Mario Vuksan asks what trust is made of

Mario Vuksan has a useful qualification for a business built around suspicion: he studied art history. Alongside mathematics and computer science, he learned to think about objects people make, the circumstances in which they make them, and the information those objects carry. Years later, as co-founder and CEO of ReversingLabs, he would be concerned with a rather different collection. Software, too, arrives with an appearance, a history, and occasionally something its owner would rather you overlooked.

He is a graduate of Swarthmore College and Boston University. The combination of technical and humanities subjects is more than a decorative flourish on a cybersecurity biography. When he discusses engineering, Vuksan talks about the relationship between technology and society. He reaches for Leonardo da Vinci and the care architects take over bridges. A bridge must carry people across a river. It also has to be something its maker can stand behind.

That makes a revealing starting point for understanding him. Security is often presented through the language of enemies and emergencies. Vuksan also approaches it through the responsibilities of making something. What have you built? How does it work? What happens when somebody else depends on it? Those questions can survive a change of profession rather well.

Before the company, a problem worth keeping

Before ReversingLabs, Vuksan held senior technical positions at PictureTel, Groove Networks, Microsoft, and Bit9. These were places where building software meant confronting complexity at close range. His later position as a chief executive came after that technical career; the product had already occupied much of his working life before the company became his responsibility.

His route into founding was gradual. He describes ideas accumulating rather than arriving as a single revelation. That is a less cinematic account than the familiar entrepreneurial thunderbolt, but it makes room for something more useful: experience. A problem encountered repeatedly can become harder to dismiss, even when an employer has other priorities.

At Bit9, he worked on a trust repository, using large collections of information to help distinguish familiar software from potentially troublesome files. The experience also exposed limits in the existing methods. Knowing the identity of a file could help. Understanding unfamiliar content demanded more investigation. That gap would become a business problem he kept working on.

By February 2018, he was speaking at an IBM cyber breakfast in London about file reputation and software supply-chain attacks. His subject included products signed by trusted vendors that nevertheless carried malicious content. The awkward question was already there, well before the topic became a regular boardroom concern: how much reassurance should a familiar name provide?

A rented apartment, then a longer road

Vuksan and Tomislav Peričin co-founded ReversingLabs in 2009. Its early development work took place in a rented apartment in Zagreb, while Vuksan had an established connection to Boston. Peričin brought his background in security research; Vuksan brought experience from software and security companies. Their shared project was static analysis: investigating software without first having to run it.

The timing offered few comforts. The financial crisis formed the backdrop to the company’s beginnings. Years later, Vuksan would discuss that period without airbrushing the difficulty out of it. ReversingLabs required persistence across years of uneven progress. A founding date is a tidy entry on a timeline. Living through the interval that follows is a much less orderly activity.

By December 2024, the company was marking its fifteenth anniversary. The apartment makes a good origin image, but the elapsed time matters more. It puts distance between an interesting technical idea and an organization able to keep developing it. Fifteen years leaves room for revisions, customer conversations, unglamorous work, and the repeated necessity of making the next version useful.

The package has an inside

To understand what Vuksan’s company does, consider the difference between reading a recipe and examining the meal delivered to your table. Source code describes software before parts of it are compiled and packaged. The finished artifact is what a customer receives. Investigating that artifact can reveal components, embedded material, and functionality that deserve attention.

ReversingLabs specializes in examining this binary content. A software delivery may contain many components and subcomponents. Analysis breaks the package down and extracts information that investigators can use: identities, metadata, suspicious capabilities, and evidence of possible tampering. The task is painstaking enough when handled one file at a time. An organization receiving software continually needs a repeatable process.

In 2020, Peričin described the company’s approach to explainable threat intelligence as a combination of reputation, similarity, and metadata analysis, alongside other techniques. A known file might be recognized quickly. An unfamiliar file could be compared with related material, or examined for revealing internal properties. Information collected inside the organization could be considered alongside outside intelligence.

The appeal of this approach is that a reputation is only the beginning of an inquiry. A package contains relationships as well as a label. The engineering challenge is to make those relationships visible quickly enough that somebody responsible for a decision can use them.

