Strig

What Strig is

Strig is a firmware and embedded software security platform that records build activity and turns it into risk findings and signed audit evidence. It tracks inputs, compilation and linking events, and outputs, then brings static analysis, software composition analysis, SBOM generation, CVE tracking, and binary analysis together in a report and release gate. Its CycloneDX SBOMs are generated from compiled source and binaries, and it flags undeclared components. Teams can compare builds to identify release changes, including dependency updates, hardening flags, and findings that have been resolved. Policy thresholds determine a pass or fail verdict and a CI exit code.

Strig can capture builds through systems that invoke compiler and linker commands, including Make, CMake, Bazel, Yocto, and Ninja. It can also ingest findings from existing tools. Supported standards and guidance include SEI CERT C/C++, MITRE CWE, MISRA C:2025/C++:2023, OASIS SARIF 2.1.0, and the OpenSSF Compiler Hardening Guide. Deployment choices are SaaS, on-premise, and fully air-gapped. For on-premise and air-gapped scans, Strig says it blocks its own network access and keeps source, binaries, and build records inside the customer network. It produces evidence for assessors, but does not certify customers.

Who it suits

Strig is aimed at firmware and embedded software teams, including R&D, DevSecOps, product security, CISO, quality, and compliance roles. It suits teams that need to review build security, compare releases, and produce evidence for assessors.

Limits

Strig is licensed per environment, with price depending on build volume and deployment model. The operational details for air-gapped vulnerability-data updates and offline licensing are still being finalized.

Getting started

1. Visit the Strig website.
2. Contact the company to discuss build and compliance requirements or request pilot access.
3. Choose a deployment model: SaaS, on-premise, or fully air-gapped.
4. Use a supported build system that invokes compiler and linker commands, such as Make, CMake, Bazel, Yocto, or Ninja.
5. Arrange licensing based on environment, build volume, and deployment model.

Verdict

Choose Strig if your firmware or embedded team needs build analysis, release gates, and signed evidence, with deployment options that include on-premise and air-gapped use. Look elsewhere if you need a product that certifies customers; Strig says it provides evidence for assessors but does not certify.