Why Your SCA is Always Wrong

A breakdown of why your SCA results are always so full of false positives (and sometimes false negatives), and why treating source code as a first class citizen can lead us to the solution.

Endor Labs Named 2023 SINET16 Innovator Award Winner

Combining the Exploit Prediction Scoring System (EPSS) with reachability analysis to optimize your vulnerability management program

In a previous post, we surveyed some of the available tools for vulnerability management, the EPSS among them. In this article, we are going deeper on it and also explore how to use the EPSS alongside a reachability analysis tool.

Introducing SCA reachability analysis for Python, Go, and C#

90% of code in modern application is open source, yet only 12% of that code is actually used. Reachability analysis lets us prioritize the risks that can actually impact our applications.

The Open Source Security Index Top 5

What’s the best of the best when it comes to open source security tools?We’ve previously talked about the OpenSSF Scorecard, which gives developers a high-level snapshot of the security of any given open source project. But in this post, we’ll talk about a related project, the Open Source Security Index (OSSI), which does something slightly different and complementary.

Faster SCA with Endor Labs and npm workspaces

As projects grow larger and more complex, developers face challenges in maintaining a clean and efficient development workflow. Fortunately, npm workspaces offer an essential solution to streamline JavaScript development. In this blog post, we will explore the concept of npm/yarn workspaces, its importance, and how Endor Labs works with them.

Key questions for your SBOM program

All the questions (and some of the answers) you need before kicking off your SBOM program.

Endor Labs & Github Advanced Security: AppSec Without The Productivity Tax

Endor Labs raises $70M in series A funding to reform application security

Endor Labs raises a total of $70M to achieve application security without the developer productivity tax. Here's what we're doing, and where we're going.

How should I prioritize software vulnerabilities?

Like any source of risk, the key is to manage them cost-effectively rather than attempting to eliminate them completely. Resources - especially when it comes to development teams - are always limited. So focusing on the biggest issues first is crucial to delivering products but still doing so securely.In this post we’ll go into the key methods for evaluating known vulnerabilities in software. And provide you with the tools to make smart prioritization decisions.

Divide and Hide: How malicious code lived on PyPI for 3 months

The Station 9 research team discovered malicious code that was divided and distributed across different packages, remaining obfuscated for months while getting nearly 2000 downloads.

Endor Labs’ ‘State of Dependency Management 2023’ Report Offers Insight on Explosive Popularity of AI and LLMs—and How They Impact Application Security

Endor Labs Recognized as a Cool Vendor in the 2023 Gartner® Cool Vendors™ in Platform Engineering for Scaling Application Security Practices

Endor Labs is committed to providing cutting-edge solutions that address the challenges faced by platform engineering and DevSecOps teams in meeting application security needs.

Visualizing the Impact of Call Graphs on Open Source Security

Call graph visualizations can support developers in the assessment and mitigation of open source vulnerabilities. This blog post demonstrates this use-case by drilling down into a voluminous call graph until we clearly see the invocation of vulnerable open source methods by a given client. Understanding this invocation context helps developers understand the relevancy and impact of open source vulnerabilities and how to mitigate them.

Why Different SCA Tools Produce Different Results

Like anything in computer science and programming, there’s more than one way to solve a problem or get a result. SCA (software composition analysis) is no different.

Strengthening Security in .NET Development with packages.lock.json

Reviewing Malware with LLMs: OpenAI vs. Vertex AI

At Endor Labs, we continue evaluating the use of large language models (LLMs) for all kinds of use-cases related to application security. And we continue to be amazed about high-quality responses … until we’re amused about the next laughably wrong answer.

Endor Labs Wins Intellyx Digital Innovation Award

Endor Labs is SOC 2 Type II Certified!

Proving once again open source governance doesn’t have to SOC, yes I made that joke again and I’m not sorry. We’re excited to announce we have received a clean audit result on our SOC2 Type II certification.

Endor Labs Recognized As a 2023 Bay Area Best Place to Work

I mean, who wouldn't want to work with a bunch of Ewoks?

Make Developers' Lives Easier with Endor Labs & GitHub Advanced Security

Developers are bombarded with information every day. Constant context switching and information overload are among the biggest barriers to productivity. There are simply too many demands for their attention. One day the sales team will understand. Right?

LLM-assisted Malware Review: AI and Humans Join Forces to Combat Malware

Experiments with GPT-3.5 suggest that LLM-based malware reviews can complement, but not yet substitute human reviews. 1800 binary classifications performed with GPT-3.5 included false-positives and false-negatives.

Endor Labs Announces 100% Channel Commitment, Launches Global Hyperdrive Program to Arm Resellers and Solution Providers with Unprecedented Software Supply Chain Security

The new Hyperdrive partner program enables organizations of all sizes to embrace open source software with confidence.

Endor Labs partners with Zinfinity to help enterprise safely adopt Open Source Software

We’re excited to announce our latest partnership with Zinfinity as a strategic partner. Zinfinity is a global provider of technology solutions and services with a focus on Cyber Security, Cloud and Digital Infrastructure. 

Introducing The Top 10 Open Source Software (OSS) Risks

The Endor Labs Station 9 research team teamed up with over 20 CISOs and CTOs to identify the top 10 security and operational risks introduced through reliance on open source code.

