A system and method is disclosed for providing security in virtual function calling. During a build process a program code is analyzed to identify one or more call sites used to facilitate a call to a subroutine associated with a declared object type. One or more trusted vtable pointers to a respective subroutine is determined, and the program is configured, via the build process, to detect, at an execution time, an initiation of a virtual call at a call site, verify whether a vtable pointer used in connection with the call site is associated with at least one of the trusted vtable pointers, and, if verified, facilitate the virtual call using the call site. If the vtable pointer cannot be verified then the virtual call is aborted.