Microsoft on Wednesday announced the acquisition of ReFirm Labs, a provider of security solutions for organizations using Internet of Things (IoT) and network edge devices.

Fulton, Md.-based ReFirm Labs was founded by former U.S. National Security Agency (NSA) hackers in 2017, producing security products for large enterprises and small-to-medium businesses. Its inception started earlier, in 2010, with the Binwalk Open Source project, designed to help security analysts extract firmware images from devices, according to a ReFirm Labs announcement.

ReFirm’s Web site is fairly upfront about its team coming from the NSA, per a company blurb:

Our team is composed of former offensive cyber professionals from the U.S. National Security Agency (NSA), where we specialized in the weaponization of device vulnerabilities. When IoT adoption exploded across the commercial sector, we knew that more businesses than ever were exposing themselves to attacks — so we turned our offensive cyber innovations into proactive tools for corporate leaders.

Microsoft is buying ReFirm Labs “to enrich our firmware analysis and security capabilities across devices that form the intelligent edge, from servers to IoT,” according to David Weston, Microsoft’s director of enterprise and OS security, in the announcement. To that end, it’s adding ReFirm Lab’s Centrifuge firmware platform, he added.

Centrifuge was replaced with Binwalk Enterprise, an analysis product designed for use by larger organizations such as telcos and device manufacturers, according to a January ReFirm Labs announcement. Binwalk Teams is the company’s other product for small and midsize organizations. The product differences have to do with things like the availability of policy and compliance reporting capabilities, and more, as described in this product comparison sheet (PDF).

It’s not clear from the company announcements whether ReFirm Labs’ products will continue to be sold. Microsoft’s announcement suggested they will be folded into Microsoft products. The deal’s terms weren’t described.

Weston described the ReFirm Labs acquisition as being synergistic to Microsoft’s earlier acquisition a year ago of CyberX, which built security solutions for both IoT devices and the operational technology used in industrial systems. Microsoft was a partner with CyberX before acquiring the company, and CyberX’s technology was later added to Microsoft’s Azure Defender for IoT security solution.

The ReFirm Labs acquisition will be used to help both builders of IoT and Edge devices and their customers, Microsoft contended. It offered the following illustration to that effect:

Microsoft explained in a video that IoT device builders are unintentionally shipping devices with software exposed to “known threats” that then get sold to businesses. Those businesses also are unaware of the flaws, mostly because it’s difficult to detect vulnerabilities at the firmware level. The ReFirm Labs addition will bolster Azure Defender for IoT to detect the problems, adding “firmware protection, certificates and device updates” capabilities. Device builders can address vulnerabilities early on by uploading their firmware for analysis in Microsoft’s cloud.

The acquisition adds to Microsoft’s general efforts to address security issues at the firmware level. Other efforts along those lines, according to the announcement, include Microsoft’s Pluton security processor, Secured-core PCs and Microsoft’s emerging Windows Server 2022 Secured-core server approach.

The Acquisition at a Glance

Microsoft announced in August 2019 that it had acquired JClarity, a London-based Java performance company and a leading contributor to the AdoptOpenJDK project, for an undisclosed sum. The stated goal was to improve the performance and experience of Java workloads running on Microsoft’s Azure cloud platform.

John Montgomery, Microsoft’s VP of Program Management for Developer Tools and Services, announced the deal in a blog post, framing it as a direct investment in the Java developer community:

“Microsoft Azure and JClarity engineers will be working together to make Azure a better platform for our Java customers and internal teams, improving the experience of the platform for Java developers and end-users. The team, formed by Java champions and data scientists with proven expertise in data-driven Java Virtual Machine (JVM) optimizations, will help teams at Microsoft to leverage advancements in the Java platform.”

— John Montgomery, VP of Program Management, Microsoft Developer Tools and Services

Who Is JClarity?