Endor Labs Partners with Security and Technology Leaders to Identify Top 10 Open Source Software Risks of 2023

20 CISOs and technology veterans collaborate with Endor Labs’ Station 9 research team to develop first comprehensive report to analyze both operational and security Open Source Software risks

How to quickly measure SBOM accuracy for Maven projects (for free)

SBOM-Lab is an open source tool that lets you quickly compare SBOM generation methods for Maven projects and find the right one for you.

Endor Labs is SOC2 Certified!

Open Source security doesn't have to SOC (sorry, I had to). We're excited to announce we have received a clean audit result on our SOC2 Type 1 certification.

SBOM vs. SBOM: Comparing SBOMs from different tools and lifecycle stages

Software bills of materials (SBOM) are becoming a key building block of software security and software supply chain risk management. Software vendors active in certain verticals will soon be required to provide customers with SBOMs for their products. But how and when should an SBOM for a given piece of software be produced?

What breaking changes teach us about security

GitHub rolled out a release that had some breaking changes to Git. Here's what we learned from it.

Open Source Licensing Simplified: A Comparative Overview of Popular Licenses

Explore the different types of open source licenses and how they impact the use, modification, and distribution of open source software. From GPL to Apache, MIT and more, learn the key differences between permissive and restrictive licenses and how to choose the right one for your project.

What is VEX and why should I care?

An SBOM without VEX is like peanut butter without jelly. SBOM has been the top buzzword in cyber-security lately, but important to understand why VEX (Vulnerability Exploitability eXchange) is such a critical companion document

Whatfuscator, malicious open source packages, and other beasts

Join Henrik to learn how his journey into Go programming turned into a path of malicious OSS packages...

Exploring Risk: Understanding Software Supply Chain Attacks

Naming and understanding the attack vectors at the disposal of our adversaries.

Endor Labs and Intuitive partner to help enterprises leverage open source software most securely and effectively

Endor Labs and Intuitive.Cloud announce strategic partnership and investment with the goal of taking on OSS sprawl.

What is reachability-based dependency analysis?

As software engineers, we (should) strive to write as little code as possible. This is understandable: new code has new bugs and will need maintenance in the future. One way of avoiding writing software is to reuse Open-Source Software (OSS) libraries, hosted on centralized code repositories, such as Maven or NPM.

Introducing The State of Dependency Management Report

In its first report, the Station 9 research team delves into the complexities of dependency management, open source security, vulnerability prioritization, and more.

What are Maven dependency scopes and their related security risks?

This article explores Maven dependency scopes: what are they, what are they used for, and how do they impact security risks?

The Government's Role in Maintaining Open-Source Security

Open-source software has become ubiquitous, powering many of the most critical infrastructure systems in the world, but its community-driven model presents a unique security risk. Because open-source projects are maintained by volunteers, they are often neglected and fall behind on security updates, which can have devastating consequences when critical infrastructure systems rely on vulnerable open-source components.

Introduction to Program Analysis

Program analysis is the process of checking whether or not a piece of software fulfills certain properties. This article explores the basics of program analysis, so we could then dive deeper into the world of call graphs.

More Than 30 Industry-Leading CISOs Personally Invest in Endor Labs

After a comprehensive diligence process on startups in the supply chain and open source security space, over 30 CISOs have chosen to personally back Endor Labs.

From cloud security to code security: why we've raised $25M to take on OSS dependency sprawl

From cloud security to code security - The story of Endor Labs.

Endor Labs Launches with $25M Seed Financing to Tackle Massive Sprawl of Open Source Software (OSS)

Solution from category-defining entrepreneurs and world-renowned experts helps developers spend less time dealing with security issues, more time accelerating their development through safe code reuse.

SBOMs are just a means to an end

Software has eaten the world. Modern society is dependent on software for everything from communicating with family to the medical devices keeping our loved ones alive. But do you know what goes into that software? If your answer was sticky tape and glue you clearly work in technology. Congratulations, this article is for you.

Introducing the OpenSSF Scorecard API

The Scorecard API makes it easier to automate and enforce your dependency policies. Naveen is one of the key contributors to the Scorecard projects, in this article, he walks through how it works!

How to get the most out of GitHub API rate limits

Thinking about using Github's REST API within your system, or already doing so? If you have not already encountered this concept, one important thing to keep in mind while developing is Github's concept of rate limiting. 

Why I joined Endor Labs to Build our India Team

Sriram Subramanian recently left his position as VP of Engineering at Citrix to lead the India R&D center at Endor Labs. We asked him what made him take the leap and what's his vision for the India team.

How Zero Trust principles can accelerate open source adoption in enterprises

Open source is a huge boost to productivity, and today we trust it implicitly even if we think we don’t. That comes with a lot of risk, a lot of friction, and doesn’t let us make the most out of open source software. Zero Trust principles can help us get open source adoption to its full potential.

The response is as dangerous as the vulnerability - Thoughts on the CSRB Log4j report

The recent report from the CSRB gives a step by step account of Log4j, from discovery to remediation, and uncovers a painful insight - sometimes the response is just as dangerous as the vulnerability.

What security teams need to know about software development

This article is meant to help security teams begin their threat models and make more informed risk management decisions regarding their software development practices. 

Polyrepo vs. Monorepo - How does it impact dependency management?

In this article, we explore the impact of using a monorepo vs a polyrepo architecture on dependency management.

Endor Labs Selected as Finalist for RSA Conference 2023 Innovation Sandbox 

Endor Labs recognized for innovation in helping enterprises manage open source risk.