Black Hat 2026 Vendor Profile — Cyber Defense Magazine By Dr. Arun Lakhotia
Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with the series introduction, or jump to the closing synthesis.
Interviewee: Igor Lasic, SVP of Technology, ReversingLabs
ReversingLabs anchors its supply-chain message on a single unit of analysis: the final build. “As a producer or a consumer of software, you want to do a final build analysis,” Lasic said — “all the open-source packages and your code in a final release package you
would release to your customer, or as a consumer, you would deploy in your system.” Software supply-chain security recently became a distinct Gartner category, and ReversingLabs positions itself as “one of the rare companies that can actually go and do a full analysis on that.”
Decompose everything, analyze each file
The distinctive move is depth. “We break the package to its complete constituent files and examine each one.” A single installed package “can contain hundreds of thousands of files”; ReversingLabs extracts and performs deep static analysis on each, recursively unpacking archives within archives. The demo — an updated build of LibreOffice — extracted roughly 100,000 files, charted their type distribution (binary, text, and the interesting things “neither binary nor text”), and flagged a stray VBScript file lurking where it had no business being. “There’s probably… we’re probably the only company that does this level of analysis,” Lasic said.
From that decomposition the platform produces a SAFE report graded across levels 1 through 5 (higher is better; level 1 is simply “no malware”), with policy summaries across the dimensions producers and consumers care about: malware, vulnerabilities, hardening (e.g., defenses against buffer overflows), tampering (including files that are signed but altered — a compromised certificate chain), secrets and leaked credentials, and licensing. The report tells a producer what to fix to climb from level 3 to 4 or 5, and lets a consumer refuse anything below a chosen level.
Behaviors, not just names
Where ReversingLabs most clearly moves beyond name-matching is its behavior inventory. The LibreOffice build exhibited 402 behaviors and touched some 5,000 URLs, domains, and IP addresses, all classified and cross-referenced against network threat intelligence. Behaviors are ranked so an analyst can filter to “uncommon, anomalous, important, or malicious” — the point being that “if something was not detected as bad yet, you can look at the behaviors and say, wow, this open-source package goes to the network… it’s heavily obfuscated, somebody’s trying to hide information.” Policies can be written against specific behavior IDs to block, say, anything that reaches the internet or deletes files.
The platform also surfaces categories increasingly relevant to modern builds: an MLBOM identifying which machine-learning models or AI services the software reaches out to (Lasic cited spotting calls to services like DeepSeek or Kimi), and a CBOM enumerating ciphers and hash functions — useful for catching weak cryptography. Vulnerability matching, he explained, relies on CVE identification data to tie a CVE to a specific file and version.
A free community feed, and flexible deployment
ReversingLabs runs a free portal that pulls package ecosystems in real time — npm, PyPI, RubyGems, NuGet, Maven, VS Code, and the PowerShell Gallery, with MCP registry and
other AI-artifact sources recently added — publishing findings “so that folks can check what they’re using before using it,” and aiming to be “one of the first people that detect new threats coming from open source.” Notably, the portal preserves malicious releases that maintainers later remove, so a team that had “the misfortune of getting it in that period of time” can still learn what they were exposed to.
Deployment fits real pipelines: a hosted SaaS portal with APIs, or an on-premises binary that plugs into Jenkins and other CI/CD tooling for air-gapped environments, blocking or passing a build based on the result. Producers wire it into CI/CD; consumers — Lasic cited financials with mandates to scan all incoming software — automate package checks via API and gate deployment through their management tooling.
One engine, two problems
A theme worth drawing out: ReversingLabs uses “the same technology for both software supply-chain security and for the SOC.” The same decomposition, static/dynamic analysis, and threat-intelligence corpus power a malware-analysis workbench with file similarity (fuzzy-hash approaches such as TLSH and ssdeep, plus the company’s own graded algorithm scoring matches at roughly 25/50/75 levels), attribution heuristics, and interactive sandbox analysis where an analyst can watch a file execute — and even bring their own sandbox. Lasic positioned this as “very comparable to VirusTotal,” with interactive analysis as a key advantage, run across a large data center of “six, seven hundred hardware machines.”
On scanning terminology, Lasic was pragmatic. Asked what “scan” even means now that every supply-chain vendor uses the word, he said it is simply “the process of taking the file, doing something to it, producing” a result — “the same concept” as antivirus, applied far more deeply.
The takeaway
ReversingLabs’ strength is uncompromising depth: it opens the final artifact all the way down, catalogs what each file does rather than merely what it is labeled, and unifies supply-chain assurance with SOC-grade malware analysis on a single engine. In the vocabulary of my thesis, its behavior- and tampering-centric view is exactly the kind of analysis that name-based SBOM/CVE inventories cannot provide.
About the author
Dr. Arun Lakhotia is Professor of Computer Science at the University of Louisiana at Lafayette and co-Founder/CTO of Unknown Cyber Inc. He was on assignment with Cyber Defense Magazine for Black Hat 2026 to study the nuances of solutions offered for software supply chain defense. His expertise is in developing automated solutions for analyzing complex malware on a very large scale.
Reach him online at [email protected].
