Research
Security research,
published openly.
Reports, open methodologies, and articles from our researchers. It's how we think out loud about protecting Web3, in public.
AI Usage at Oak Security
Meet Hive. Human-led, multi-model security research.
Our continuously evolving proprietary AI harness combines independent discovery, adversarial validation, and threat corpora for multiple technology stacks. We use Hive in every audit, alongside a manual audit of every line of in-scope code and verification of all findings by at least one senior human security researcher.
How we use AIThe State of Web3 Security 2022 – Q3 2026
Nearly five years of data: 27,312 published audit findings from 22 firms, and 257 real-world exploit incidents worth US$9.69 billion in losses. Built with rekt.news, updated quarterly.
TRACE. Threat modelling for organisations without a perimeter.
Threat actors, Roles, Assets, Critical invariants, Edges. One method, applied across protocols, systems, and organisations. We built it through our Web3 work, but it fits any team that no longer has a clean security perimeter.
Articles
From our researchers
Hive: human-led audits with adversarial AI
How our proprietary multi-model AI harness combines independent discovery, adversarial validation, and threat corpora to reduce noise, with senior human review in every audit.
October 29, 2026 Web3 Security ReportThe audit gap, updated: Q3 2026 was the costliest quarter since Bybit, and the money came out of the supply chain
Our Web3 security dataset now runs through 30 September 2026: 27,312 audit findings, 257 incidents, US$9.69B in losses. Q3 brought US$1.07B in losses, half of it through two supply-chain compromises.
October 13, 2026 Web3 Security ReportThe audit gap, updated: Q2 2026 joins four years of data, and the quiet quarter ends
Our Web3 security dataset now runs through 30 June 2026: 25,706 audit findings, 237 incidents, US$8.62B in losses. Q1 looked like a rotation in attacker behaviour. Q2 ended that theory.
July 28, 2026 TRACEThe TRACE paper is out
Our threat modelling methodology, written up as a paper: why perimeter-era methods miss the failures that actually happen, and what TRACE does instead.
June 25, 2026 Operational securityMost Web3 losses don't start in the code
A perfectly audited contract won't help you if the deployer key leaks. Here's what an operational security review actually looks at.
June 4, 2026 ResearchThe State of Web3 Security 2022 – Q1 2026: six key findings
What 23,818 audit findings and 218 exploit incidents tell us about where Web3 actually loses money.
May 28, 2026 TRACEIntroducing TRACE: threat modelling without a perimeter
Why we built our own threat modelling methodology, what the five model objects are, and why it works beyond Web3.
May 20, 2026Looking for our audit reports?
Every final audit report is transparently published to our GitHub repository.
Published audit reports