Blog

A call graph is a visualization of invocation of vulnerable open source methods by a given client. Learn how to use call graphs to understand relevancy and impact of vulnerabilities.

Like anything in computer science and programming, there’s more than one way to solve a problem or get a result. SCA (software composition analysis) is no different.

Learn how packages.lock.json can help maintain a secure .NET development and why it should be part of your development workflow.

Proving once again open source governance doesn’t have to SOC, yes I made that joke again and I’m not sorry. We’re excited to announce we have received a clean audit result on our SOC2 Type II certification.

At Endor Labs, we continue evaluating the use of large language models (LLMs) for all kinds of use-cases related to application security. And we continue to be amazed about high-quality responses … until we’re amused about the next laughably wrong answer.

We've been named a winner of the 2023 Intellyx Digital Innovator Award, recognizing technology providers driving enterprise digital transformation. Learn more.

I mean, who wouldn't want to work with a bunch of Ewoks?

Developers are bombarded with information every day. Constant context switching and information overload are among the biggest barriers to productivity. There are simply too many demands for their attention. One day the sales team will understand. Right?

Experiments with GPT-3.5 suggest that LLM-based malware reviews can complement, but not yet substitute human reviews. 1800 binary classifications performed with GPT-3.5 included false-positives and false-negatives.

Endor Labs recognized for innovation in helping enterprises manage open source risk.

The Hyperdrive partner program enables organizations of all sizes to embrace open source software with confidence.

We’re excited to announce our latest partnership with Zinfinity as a strategic partner. Zinfinity is a global provider of technology solutions and services with a focus on Cyber Security, Cloud and Digital Infrastructure.

SBOM-Lab is an open source tool that lets you quickly compare SBOM generation methods for Maven projects and find the right one for you.

Open Source security doesn't have to SOC (sorry, I had to). We're excited to announce we have received a clean audit result on our SOC2 Type 1 certification.

Software vendors active in certain verticals will soon be required to provide customers with SBOMs for their products. But how and when should an SBOM for a given piece of software be produced?

GitHub rolled out a release that had some breaking changes to Git. Here's what we learned from it.

Explore the different types of open source licenses and how they impact the use, modification, and distribution of open source software. From GPL to Apache, MIT and more, learn the key differences between permissive and restrictive licenses and how to choose the right one for your project.

An SBOM without VEX is like peanut butter without jelly. SBOM is a top buzzword in cybersecurity, but it's important to understand why VEX (Vulnerability Exploitability eXchange) is such a critical companion document.

Join Henrik to learn how his journey into Go programming turned into a path of malicious OSS packages.

Naming and understanding the attack vectors at the disposal of our adversaries.

Endor Labs and Intuitive.Cloud announce strategic partnership and investment with the goal of taking on OSS sprawl.

Reachability analysis increases reliability of SCA results, allowing teams to quickly prioritize just the risks that matter.

This article explores Maven dependency scopes: What are they, what are they used for, and how do they impact security risks?

This blog summarizes highlights from Tragedy of the Digital Commons, by Strauss Center scholar and lecturer Chinmayi Sharma, where she shares the OSS state of affairs and her thoughts on improving security.

Program analysis is the process of checking whether or not a piece of software fulfills certain properties. This article explores the basics of program analysis, so we could then dive deeper into the world of call graphs.