Systems, methods, and software can be used to detect security risks in binary software code. In some aspects, a computer-implemented method comprises: receiving, at an electronic device, a set of binary software code to be loaded onto the electronic device; disassembling, by the electronic device, the set of binary software code into a set of assembly code; determining, by the electronic device, a number of occurrences of an assembly instruction in the set of assembly code; and determining, by the electronic device, whether the set of binary software code has a security risk based on the number of occurrences of the assembly instruction.