AI-Native Security Research

We Find What Others Can't

AI-powered vulnerability research across source code, binaries, web applications, mobile platforms and live infrastructure. We find security flaws before attackers do.

Our Research Recent Disclosures
Scroll
Our Approach

AI-Augmented Vulnerability Discovery

A multi-phase pipeline that combines AI-driven static analysis, binary reverse engineering, dynamic testing in real environments and evolutionary fuzzing — covering every layer from source code to live infrastructure.

Static Analysis

Deep source code auditing across C, C++, Java, PHP, Kotlin and Rust using custom tooling built on code property graphs. We identify logic flaws, variant patterns and overlooked attack surfaces that scanners miss.

Binary & Runtime

Reverse engineering of compiled binaries and dynamic instrumentation of running targets — enterprise products, mobile apps and closed-source software tested under real conditions with custom fuzzers and sanitizers.

AI-Native Methodology

Our AI engine drives every phase — pattern-matching across codebases, cross-referencing vulnerability classes, generating exploit variants and guiding evolutionary fuzzing across 500M+ iterations per campaign.

Audit
Fuzzing
PoC
Disclosure
Research Model

The Loop Is Closed

Martila's value is not just having ideas, or just having tools, or just writing disclosures. The differentiator is that the theory, the instrumentation, and the real findings reinforce each other.

From framework to finding

Martila's research practice is built around a simple principle: a methodology is only meaningful if it improves investigation quality on real systems. Internal analysis methods inform the tooling, the tooling generates investigation paths, the paths are validated manually and dynamically, and the validated results feed back into better research.

That creates a traceable loop from concept to evidence. It also changes the nature of the work: instead of asking only "what bug is here?", the investigation can ask "what structure is failing, what variants follow from that failure, and what higher-impact chain becomes possible?"

Operational flow

Research → tooling → proof
01

Research frame

Develop an explanatory model for how a target class fails, not just a checklist for what to grep.

02

Investigation paths

Turn the model into targeted analysis, ranking, fuzzing, variant search, and traceable hypotheses.

03

Validation

Manually review, dynamically validate, produce proof-of-concept artifacts, and check for exploit chains or sibling paths.

04

Disclosure and refinement

Report findings responsibly, archive results, and feed what was learned back into the research and tooling stack.

Security Advisories

Vulnerability Disclosures

A selection of our published findings and active responsible disclosure processes.

2026-02-25
Out-of-bounds write in RLE planar decode path CVE-2026-26965 FreeRDP
Heap buffer overflow in planar_decompress_plane_rle() — a malicious RDP server can overwrite an adjacent NSC_CONTEXT struct's function pointer with attacker-controlled pixel data, achieving full control-flow hijack on any connecting FreeRDP client. Up to 132 KB past buffer end.
High — CVSS 8.8 Disclosed
2026-02-25
Out-of-bounds write in GDI ClearCodec surface handler CVE-2026-26955 FreeRDP
Missing is_within_surface() validation in gdi_SurfaceCommand_ClearCodec() allows a malicious RDP server to corrupt an adjacent gdiGfxSurface struct's codecs* pointer — full RIP control demonstrated via indirect function pointer overwrite.
High — CVSS 8.8 Disclosed
2026-02-25
Smartcard NDR alignment padding triggers reachable assertion abort CVE-2026-27015 FreeRDP
Missing bounds check in smartcard_unpack_read_size_align() allows a malicious RDP server to crash the client via WINPR_ASSERT → abort(). Requires smartcard redirection enabled (/smartcard or /smartcard-logon).
Medium — CVSS 5.0 Disclosed
2025-xx-xx
Details pending publication CVE-2025-69953 TBD
CVE reserved — details withheld pending coordinated disclosure.
TBD In Progress
Research ongoing — new findings regularly added
Publications

Whitepapers

In-depth technical research from our vulnerability discovery and security engineering work.

Coming Soon
Paper #1 — Title TBD
Details to be announced.
2026 Pending
Coming Soon
Paper #2 — Title TBD
Details to be announced.
2026 Pending
Coming Soon
Paper #3 — Title TBD
Details to be announced.
2026 Pending
Services

Research-Powered Security Services

Every service we deliver is backed by the same AI methodology we use in our original research.

Research-Powered

Security & Compliance

Security by default. Our research methodology translates directly into deeper assessments, better detection and stronger defenses for your organization.

Learn more
Security-First

Dev, Build, Automate

From concept to completion with security embedded at every stage. We build software the way attackers think — so your product ships hardened from day one.

Learn more
Research-Powered

Vulnerability Research

Dedicated 0-day hunting in your critical dependencies. The same methodology behind our published CVEs, applied to your technology stack.

Learn more
Security & Compliance

Continuous Security Lifecycle

The same methodology we use to discover 0-days, applied to protect your organization.

01

Identify

Map your full attack surface — infrastructure, applications, APIs, mobile clients and third-party dependencies.

02

Assess

Combine automated scanning with manual expert analysis to uncover vulnerabilities that tools alone will never find.

03

Protect

Implement and validate fixes against real-world attack patterns — not just compliance checklists.

04

Monitor

Ongoing threat intelligence, continuous vulnerability scanning and alerting on newly disclosed CVEs affecting your stack.

Penetration Testing

  • Web & API Penetration Testing
  • Mobile Application Security (Android/iOS)
  • Internal & External Network Testing
  • Black Box, Grey Box & White Box

AppSec & Code Review

  • Source Code Audit (SAST)
  • Dynamic Application Testing (DAST)
  • Business Logic Analysis
  • CI/CD Security Automation

Infrastructure & Network

  • Architecture & Network Assessments
  • Hardening & Compliance Verification
  • Perimeter Security Review
  • Cloud Posture Management

Red Team & Simulation

  • Full Red Team Exercises
  • DDoS & Ransomware Simulation
  • Social Engineering (Phishing, Vishing, Smishing)
  • Physical Security Assessment

Continuous Monitoring

  • Threat Intelligence Feeds
  • SIEM Integration & Tuning
  • Vulnerability Tracking & Alerting
  • Incident Response Support

Vulnerability Research

  • 0-day Discovery in Your Stack
  • Custom Fuzzing Campaigns
  • Binary & Firmware Analysis
  • Responsible Disclosure Management
Development

Secure Development Life Cycle

Software built the way attackers think — hardened from the first line of code.

01
Analysis
Gathering information, analyzing data, determining feasibility
02
Design
Architecture planning, interface design, proof of concept
03
Development
Code creation, prototype building, documentation
04
Testing
Performance, code bugs, security misconfigurations
05
Deployment
Issue resolution, production setup, go-live
06
Maintenance
Operations, monitoring, continuous reviews
About

Not Just Another Security Firm

Founded in 2019 in Spain, Martila.iO was built on one belief: real security comes from understanding how software breaks — not from running tools someone else built.

Our team combines deep expertise across security research, software engineering and cloud infrastructure. We don't just assess your defenses — we push the boundaries of what's possible in vulnerability discovery, and that knowledge flows into every service we deliver.

2019
Founded
Spain
Headquarters
5+
Partners
M.IO
Technology Partners
Contact

Let's Talk

For vulnerability research, security assessments, or research collaboration.

hola@martila.io
Location Spain
PGP Fingerprint 4443 9063 86EB 0415 F542
881F 417D 1B80 CABF 0C31
Public Key Available on keyservers