Binarly Platform 3.5 Adds Java Support, Enterprise YARA Integration

Binarly, a software supply chain security company based in Santa Monica, released version 3.5 of its Transparency Platform on November 5th, marking the first time the company's cryptographic analysis engine can scan Java archives and JVM bytecode without requiring access to source code. The update addresses a longstanding gap in visibility: organizations building products with Java dependencies—whether those libraries sit alone or embedded inside Docker containers and firmware—can now identify exactly which cryptographic primitives their systems rely on, a capability that previously required manual code review or source access.

The Java support covers four major library ecosystems: Bouncy Castle, Apache Commons, Google Tink, and Guava. The engine uses Code Property Graph analysis to track how data flows across functions, which helps eliminate false positives that plague less sophisticated scanning tools. Every finding gets mapped to NIST IR 8457 categories, giving security teams a standardized way to measure their readiness for post-quantum cryptography migration—an increasingly urgent concern as quantum computing advances. Android package analysis is scheduled to arrive later in 2025.

The second major pillar of the 3.5 release tackles an operational problem that has plagued security teams for years: managing YARA rules at enterprise scale. YARA is the industry standard for signature-based threat detection, but maintaining consistency across teams, suppliers, and large portfolios has historically meant wrestling with syntax drift, rule sprawl, and enforcement gaps. Binarly's solution is a governed pipeline that includes an interactive YARA Playground for rule development, a Rules Manager with granular role-based access controls, and a real-time YARA-X engine built in Rust that validates rules before they go live. The result is a single source of truth where product security teams, third-party risk management groups, and procurement functions can all drive consistent detections and make evidence-based decisions.

Alex Matrosov, CEO and Head of Research at Binarly, framed the release as solving two of the hardest blind spots in modern product security: understanding what's actually inside Java stacks and operationalizing YARA rules consistently across complex environments. The company positioned itself as the first to build tooling that connects data from existing threat-intelligence feeds with both cryptographic visibility and scalable threat-hunting capabilities.

Beyond Java and YARA, the 3.5 release includes several operational upgrades. Custom Rule Management lets security teams define their own detection logic using YARA and FwHunt rules—the same internal schema Binarly uses for its own vulnerability research. This bridges the gap between research and product security, enabling teams to write bespoke checks for vendor risk, hard-coded keys, or policy enforcement. Organization Quotas simplify license management with centralized allocation across distributed groups. Triage enhancements add assignable statuses, threaded comments with Markdown support, and dynamic charts. Backend upgrades deliver faster performance, broader Android handling, and deeper extraction of cryptographic artifacts ranging from JARs to UEFI Secure Boot keys.

For procurement and third-party vendor risk teams, Binarly claims the platform delivers measurable improvements in vendor assessment workflows through private threat-intelligence ingestion, scoped rule enforcement, and transparent, evidence-backed risk reporting. Security teams benefit from faster rule validation, consistent detections, and streamlined triage, while the company argues the platform lowers the hidden operational costs that typically burden large-scale YARA programs. The platform now spans firmware to JVM bytecode, built by security research experts to give defenders a unified view of vulnerabilities, cryptographic posture, and reachability across complex software ecosystems.