PROVELABS · SECURITY BY PROOF
Security you can trust,
backed by proof.
ProveLabs is a security company that builds on formal verification to deliver code security analysis, cryptographic module development, security consulting and security training.
About
Calling something “secure”
should come with evidence.
ProveLabs treats security as a matter of proof, not assertion. We verify software vulnerabilities mathematically, build cryptographic implementations to national validation standards, and raise the security capability of organizations and people through field experience.
Our team combines more than ten years of hands-on security work at public enterprises with research in formal verification, building evidence-based security from products to people.
- Company
- ProveLabs (프루브랩스)
- Representative
- Woohyun Choi
- Business
- Code security analysis · Cryptographic module development · Security consulting · Security training
- Main product
- Prove — formal-verification-based security analysis for Python code (provelabs.kr)
- Address
- Room 320, Building B, Gwangju Institute of Science and Technology (GIST)
123 Cheomdangwagi-ro, Buk-gu, Jeonnam-Gwangju Integrated Special City, Republic of Korea - Business reg. no.
- 827-10-03003
Business
One principle, four businesses
We apply the same principle — security that can be proven — to software, cryptographic implementations, organizations and people.
Code security analysis
We find vulnerabilities in Python code with formal verification and issue machine-checked proofs for code that is safe.
More about Prove 02Cryptographic modules
We develop software cryptographic modules for embedded systems and handle KCMVP testing and validation.
Learn more 03Security consulting
Source code security review, control-system (OT/ICS) security, certification readiness and digital forensics, grounded in field experience.
Learn more 04Security training
Secure coding, security of AI-generated code and hands-on cryptographic module training for developers and security staff.
Learn moreFlagship product · Prove
Not a scan.
A proof.
Upload code and get a mathematical proof of whether it is safe. Prove finds vulnerabilities that pattern-matching tools miss, and every safe verdict comes with a certificate that a third party can re-verify.
- Formal verification engine — verifies execution paths mathematically, 2.92 s per function on average
- Machine-checked certificates — zero unproven steps or assumptions under an independent checker
- 98 CWEs — SQL and command injection, deserialization, SSRF, XSS, cryptographic misuse and more
- Real-world results — 12 zero-days found and reported in global open source (allenai CWE-79, OpenMMLab CWE-502 and others)
False positive rate Lower is better
222 CVE-derived files, measured under the same conditions
- Analyze code
- Prove
- Simulate attacks
- Verdict
- Certificate
* Projects listed are ones where we found and reported vulnerabilities; this does not imply sponsorship or partnership.
Cryptographic modules
From module development to KCMVP validation
We design and implement software cryptographic modules for MCU-based embedded products, and provide the documents and test-lab support needed for KCMVP (Korea Cryptographic Module Validation Program) testing in one package.
Algorithms in scope
Operating environments
Porting, building and testing on STM32-family MCUs with the FreeRTOS native API and CMSIS-RTOS2. Scope is set to the MCU and RTOS combination the customer specifies.
Deliverables
- Cryptographic module and source code for each operating environment
- Build, installation and integration guides and API documentation
- Development and functional test results, and the full KCMVP submission package
- Supplementary materials and technical responses for the test lab
- 01
Scope and environment
Target board, build environment, API and acceptance criteria
- 02
Design and development
Module structure and API design, algorithm implementation, RTOS integration
- 03
Development testing
CAVP test vectors, functional and integration tests, entropy analysis
- 04
KCMVP submission
Module description, design documents, operating environment and test procedures
- 05
Testing and validation
Answering test-lab queries, source fixes, retesting
Security consulting
Assessment backed by field-proven experience
Source code security review
We combine the Prove engine with expert review to find vulnerabilities, and support remediation and re-verification.
OT · ICS security
We assess risks in control-system (SCADA) environments such as power and energy, and propose network segmentation and access-control improvements.
Certification readiness
We help analyze requirements and prepare submission documents for security certifications such as CC and KCMVP.
Incident response readiness
Drawing on ransomware response experience, we review detection and response procedures and build training scenarios with you.
Digital forensics
When an incident occurs, we collect and analyze digital evidence from PCs, servers and logs to establish the cause and extent of the damage, and deliver an analysis report with measures to prevent recurrence.
Security training
Not just safer tools — safer people
Hands-on courses built from our research and field work, tailored to each organization.
Trust and team
Proven technology, proven team
Paper “PROVE — Evidence-carrying static analysis for Python”
Under review at Computers & Security (Elsevier)
Korean government Pre-Startup Package
Advanced to the final round
Zero-day vulnerabilities in global open source
12 found and reported
PhD in AI · 10+ years in public-enterprise security · ICS/SCADA security · WannaCry incident response
PhD candidate in energy AI · Korean national team at Locked Shields · CC certification · public enterprise and large-company experience
PhD candidate in Cultural Studies · 10+ years planning national R&D projects · commercialization and operations
Looking for a security partner?
We welcome inquiries about Prove, cryptographic module development, security consulting and training.