AdaCore
Safety-critical software toolmaker combining Ada/SPARK formal verification with the CodeSonar/CodeSentry static-analysis and binary SCA platform.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
AdaCore, founded in 1994 by NYU faculty spun out of the GNAT compiler project, has spent three decades building development and verification tools (GNAT, SPARK formal-methods, GNATcoverage) used to certify software in avionics, defense, automotive, rail, and space systems. In June 2025, Battery Ventures-backed AdaCore merged with CodeSecure — the company formed in 2023 when Battery Ventures carved GrammaTech’s application-security testing line (CodeSonar SAST and CodeSentry binary software composition analysis) into a standalone business. The combined company operates under the AdaCore brand, with dual headquarters in Paris, France and New York.
The merger pairs AdaCore’s formal-verification heritage with CodeSonar/CodeSentry’s static and binary analysis, giving the combined platform reach across both source-available and third-party/legacy binary code — a combination aimed squarely at safety-critical industries where defects carry physical-safety as well as data-security consequences. Vendor-published customer lists (not independently confirmed) name aerospace and defense primes including Airbus, Boeing, Lockheed Martin, Northrop Grumman, BAE Systems and NASA, plus automotive names such as BMW, Hyundai, Denso, and Rivian, alongside medical-device makers.
Both predecessor companies were backed by growth-equity firm Battery Ventures, and CodeSonar’s lineage includes long-documented use in FDA medical-device review and DO-178C-relevant avionics software analysis. The combined entity is a genuine, currently operating company rather than a defunct or fully absorbed brand — it kept its own name and leadership (AdaCore CEO Franco Gasperoni leads the merged firm) rather than disappearing into an acquirer.
Innovation Matrix Assessment
The 2025 merger of CodeSonar/CodeSentry static and binary analysis with AdaCore's formal-verification (SPARK) tooling is a meaningful integration effort, combining two previously separate analysis disciplines into one platform.
Addresses a high-stakes need in safety-critical engineering organizations (aerospace, defense, automotive, medical device, rail) where undetected code defects carry physical-safety as well as breach risk — a distinct and durable operational value proposition.
Thirty-year operating history with long-documented relationships at major aerospace/defense/automotive primes and backing from growth-equity firm Battery Ventures across two linked deals (2023 carve-out, 2025 merger); momentum reflects legacy relationships more than new high-growth adoption.
Pairing formal verification with traditional SAST/binary SCA is a relatively rare positioning versus the mostly generic SAST/SCA market, but it serves a specialized, regulation-driven niche rather than disrupting mainstream AppSec broadly.
Long operating history in certified domains (FDA medical-device software review, avionics-adjacent certification work per third-party sources) offers real-world proof points, though recent, specific independent efficacy data was not located in this research.
Safety-critical software assurance is a durable, regulation-driven requirement (DO-178C, IEC 62304, ISO 26262) unlikely to diminish, and the 30-year track record signals institutional resilience.
Why CISOs Should Care
For organizations building safety-critical or regulated embedded software, it combines source-code static analysis, binary/third-party component scanning, and formal verification in one lineage — reducing the need to stitch together separate tools for certification evidence.
What Makes It Different
Few vendors combine formal-methods verification (SPARK) with conventional static and binary analysis under one roof; most AppSec vendors focus solely on web/cloud-native code rather than embedded, safety-critical systems.
The Matrix Verdict
65/100 — INCREMENTAL INNOVATOR
Incremental-to-Meaningful: a credible, long-established player with real customer history and a genuinely differentiated niche (safety-critical software assurance), but its market is specialized and growth evidence is based on legacy relationships rather than fast new adoption.
Editorial Note: Claims vs. Verified Findings
Named customer lists (Airbus, Boeing, Lockheed Martin, NASA, BMW, Hyundai, etc.) are vendor-published 'partial lists' and were not independently confirmed; deal values for the 2023 carve-out and 2025 merger were not disclosed in any source found.
Sources
Alternatives to AdaCore
ThreatLocker
CISO ReviewedZero Trust endpoint protection platform that blocks unknown applications by default through allowlisting, ringfencing, and storage control.
Endor Labs
Reachability-based software composition analysis that filters open-source dependency risk down to what code paths are actually exploitable.
Socket
A software supply chain security platform that combines automated dependency analysis with human verification to catch malicious and…
JFrog
Public software supply chain security platform (Xray plus Advanced Security) that scans binaries and artifacts end-to-end from the…
Apiiro
Builds a continuous 'code risk graph' that maps code, developers, and cloud deployment to prioritize AppSec findings by…
ArmorCode
Tool-agnostic ASPM layer that correlates findings from 300+ existing security tools into one prioritized backlog, without running its…