RunSafe

RunSafe Security provides cybersecurity software for embedded systems and firmware, combining software supply chain transparency with runtime exploitability reduction. Its platform is organized into three modules that can be adopted individually or together: Identify, which generates build-time Software Bills of Materials (SBOMs) for C/C++ and firmware codebases, finds known vulnerabilities in libraries and dependencies, and scores risk reduction; Protect, which mitigates memory-based exploits such as return-oriented programming (ROP) chains and buffer overflows; and Monitor, which tracks software crashes at runtime to distinguish bugs from attacks and filter false positives for incident response.

The products are positioned for environments where conventional application security tooling struggles, including statically linked binaries, custom toolchains, and long-lived embedded systems. RunSafe states its tooling works with Yocto, QNX, Linux, VxWorks, and Windows builds, integrates with CI/CD pipelines and local build environments, and outputs CycloneDX-format SBOMs to support EU Cyber Resilience Act, FDA, and OEM security requirements. The company emphasizes that protection requires no source code changes and operates on existing binaries with minimal performance overhead.

RunSafe describes its customers as spanning aerospace and defense, energy and industrial automation, operational technology, transportation and automotive, medical devices, and high-tech manufacturing.

Founding story

RunSafe Security was founded by Joseph M. Saunders, who serves as Founder and CEO, and Doug Britton, who serves as Executive Vice President and Chief Strategy Officer and previously served as CTO. According to the company, the founders shared the observation that despite investment in perimeter defenses and continuous patching, critical systems remained vulnerable to sophisticated attacks. This led them to develop technology intended to deny attackers the determinism required to build reliable exploits. Saunders' prior background includes management consulting at PricewaterhouseCoopers, a director role at Thomson Reuters Special Services, and membership on the management team of TARGUSinfo; Britton previously founded Kaprica Security, which sold its Tachyon business to Samsung, and managed security research and exploit development programs at Lockheed Martin.

Business model

RunSafe sells a modular commercial software platform to organizations that build embedded products and critical infrastructure software. The Identify, Protect, and Monitor modules can be licensed separately or in combination, allowing customers to scale adoption. The products integrate into existing build and deploy toolchains rather than replacing them.

The company sells its security platform modules to commercial and defense organizations; specific pricing structures are not disclosed. RunSafe reported back-to-back years of tripling annualized revenue as of September 2024.

Traction

The company reports back-to-back years of tripling annualized revenue as of September 2024 and adoption by industry leaders including Vertiv, Lockheed Martin, GE Vernova, and the U.S. Army, Navy, and Air Force. Marketing materials cite average customer savings of $2.08 million per year from risk reduction, a 50% average increase in automated mitigation, and a 90% reduction in zero-day exposure. Employee count is listed in the 1-50 range.

Latest developments

In January 2026, RunSafe appointed Bob Lyle, previously CRO at Medcrypt, as Chief Revenue Officer. In March 2026 it was named a finalist for the 2026 SC Awards in Best Supply Chain Security Solution, and in April 2026 it released the 2026 Medical Device Cybersecurity Index, reporting that 24% of healthcare organizations experienced cyberattacks affecting medical devices, with 80% of those impacting patient care. In June 2026 the company received a Cybersecurity Stars Award for Best Embedded Security Platform from The Hacker News. In July 2026 it announced plans to demonstrate certifiable cybersecurity for aviation systems at DEF CON 34, and CEO Joseph M. Saunders was scheduled to address the U.S. connected vehicle rule at the Automotive Cybersecurity Summit 2026.