Fuzzbuzz

Fuzzbuzz built a cloud platform that delivered fuzzing — an automated software testing technique that generates and executes very large numbers of test inputs to surface edge cases, crashes and vulnerabilities — as a managed service. The platform was designed so that writing a fuzz test was comparable in effort to writing a unit test: developers connected their repositories, and Fuzzbuzz ran the latest version of the code against continuously generated inputs on managed infrastructure that could be scaled across dedicated CPUs.

The service integrated with GitHub and, through an open API, with CI tools such as Jenkins and TravisCI. When bugs were found, Fuzzbuzz notified users via Slack and opened Jira tickets or GitHub Issues, and a command-line interface let developers reproduce and fix findings locally before pushing code. The company addressed common operational problems of fuzzing at scale, including bug deduplication and elimination of false positives. At launch the platform supported C, C++, Go and Python, with Java and JavaScript described as planned; the company said its approach applied genetic algorithms to evolve new test cases from seed examples and used code-coverage feedback to identify interesting inputs. Beyond memory-safety defects in C/C++, the founders described use cases such as hangs and slowness, panics, assertion failures, race conditions, excessive resource consumption and denial-of-service conditions, plus differential fuzzing between implementations and invariant checking.

Fuzzbuzz maintained public GitHub repositories accompanying its documentation and tutorials, including getting-started projects for C/C++, Go, Rust and Python, a Go fuzzing tutorial, a Heartbleed walkthrough and deliberately buggy sample targets. Public repository activity is dated through 2022.

Founding story

The company was founded by Everest Munro-Zeisberger, Andrei Serban and Sabera Hussain. Munro-Zeisberger was introduced to fuzzing while working on Google's ClusterFuzz team, where he built ClusterFuzz Tools v1, and later built Maxfuzz, a toolset for fuzzing code in Docker containers, while on Coinbase's security team. The founders observed that although fuzzing was highly effective — teams at Google reported it found 80% of their bugs — few organizations outside large companies such as Google and Microsoft ran it, because of the time and cost of standing up automated fuzzing infrastructure, and started Fuzzbuzz to remove that barrier.

Business model

Fuzzbuzz operated a hosted software service in which it managed the fuzzing infrastructure on behalf of customer engineering teams, offering a free tier that allowed anyone to sign up and fuzz code on one dedicated CPU, with the ability to scale to additional CPUs on demand. The company also offered to fuzz qualifying open-source projects written in C, C++, Go or Python for free on its platform.

Paid access to hosted fuzzing capacity, with a free tier limited to a single dedicated CPU and additional CPUs available to customers; free fuzzing was also offered to selected open-source projects.

Traction

At the time of its April 2019 seed round the company described itself as early-stage and working with initial customers, with the funding earmarked for hiring engineers and completing the product. Its public GitHub organization hosted 11 repositories, including a Go fuzzing tutorial and a Heartbleed tutorial. By the 2024 acquisition, the team consisted of six engineers.

Latest developments

Rippling announced the acquisition of Fuzzbuzz in a post updated March 26, 2024, stating that the Fuzzbuzz team would work on Rippling engineering efforts spanning new products and infrastructure. Rippling framed the deal as part of a pattern of acquiring founder-led teams, following its 2022 acquisition of RunX.