Ormandy is credited with discovering severe vulnerabilities in Libtiff, Sophos' antivirus software and Microsoft Windows. With Natalie Silvanovich he discovered a severe vulnerability in FireEye products in 2015.
His findings with Sophos' products led him to write a 30-page paper entitled "Sophail: Applied attacks against Sophos Antivirus" in 2012, which concludes that the company was "working with good intentions" but is "ill-equipped to handle the output of one co-operative security researcher working in his spare time" and that its products shouldn't be used on high-value systems.
In February 2017, he found and reported a critical bug in Cloudflare's infrastructure leaking user-sensitive data along with requests affecting millions of websites around the world which has been referred to as Cloudbleed (in reference to the Heartbleed bug that Google co-discovered).
- Greenberg, Andy (15 July 2014). "Meet 'Project Zero,' Google's Secret Team of Bug-Hunting Hackers". Wired.com. Retrieved 4 January 2015.
- Constantin, Lucian (30 December 2014). "Hey, devs! Those software libraries aren't always safe to use". Computerworld. Retrieved 5 January 2015.
- Greenberg, Andy (4 August 2011). "Google Researcher Exposes Flaws In Sophos Software, Slams Antivirus Industry". Forbes. Retrieved 15 August 2016.
- Keizer, Gregg (23 May 2013). "Google engineer bashes Microsoft's handling of security researchers, discloses Windows zero-day". Computerworld. Retrieved 5 January 2015.
- Ormandy, Tavis (15 December 2015). "Project Zero: FireEye Exploitation: Project Zero's Vulnerability of the Beast". Project Zero. Retrieved 11 May 2017.
- Tung, Liam (6 November 2012). "Google security researcher: Keep Sophos away from high value systems". CSO Online. Retrieved 5 January 2015.
- Evans, Chris (25 August 2014). "Project Zero: The poisoned NUL byte, 2014 edition". Project Zero. Retrieved 11 May 2017.
- Goodin, Dan (11 January 2016). "Google security researcher excoriates TrendMicro for critical AV defects". Ars Technica. Retrieved 4 February 2016.
- "Incident report on memory leak caused by Cloudflare parser bug". Retrieved 23 February 2017.