An alarm owes you an explanation

That same year, ReversingLabs introduced its approach to explainable machine learning. The emphasis was on helping human analysts understand the classification a system had produced. Peričin’s technical account described models built around human-readable indicators of code intent, so an analyst could examine why a file had been assigned a particular malware category.

This is a practical concern with a human consequence. A security analyst who receives an alarm must decide what to investigate and how to respond. A label on its own leaves much of that work untouched. An explanation offers material to question, assess, and act upon. The computer may be fast; the person still has to answer for the decision.

Here, the art-history connection becomes an interesting lens rather than a claim about who invented which algorithm. Looking carefully and explaining what you see are useful habits in both fields. ReversingLabs’ technical work belongs to its researchers and engineers. Vuksan’s role is to help sustain an organization in which that work can become something customers understand and use.

When a trusted update carried the attack

In December 2020, the SolarWinds compromise gave the software industry an especially costly example of misplaced reassurance. Malicious code had travelled inside updates to the Orion platform. A normal delivery mechanism had carried an abnormal passenger. Customers did not need to seek out a suspicious download; the software update had come through an established channel.

Peričin published ReversingLabs’ analysis on December 16. It examined how the attackers blended their additions into the surrounding code, adopting naming patterns and arranging execution within existing background activity. The research also considered compilation and signing artifacts. Details that might look administrative to an outsider became evidence about how the software had been built and delivered.

The work illustrates the company’s particular interest in the finished object. Its researchers compared versions and described changes in capabilities that could give investigators reasons to look more closely. The incident was discovered by others; ReversingLabs contributed analysis of its mechanics. Keeping that distinction matters. The story is revealing enough without handing one company everybody else’s credit.

For Vuksan, the episode sits squarely inside the question his business addresses. A recognized supplier, a signed package, and a familiar update process can coexist with malicious content. Trust needs maintenance after the paperwork is complete.

Capital arrives; responsibility stays

In August 2021, ReversingLabs announced a $56 million Series B financing led by Crosspoint Capital Partners, with ForgePoint Capital also participating. The company planned to expand its sales and marketing efforts. The funding followed heightened attention to software supply-chain compromises, including SolarWinds. More organizations had reasons to ask what was actually inside their software.

The money belongs in the story as a company milestone. It measures financing, rather than Vuksan’s personal wealth or the quality of every product decision. For a technical founder, bringing a product to more customers adds another kind of work: explaining why it matters, supporting its use, and maintaining the organization behind it.

At Black Hat’s first Entrepreneur Micro Summit in 2023, Vuksan spoke about the long road to building ReversingLabs. His advice was grounded in product quality and attention to customers. He also placed employees and their families within a founder’s circle of responsibility. A company’s survival has consequences beyond the person whose name appears beside its founding date.

“If you want to survive, your technology has to be solid,” he said. It is a wonderfully unadorned sentence for an industry with no shortage of elaborate vocabulary. Beneath the conference lighting, there was an engineer’s test: the thing has to work.

“If you want to survive, your technology has to be solid.”

Mario Vuksan · Black Hat, 2023

The next file is already on its way

Vuksan has continued making the case for inspection as the software landscape changes. In September and October 2026, his public writing turned to AI agents and the artifacts they consume: packages, models, files, and tools. His argument was that permission to reach a resource and evidence about its contents answer different security questions.

The concern fits the older work. An automated system can bring software into an organization quickly. Someone must still decide how that software should be examined and what evidence should accompany approval. Faster acquisition gives the inspection problem another setting. It does not retire the original question.

His public career also includes appearances at RSA Conference, Black Hat, Defcon, Virus Bulletin, and other security events. These are places where the work has to survive questions from people who understand the details. For a founder who has remained close to technical subjects, explaining the reasoning is part of the job.

The story circles back to the object on the table. A bridge, a painting, a software package: each has been made by someone, through a process, with consequences for the next person who encounters it. Vuksan has spent years building a company around investigating one class of those objects. Before handing over your trust, he would like you to have a look inside.