Current state of web3 security products

This is a review of some of my thoughts about the software products and services in Web3 and DeFi security market.

Web3 security market in 2024 is quite more competitive than, say, in 2021, when the money was crazy and there were only a few auditors.

The web3 and DeFi security assessment market is maturing, becoming more fragmented, same as the traditional penetration testing and security audit markets.

The reasons this type of services tend to form a fragmented market is quite simple:

1. Anyone can start a security auditing company, it does not require any product development or investments,
2. The customers often wish to have more than 1 auditor and also rotate them from time to time, so there’s much less retention than in the SaaS markets.

Obviously, a potentially more lucrative path for a business is to create a subscription-based product with a recurrent revenue (aka ARR/MRR) and to pursue an exit.

Also obviously, the web3 founders borrow many ideas from “web2” or rather non-blockchain tech and TradFi protocols. It’s logical to also adopt the web2 security practices in web3.

And it works in some cases! However, many obvious and straightforward ideas do not transfer well from web2 to web3 in terms of business.

Let’s take a look at a few possible web3 security product categories.

Application Security Testing (SAST/DAST)

SAST/DAST products along with the DevSecOps/SDLC implementation services make up quite a big market, estimated at least billions of USD yearly. Of course we should create a SAST for Solidity and a DAST/fuzzing tool for EVM! Right?

Well… Not quite so! Why? There’re differences in some key points, let’s look at them.

• The code size

In the legacy web2 world, especially in corporations such as banks, there’s literally millions lines of code. Many people who wrote that code are dead long time ago, so no one know how this shit works.

Hundreds or thousands of devs continue piling up on those layers of ancient code, and someone needs to review all of that.

It’s undoable and too expensive for people, so we need tools! And here comes the corporate Salesforce-enabled HADI-cycle powered Linkedin-type crowd of B2B SaaS sales people with their monstrous on-premise boxes priced like an airplane with additional $100/hour low-quality support.

In web3, on the other hand, a single protocol has somewhere around 500–3000 lines of code which can totally be thoroughly reviewed by a single team in a reasonable time. Still, the bugs get missed, but that’s another story =)

• The risk level

In web2, when you have 5 million lines of code in C#, you cannot physically fix all the bugs. You manage the risks by combining security reviews with mitigations, monitoring, “zero trust”, etc.

If you’re a web2 corporate AppSec engineer and a SAST scanner yields a report with 1000 critical bugs, you just say “meh” and report to CISO that there were 1337 crits last month, so you’re making a progress. You never care fixing all the bugs!

In web3, a single bug can instantaneously drain your whole business within 1 transaction, and there can be no going back. Therefore, you cannot afford just doing a pass of automated analysis before deploying to prod. You have to do a few rounds of high-cost security reviews.

This diminishes the value of automated tools for web3, although they still can be useful because they catch the low-hanging fruits and force the auditors to focus on more subtle bugs.

• The development cycle

In web2, you have weekly or bi-weekly sprints which never stop. There’s always something adding to the product, constant modifications are shipped regularly.

Move fast and break things!

The philosophy of web3 is totally different — you write the code once and it’s immutable. Well, we don’t actually follow that philosophy, do we? But the point holds: there’re much less changes being done to DeFi protocols compared to the typical software.

If the release cycle is very long, then do we really need DevSecOps? The whole point of DevSecOps is to plug in the SDLC as one of the blocking steps before shipping to prod.

But if we need to do an audit before going live anyway, then there’s no need to subscribe to an automated tool. We can just run it once if needed and then proceed with a manual audit!

All of this boils down to a fact that an AST-type software product business in web3 is not so attractive as it is in web2. It might be viable but the market is limited.

There were a few notable examples in this field:

• Crytic was a startup by Trail of Bits that created Slither but shut down because the business model didn’t work,
• MythX was a startup acquired by Consensys Dilligence, the core product initially was an open source tool Mythril, however, the product was also sunset.

We should also note some possibly successful but very limited cases such as Dedaub’s $400k deal with Fantom, FuzzLand’s revenue from front-running, or Remedy’s Glider platform release.

Firewalls/IDS/IPS

The firewall market is also a multi-billion dollar industry in web2. What if we make a “web3 firewall” or a “web3 SOC”?

Real-Time Hack Detection

This idea came to dozens of companies including us. When we started Decurity in 2022, the on-chain real-time threat detection space was not crowded at all. As a team that previously built enterprise Web Application Firewall (WAF) solutions, we also rushed to build a transaction analysis tool.

We decided not to raise VC funding because there was no market for hack prevention and it was clear that this niche is suicidal: as soon as there’s enough adoption of monitoring tools, the hackers will become more elusive and smart and will learn to evade them, reducing the value of on-chain prevention.

Our initial idea was a transaction filter powered by DSL rules with Wirefilter-based queries and we spent a few months developing this product. Only after some progress we realized that the tool was quite limited and can only be used as a bit more advanced kind of OpenZeppelin Defender.

To build a more general solution and a hack prevention product, we needed a streaming analysis platform with complex range matching queries. So, circa May 2023 we started building Defimon from scratch, throwing away all the previous work. Our CTO Arseniy Reutov talked about some technical details at the TrustX conference in Istanbul in 2023:

At this time, some of our competitors have already been developing the exact same thing for 2 years and raised $7–10M in VC funding. Since then, only Hypernative and Cube3 raised series A in 2024, both expanding or pivoting their product focus from the narrow niche.

