Blog

Explore the challenges of modern vulnerability management and the efficiency of the Vulnerability Exploitability eXchange (VEX) in our latest blog post. Learn how VEX helps identify and communicate the true exploitability of vulnerabilities, streamlining cybersecurity efforts in the face of overwhelming scanner findings.

Learn about the 2023 FDA rule for medical devices, including requirements for SBOMs, a mitigation plan, and secure software development practices.

A breakdown of the "Guidelines for Secure AI System Development document from CISA and NCSC.

Organizations need to evolve their approach to using open source securely. Find four fundamental considerations to consider when it comes to securely using OSS.

CRN®, a brand of The Channel Company, has named Endor Labs to its 2023 Stellar Startups list in the Security category. Learn more about the list and us here.

An overview of 3 requirements for a secret detection program, and how to do it with Endor Labs.

One scanner says this is a CVE, and the other says it's not. Which is right?

If you’ve been watching the software supply chain security space evolve, you likely know that a lot of the momentum and effort is coming out of the U.S. Federal government. This may seem surprising at first, but it shouldn’t be, when you account for the fact that the Federal government is one of the single largest procurers of technology and software in the world. 

Third-party open source dependencies offer convenience but also pose a significant security risk. Learn how tools like Endor Labs can detect & address vulnerabilities here.

Phantom dependencies are dependencies used by your code that are not declared in the manifest. If you miss them, they can sneak reachable risks into your application, lead to false positives, or inaccurate SBOMs. All very spooky. This article breaks down how phantom dependencies happen, and how to catch them.

Chris Hughes brings nearly 20 years of IT and cybersecurity experience to his role as Chief Security Advisor. Learn what made him choose Endor Labs.

In this blog, we delve into the various Python manifest files used to declare dependencies and how they collaborate seamlessly.

A breakdown of why your SCA results are always so full of false positives (and sometimes false negatives), and why treating source code as a first class citizen can lead us to the solution.

SINET, an organization with the mission to accelerate Cybersecurity innovation through public-private partnerships, announced today that Endor Labs is one of the winners of its annual SINET16 Innovator Award. Endor Labs and 15 other emerging companies are identified as the most innovative and compelling technologies in their fields to address Cybersecurity threats and vulnerabilities.

Exploit Prediction Scoring Systems (EPSS) is a data set that helps you understand the likelihood that a CVE will be exploited. Learn what the EPSS includes and how to use it to prioritize vulnerability remediation.

Announcing new language support for Endor Labs Open Source

What’s the best of the best when it comes to open source security tools?We’ve previously talked about the OpenSSF Scorecard, which gives developers a high-level snapshot of the security of any given open source project. But in this post, we’ll talk about a related project, the Open Source Security Index (OSSI), which does something slightly different and complementary.

As projects grow larger and more complex, developers face challenges in maintaining a clean and efficient development workflow. Fortunately, npm workspaces offer an essential solution to streamline JavaScript development. In this blog post, we will explore the concept of npm/yarn workspaces, its importance, and how Endor Labs works with them.

All the questions (and some of the answers) you need before kicking off your SBOM program.

Endor Labs integrates with GitHub Advanced Security to enable developers to easily view and remediate SCA alerts without ever needing to leave GitHub.

Endor Labs raises a total of $70M to achieve application security without the developer productivity tax. Here's what we're doing, and where we're going.

CVSS, KEV, SVCC, EPSS, and reachability analysis are 5 method used to prioritize open source vulnerabilities for remediation. Do you need all 5? Which is the best? It turns out a combination of factors (and a tool that can bring it all together) is the best solution.

The Station 9 research team discovered malicious code that was divided and distributed across different packages, remaining obfuscated for months while getting nearly 2000 downloads.

The State of Dependency Management 2023 reports on the latest research on dependency management and how AI is impacting the application security landscape.

Endor Labs is committed to providing cutting-edge solutions that address the challenges faced by platform engineering and DevSecOps teams in meeting application security needs.