Merger Strengthens AdaCore’s Reach in C and C++ Static Testing for Embedded Systems
AdaCore plans to merge with an application security testing company backed by the same venture capital fund to boost its static analysis tools for the C and C++ programming languages.
The New York software development tool provider said Washington D.C.-area CodeSecure’s strength will complement AdaCore’s historic specialization in the Ada and Rust programming languages. AdaCore Chief Product and Revenue Officer Quentin Ochem said providing static analysis around safety-critical applications fills a significant gap in AdaCore’s offerings and will boost security verification.
“We didn’t have a sincere, prosperous solution for static analysis and CodeSecure just seemed to be the perfect company to partner with to complete the portfolio,” Ochem told Information Security Media Group.
CodeSecure and AdaCore each are companies backed by Battery Ventures, a technology-focused investment firm active since the early 1980s. CodeSecure has existed in its current form since September 2023, when Battery Ventures carved it out of GrammaTech. Battery in March 2024 bought a majority stake in AdaCore in a deal reportedly worth more than $100 million. AdaCore CEO Franco Gasperoni will become CEO of the joint organization (see: Battery Ventures Buys GrammaTech’s Application Security Unit).
How AdaCore, CodeSecure Will Come Together
AdaCore historically focused on compilers and tools tailored to the Ada programming language. It expanded to include other languages but Ochem said it lacked a robust static analysis solution for widely used languages like C and C++. This gap became increasingly significant, as customers in high-assurance domains demanded comprehensive toolchains capable of ensuring safety and security.
“What we want to do is to be the major player in the embedded systems space, if you will, and provide software solution for developers there,” Ochem said. “So you have the compilation, which we used to do, but then you have analysis tools that are also required.”
CodeSecure supports a wide variety of programming languages and has built tools that are tailored to deep analysis, a critical need for safety-critical embedded systems, Ochem said. AdaCore’s strength is compilation and dynamic analysis. Combining forces will allow a unified suite of development tools across the software lifecycle, from code writing to verification.
“If you go back to those programming languages that we care about, the key one in our embedded space today are C/C++, Ada, Rust, so on,” Ochem said. “CodeSecure has a very strong C++ story for static analysis, which we don’t, so that plugs very well there. And then they also have additional support for the languages that right now we are maybe less involved with.”
Ochem said the long-term vision is to create a cohesive portfolio that harmonizes user interfaces, unifies results formats through common industry standards like SARIF and potentially integrates their back-end static analysis engines at a deeper level. These advanced integration steps aim to improve tool power, speed, accuracy and ease of adoption across both Ada and C/C++ environments, according to Ochem.
The long-term vision is “to merge those two offerings into one consistent portfolio of technologies,” Ochem said. “If you look down the line, we’re going to act eventually as a combined entity that provides a cohesive offering.”
Why Broadening Language Support Is Vital in Embedded Systems
In sectors such as aviation or defense, software bugs can result in catastrophic failures. That puts enormous pressure on AdaCore’s customers to minimize software defects, Ochem said. Static analysis tools help developers detect vulnerabilities or flaws before code is even executed, acting as an essential part of the broader software verification toolkit, he said.
“If you look at the consequences of errors, they can be dramatic,” Ochem said. “If it’s a safety issue, you can have a plane that falls because of the software errors. If it’s a security issue, it’s an attacker that gets into a system and then takes over. Our customers are under very high pressure, to reduce those hours as much as they can. And for that, they need an array of tools. Static analysis is one of the key aspects.”
Broader language support is important, as real-world embedded systems often involve mixed-language codebases, Ochem said. A core embedded system might be written in Rust or C++ and support Python or JavaScript scripts. The deal means users will be able to see analysis results from different languages in a consistent format and share workflows.
“I would say that every single one of our customers have C/C++ somewhere,” Ochem said. “And within that, a lot of them actually mix Ada, C, and C++ to some respects. So having a coherent solution that can look at problems on both edges is very, very valuable.”
Static analysis is just one part of a wider verification strategy, he said. AdaCore also supports dynamic testing and formal proof techniques, which go a step further by mathematically verifying the absence of certain categories of bugs, Ochem said. These methods require specialized programming practices and tools which allow developers to prove correctness rather than merely test for errors, Ochem said.
“There’s a range of verification methods for security, and sometimes there’s a lot of focus on static analysis together with testing,” Ochem said.