Now, some (Venn, Forta) started working on slightly different yet obvious angle: doing ecosystem-level integrations for hack prevention, others shifted to the risky world of fuzzing and MEV.

Still, it’s evident that the revenue of the companies in this space is very disproportionate to the funding. Each of these startups are raising more than the whole market size while earning less than auditing companies who don’t need any funding.

On-chain Firewalls

Apart from the off-chain detection and response, there’s another idea floating around: circuit breakers. A few startups are working in the space and some have raised significant capital.

Though it seems now that they’re desperate to get customers, and on-chain data suggests that there’s little to no adoption. It’s hard to convince people to add another level of complexity to their DeFi protocols.

SOC and Incident Response

Transaction monitoring systems are a Web3 analogs of IDS/SIEM, circuit breakers are a Web3 analogs of IPS. Sure enough, this leads us to Web3 SOCs and similar services offering investigations and incident response.

Seems that there’s a relative success in this field for a couple firms but it’s not a software product but rather a solution consisting of implementing various procedures and building processes.

To summarize: the “web3 monitoring/firewalls” business is not venture-scale although having about $100M in funding and will have to consolidate or pivot.

Threat Intelligence/Compliance/Risk Management

Speaking of SOC, I cannot forget about TI. If we count Chainalysis, TRM Labs and the like in this category, we’ll notice that this niche is comparatively less fragmented and has stronger leaders.

Data Analytics, KYC/KYT

Why is there success in this space? Simple: it’s not even actually Web3, it’s more like a solution for the corporates who need to deal with blockchain and need observability of what’s going on there.

The demand is driven not by the inner security problems of blockchain or smart contracts but rather by the fact that the scammers like crypto so much. The regulations and sanctions pumped the market additionally.

The products of this type can either serve a certain specific task such as checking an address for some red flags before accepting or sending a payment (KYC/KYT), or they can be a general-purpose data analytics platform used for investigations and risk management as well as other not security-related purposes.

Scam Detection

The token sniffers, rug-pull detectors, anti-scam extensions might be even more heated space compared to the monitoring market.

There’re dozens of browser extensions and a few SaaS API products doing reputation database lookups, transaction and contract analysis and simulation to protect against scams.

This use case is much broader and technically much more solvable than preventing hacks: people get scammed all the time, and they can actually be saved before the scam happened without complex actions such as front-running. Also, the businesses such as wallets, CEXs or custodies might need the APIs for checking the tokens or EOAs.

However, it still doesn’t seem to work for the B2C part of this business: people are not willing to pay much for such protection. The B2B side looks a bit healthier, with a notable example of Goplus who even acts as a venture investor. One of the other examples was Redefine who integrated their simulation API with Safe but then lost the deal to Tenderly.

To summarize: Threat Intelligence solutions might be the only really successful type of software product in Web3 Security, and not easy to get in because you need to be able to analyze large amounts of data from the start and have connections to many entities to sell to the institutions.

Marketplaces/Bug Bounty

The platforms for bug bounty and audit contests are another highly competitive space with players like Immunefi, Spearbit/Cantina, Code4rena, Hackenproof, and many others.

The idea of contests is quite novel and differs a lot from conventional web2/web3 audits and bug bounties. It’s also controversial: it’s unclear what should the contest be done, what should be the budget, etc.

It seems that currently for many DeFi projects contests are not in the same category as audits: it’s a marketing budget rather than a security budget. Someone had a $1M contest? We’ll make it $1.05M! Oh, now there was a $2M contest? Hold my beer…

Clearly, for $2M you could do 10 deep audits with top-tier firms, the amount of highly qualified person-hours dedicated to your codebase would be much higher than in a contest where hackers have no commitment and most of them don’t actually spend any time. Also, the triaging is a nightmare, and the projects have to spend a lot of effort on top of the budget to triage the findings.

From the business standpoint it’s also a bit fragile: there’s a hard cap on the margins since the platforms only charge 20–30% on top of the rewards. And the whole market is only a part of the bigger market of security reviews.

Probably the biggest player is Spearbit/Cantina with estimated north of $15M in revenue which means that their actual revenue (fees) would be about $3.5M. Quite not bad but also not huge for the market leader who raised $7M, has a strong team and hired top bounty hunters paying them highest hourly rates in the industry.

Another well-known company that created the contest space, in a sense, Code4rena, burned through its funding and succumbed to a forced liquidation/exit in 2024.

To summarize: crowdsource platforms are a continuation of the audit market and currently almost do not bring any additional technical value apart from a simple web app and a community of hackers.

There’re some notable attempts to make it actually a software product rather than a marketplace: Remedy’s Glider search engine and Cantina’s platform/IDE.

Wen Moon

Despite all the technical complexities and business hurdles of creating a successful Web3 Security product, I’m quite bullish, and we’re working hard on a few novel products in Decurity.

A lot of smart people are trying to create the solutions to existing problems and foresee the future problems. A lot of smart people come to the industry from the other industries, bringing their skillsets and vision. And of course, with this trend, the biggest factor will be AI replacing the auditors in a few years =)

Overall, the crypto market stabilization, purge, regulation, and UX enhancements will create a path for the tools that will find a product-market fit and will help the future web3 adoption.

Current state of web3 security products was originally published in Decurity on Medium, where people are continuing the conversation by highlighting and responding to this story.