CertiK

Three businesses sit at different distances from the models, and the blend lands in the middle. The audit practice, which independent reporting places at roughly half of revenue, is led by security engineers performing manual review. Formal verification supplies mathematical proof rather than learned inference, and proprietary tooling automates vulnerability detection and prioritizes findings. Skynet scores more than 17,000 projects continuously.

Its published methodology describes weighted aggregation across named on chain and off chain indicators, with algorithms, machine learning and AI stated as incorporated to reduce error rather than as the engine itself. SkyInsights depends on the models outright, since entity attribution and behavioral classification across wallets and transactions is model work, as it usually is in blockchain intelligence. Strip the models and an audit firm and a weighted scoreboard remain.

A human layer is named and placed in the audit path and no equivalent exists on the scoring path. Every audit is stated to include a thorough manual assessment by security professionals alongside the automated engines, which is a described position in the workflow rather than an assurance.

Skynet runs continuously and publishes scores without any described review step, threshold or approval before a score changes, and those scores are consumed by wallets, exchanges and listing decisions at the point where they affect whether a project reaches users.

The mitigating fact, and it is a real one, is that the methodology page states its own limitations plainly, including that the assessment is external, cannot see private internal security practices or closed source components, and represents a point in time.

The methodology is published in detail, and evidence about its quality is absent. The scoring framework is set out to component level across six named categories. Audit coverage is measured through source lines of code and similarity mapping, and findings are parsed into structured severity and remediation data. Audit history is weighted by the credibility and frequency of the originating auditor.

Token behavior scanning, repository activity metrics and website vulnerability scanning complete the sub methods. A published limitations section adds to the transparency. What is missing is the one thing this firm is well placed to supply: a back test showing whether high scores were followed by fewer exploits than low scores. There is no accuracy or calibration figure, the machine learning components get a single sentence, and there is no ISO 42001 certification.

The strongest evidence is a payout from a third party. CertiK was awarded Sui's top bug bounty of $600,000 for uncovering a critical vulnerability with the potential to shut down the network. That is a customer confirming a finding with its own money rather than a vendor describing its own value. Around it sits substantial named work: formal verification of the TON network's consensus module, and critical issues identified and resolved for SEI Protocol before mainnet launch.

CertiK also monitors Bitget Wallet across more than 130 blockchains. Published scale is consistent across sources at more than 5,500 audits and more than 17,000 projects under continuous scoring. What is missing is any evidence about the scoring product's predictive quality, which is a different question from the audit track record.

The dual position is commercially explicit. The firm audits projects, scores those same projects on a public leaderboard, and sells the scored projects promotional placement on the scoring surface. The placement is described as helping qualified projects showcase verified security and transparency signals across those surfaces and in selected co marketing moments. Alongside that sits the published assertion that the assessment is independent and unaffected by project relationships.

A second overlap runs in parallel: the score aggregates audit reports produced by other firms and weights them by the originating auditor's credibility, so a competitor's work is graded by a competitor. Nothing describes any separation between the audit, scoring and placement businesses. Nor does anything say whether a paying project's score is computed by people insulated from that relationship, or what a project forfeits by declining to buy placement.

There is no public data processing agreement, subprocessor list or retention schedule, and a privacy policy is referenced only through the site's cookie notice. The gap matters more than the product description suggests. SkyInsights aggregates, classifies and scores wallet addresses and transactions and performs entity attribution, which under most data protection regimes is processing that can identify a person even though the underlying ledger is public. For a financial institution buying this for screening, nothing states what is retained, for how long, or whether attribution outputs about an individual are shared across customers.

The certifications are real, there is a dedicated trust and security page, and the firm discloses two scoping limits itself. ISO 27001 and SOC 2 Type 1 and Type 2 examinations are held. A public bug bounty program invites external researchers, which is a working security practice rather than a document. The first limit is that the examinations are stated as covering the platform hosting the services rather than the organization as a whole.

The second is that the report and certificate are available on request rather than published, so a buyer cannot see the scope, the controls or the exceptions without entering a sales process. Some vendors publish group wide scope and the implemented proportion of each control set. The candor about scope matters, since a badge row that hid the boundary would read stronger and mean less.

The firm holds no financial license, which is the correct posture for a technology supplier. Its ISO 27001 and SOC 2 examinations are technical conformity assessments rather than regulatory standing. No sandbox participation, supervised program or regulator engagement is published.

The firm publishes guidance for other companies on obtaining SOC 2 and ISO 27001 credentials to satisfy banks and enterprise procurement, while its own examinations are scoped to its hosting platform rather than the organization.

No fairness testing or differential outcome analysis is published, and the published methodology contains a structural tilt that is visible without any testing. Among the inputs to what is presented as a security score are a funding profile rated on capital raised, funding rounds and investor reputation, and a team identity component assessed through open source intelligence and third party verification.

A well funded project with recognisable investors therefore scores higher on security than an equally secure project without them, and the score is consumed by exchanges, wallets and users deciding whether to engage. Nothing states the weighting these components carry or whether the score has been examined for that effect.

The disclaimers are clear, and there is still no route for anyone harmed. The scoring methodology states that the assessment is not financial or investment advice, is limited to externally observable information, and represents a point in time. None of that is recourse. A project scored poorly on components it disputes has no stated appeal or correction path, and a user who relied on a high score before an exploit has nothing.

No error rate, remediation commitment or liability position is published for either the scoring product or the audit engagements. For a firm whose entire proposition is that its assessment can be relied upon, the absence of a stated position on being wrong is conspicuous.

No model provider, family, version or hosting arrangement is disclosed. The published material states that algorithms, machine learning and AI are incorporated into the scoring processes and that proprietary AI tooling assists vulnerability detection during audits, and identifies none of it further. The hosting platform behind the services is named, but that disclosure does not extend to the models.

The integration story is told by category rather than by counterparty. SkyInsights runs on a real time API framework and is presented as integrating with anti money laundering and counter terrorist financing systems, transaction monitoring engines and security infrastructures, which is the correct set of destinations for the product. Skynet offers API integrations, and its risk feeds are consumed by wallets, dashboards and exchanges.

A public partner API portal carries the scoring methodology documentation. No specific transaction monitoring platform, case management system or core system is named as a supported integration, and no integration count is published.

No hosting regions, residency commitments or tenancy model are published. Delivery is through real time APIs and public leaderboards. The platform hosting the services is named in the certification statement, but nothing says where that platform runs. An institution using the screening product inside a jurisdiction with data localization requirements would find nothing to rely on.

CertiK publishes no pricing for any of its three product lines. One disclosure sits against that: core Skynet analysis tools, leaderboards and dashboards are stated to be freely accessible, which tells a buyer something real about how the scoring product is distributed. Third party reporting places audit engagements between roughly ten thousand and over $300,000 depending on complexity. That range does not appear in the vendor's own material. The promotional placement product carries no published price either, which matters given that the same firm scores the projects buying it.

Buyer types are named explicitly, and the evidenced customers sit on one side of them. SkyInsights is stated as serving exchanges, decentralized finance protocols, financial institutions and crypto custodians for regulatory compliance and risk control, which is institutional breadth on paper. The customers actually named are crypto native rather than institutional. They include the TON network, whose consensus module was formally verified, and SEI Protocol before its mainnet launch.

Sui is named, and so is Bitget Wallet across more than 130 blockchains. Scale is substantial on both sides, with more than 5,500 audits completed and more than 17,000 projects covered by continuous scoring. No bank, custodian or asset manager is named as a customer.