the inventor of the code property graph, we have offices in Cape Town and Centurion and work with development teams worldwide, most of them in Europe and North America.

Our security assessments start from the code. We review your source code with the help of the code property graph and tooling tailored to your application, and confirm what we find against the running system. That way we find the root cause of each vulnerability and every place it occurs, and keep false positives out of our reports. We assess web applications and APIs, iOS and Android apps, applications built on large language models, system code in C and C++, and cloud and internal infrastructure, and check them against established standards such as the OWASP WSTG, ASVS, and MASVS, the OWASP Top 10 for LLM Applications, and the CIS Benchmarks. Our reports meet compliance requirements such as PCI DSS, ISO 27001, and SOC 2.

Many of our analysts worked as software developers before moving into security. We explain each finding in your code, tell your team which findings matter and which can wait, and stay available while they fix them.

Beyond assessments, we build custom static analysis on Joern, the open-source code analysis platform we maintain: analysis that knows your frameworks and conventions, runs in your CI pipeline, and finds every instance of a vulnerability pattern. Our analysts also join teams as an embedded security team, and we run hands-on developer training built around your languages, frameworks, and findings. If you want AI in your testing, our analysts work with MAGE, our AI harness for cyborg pentesting.

Our team has found and responsibly disclosed vulnerabilities in software from Microsoft, Cisco, the Linux kernel, VLC, and Graylog.