JClarity was founded by Java champions — recognised community leaders with deep expertise in the Java ecosystem — and data scientists specialising in JVM performance analysis and optimisation. The company built commercial Java performance tooling and became one of the most active contributors to AdoptOpenJDK, an open community project that produces freely available, production-quality OpenJDK binaries for a wide range of platforms.

OpenJDK itself is the free and open-source reference implementation of the Java Platform Standard Edition. AdoptOpenJDK filled a gap left by Oracle’s 2018 changes to its JDK licensing model by offering build pipelines and binary distributions for Linux, Windows, macOS, and other platforms — without licence restrictions for production use.

Microsoft’s Pre-existing Java Commitment

The JClarity acquisition was not Microsoft’s first move toward the Java ecosystem. Key milestones before the deal include:

• June 2018: Microsoft became a platinum-level sponsor of AdoptOpenJDK, funding the project’s build and test infrastructure through at least 2020.
• Visual Studio Code Java support: Microsoft worked with the AdoptOpenJDK project to build and ship a Java installer integrated with its popular lightweight code editor, Visual Studio Code.
• Azure HDInsight: Microsoft’s open-source analytics service on Azure runs on Java-based technologies, including Apache Hadoop and Apache Spark.
• Minecraft: The flagship Microsoft gaming title — acquired as part of the Mojang purchase in 2014 — is written in Java.
• Enterprise Java customers: At the time of the acquisition, major Azure customers including Adobe, Daimler, and Société Générale were running significant Java workloads on the platform.

What Changes for JClarity Customers?

JClarity CEO Martijn Verburg transitioned to a role as Java Principal Engineering Group Manager at Microsoft following the acquisition. He emphasised continuity for existing customers and ongoing community involvement:

“It’s always been JClarity’s core mission to support the Java ecosystem. We started with our world-class performance tooling and then later became a leader in the AdoptOpenJDK project. Microsoft leads the world in backing developers and their communities, and after speaking to their engineering and program leadership it was a no-brainer to enter formal discussions. With the passion and deep expertise of Microsoft’s people, we’ll be able to support the Java ecosystem better than ever before.”

— Martijn Verburg, former JClarity CEO, Java Principal Engineering Group Manager at Microsoft

Verburg confirmed that JClarity would continue contributing to Java community projects post-acquisition, and that the company’s support team would contact existing customers directly to address questions about ongoing product and support arrangements.

Why This Matters for Java on Azure

Bringing JVM performance engineers and Java champions in-house gives Microsoft a direct pathway to influence JVM tuning at the platform level — optimising how the JVM behaves on Azure’s underlying infrastructure rather than relying solely on upstream OpenJDK improvements. This matters for enterprise workloads where garbage collection pauses, JIT compilation behaviour, and memory footprint directly affect service-level objectives.

The acquisition also strengthens Microsoft’s upstream credibility. Contributions to AdoptOpenJDK and OpenJDK itself signal to the enterprise Java community that Azure is a first-class destination for Java workloads — important positioning as AWS and Google Cloud had already established strong Java ecosystems of their own.

The Broader Java Developer Landscape

According to a SlashData report cited at the time of the acquisition, approximately 7.6 million developers worldwide actively coded in Java, making it one of the largest developer communities globally. For a cloud platform competing for enterprise workload migrations, meaningful investment in that ecosystem carries clear strategic weight.

Key Takeaways for DevOps Teams

• JVM expertise embedded in Azure: Microsoft now has in-house Java champions focused on platform-level JVM optimisation, which should translate to improved tooling and guidance for Azure-hosted Java applications.
• AdoptOpenJDK continuity: JClarity’s contributions to the AdoptOpenJDK project were set to continue, maintaining the availability of free, production-ready OpenJDK builds for multiple platforms.
• Enterprise Java on Azure: Teams evaluating cloud providers for Java workloads — particularly those running Spring Boot, Jakarta EE, or big-data frameworks on the JVM — gained a clearer signal of Microsoft’s long-term commitment to the platform.
• Existing JClarity customers: Support and product continuity were explicitly addressed, with the JClarity support team committed to reaching out directly to customers.