Sherlock

Sherlock is a security organization focused on onchain systems where software directly controls capital. It positions its offering as "complete lifecycle security," spanning three phases: development (early identification of issues while code is still changing), auditing (structured adversarial review programs plus fix verification before release), and post-launch operation (ongoing incentives and financial backstops on production code). The stated rationale is that point-in-time reviews do not match how protocols are built, since teams ship continuously and trust assumptions shift with upgrades and integrations; Sherlock describes the benefit of its connected model as a durable "security memory" of a system that reduces repeat findings and shortens remediation cycles.

The company documents six core services. Sherlock AI is an AI security tool used during development and pre-launch review that reads a codebase in context, models protocol intent and trust assumptions, and produces fix-ready findings. Collaborative Auditing is a staffed private engagement in which Sherlock assembles a team from its researcher network for a given architecture and attack surface. Audit Contests are time-boxed public programs where many vetted researchers review the same scope under defined rules, with structured judging and severity calibration. Bug Bounties are post-launch programs paying independent researchers for valid live findings, with triage and remediation workflows defined up front and in-house triage of incoming reports. Sherlock Shield is an optional post-launch coverage program that can reimburse eligible losses or payouts tied to covered security events. Blackthorn is a premium collaborative audit tier staffed by a small group of top-tier reviewers for the highest-stakes scopes. The company's site also describes an Audit Engine as an orchestration layer that coordinates multiple AI security approaches against a codebase and consolidates their output into a single validated audit result.

Sherlock states that its services can be used individually or combined, and that customers include protocols, institutions, infrastructure providers, asset managers, L1s and L2s, bridges and vaults.

Business model

Sherlock sells security services to teams operating onchain systems, structured as discrete programs that can be purchased individually or combined: private collaborative audits (including the premium Blackthorn tier), AI-native review via Sherlock AI and Audit Engine, public audit contests, post-launch bug bounties, and Sherlock Shield, an optional coverage program with defined terms that can reimburse eligible losses or payouts tied to covered security events. Audit contests and bug bounties are run over a network of external, vetted security researchers who are paid for valid findings, while Sherlock coordinates scoping, judging, triage and fix verification.

Sherlock is engaged by protocol teams for paid security programs (staffed audits, AI-based review, contests and bug bounties) and offers Sherlock Shield as an optional coverage program with defined terms. The company frames its AI product as reducing audit scope and audit costs for customers; specific pricing is not stated.

Traction

Company-reported figures include 1,500+ audits and security reviews, 2,000+ critical vulnerabilities uncovered, 11,000+ registered security researchers, and support for protocols accounting for more than $250B in active TVL. Publicized engagements include a collaborative audit plus public contest for Aave V4, a Blackthorn audit of Morpho Vaults V2, and a two-week competitive review of upcoming XRP Ledger functionality for Ripple. Sherlock AI, launched in open beta, is described as already in use by several large Web3 projects, including protocols ranked in the top 50 by TVL.

Latest developments

Sherlock announced Sherlock AI, an AI auditing assistant integrated into development workflows via GitHub, on 2026-02-04, initially as an open beta; the company's site indicates Sherlock AI is live. It also published a post on its Audit Engine, an orchestration layer for AI-native security review, dated 2026-08-19.