No vendor money. No conflicts.
Our findings are credible because they cannot be bought, suppressed, or influenced by the vendors we investigate.
The security audit industry has a structural conflict of interest. The same firms that audit code also take retainer fees from the vendors whose code they audit.
When the firm that finds the vulnerability is paid by the vendor to find the vulnerability, the vendor controls what gets published. We have seen audit firms produce a clean report for a codebase that we later documented had 13+ silent patches. The audit firm’s clean report became the vendor’s marketing material. The 13 silent patches were never mentioned. This is not a hypothetical. This is documented in our case studies.
Whitenbaker does not accept vendor funding for any engagement where the vendor is the subject of the research.
No vendor retainers. We do not accept retainer fees from the companies whose software we analyze. Our clients are the organizations that depend on the software, not the organizations that produce it.
No audit partnerships. We do not partner with vendors to produce co-branded security assessments. When a vendor’s name appears in our work, it is because we documented their behavior, not because they commissioned the review.
No platform dependencies. We do not rely on bug bounty platforms, vendor-controlled triage processes, or intermediaries that give the vendor control over whether a finding becomes public. We file directly with MITRE.
We Accept
- Engagement fees from organizations evaluating their own dependencies
- Subscription fees from investors, compliance teams, and risk managers
- Expert witness fees from courts and enforcement bodies
- Retainer fees from researchers needing escalation assistance
We Do Not Accept
- Vendor-funded audits of the vendor’s own software
- Retainers from companies we are actively investigating
- Bug bounty platform fees that give vendors triage control
- Partnership arrangements with audit firms that serve our targets
- Sponsorship, advisory, or equity positions in target ecosystems
We have documented a specific conflict of interest pattern in the blockchain security industry.
One firm audits the upstream code, triages the downstream bounty program, and serves as a paid partner to the platform that manages both. When a researcher submits a finding about the upstream code through the downstream bounty program, the same firm that missed it in their audit is now the firm deciding whether it is valid. Their financial incentive is to reject it. We have documented this happening. The case studies are public.
Our independence is not a marketing position. It is the structural precondition for our work being credible.
Every finding stands on its own. No vendor can suppress it.
Our evidence packages are designed to survive adversarial scrutiny from the vendor, their legal team, and any audit firm they retain to dispute the finding.