Blog

Learn ways to comply with SSDF requirements for secure environments, trusted source code supply chains, code and artifact provenance, and vulnerabilities.

Learn how to establish automated CI/CD controls to reveal what’s running in your pipelines and which configs don’t align with risk and compliance requirements.

Learn about the pros and cons of maintaining current dependencies, backed by a TU Delft study on 262 Java projects on Github

Code Signing and other Artifact Signing enable application provenance to enhance admission control, incident response, and other essential capabilities.

Learn about emerging malicious code trends, including typosquatting and dependency confusion attacks, and two techniques for detecting malware in your applications.

Tom Gleason is a security enthusiast with a knack for building and leading technically-focused customer teams. Formerly at Snyk, Akamai, and Palo Alto Networks, Tom joins Endor Labs to lead Customer Solutions.

Endor Labs CI/CD helps organizations secure their pipelines through pipeline discovery, repository security posture management, and build integrity verification (artifact signing).

Testing and installing new security tools is painful. Using generative AI, DroidGPT by Endor Labs makes it easy to troubleshoot and even prevent compatibility errors when installing the platform.

Endor Labs’ reachability-based SCA now supports Bazel so you can get fully accurate results without any of the messy workarounds usually required for monorepos.

Explore the five key categories of reachability and their practical applications in AppSec and development. Learn the differences between SCA and container scanning, and understand how various tools like Function-Level Reachability, Package Baselining, and Internet Reachability play crucial roles in identifying and prioritizing security risks.

Learn best practices for a proper software identification ecosystem that supports asset inventory, version control, vulnerability management, incident response, and more.

Discover the critical details of CVE-2023-50164, a severe vulnerability in Apache Struts.

Endor Labs’ JavaScript SCA capabilities cut down noise with a program analysis approach that outperforms manifest scanning SCA tools like Snyk, Veracode, and BlackDuck.

Explore the challenges of modern vulnerability management and the efficiency of the Vulnerability Exploitability eXchange (VEX) in our latest blog post. Learn how VEX helps identify and communicate the true exploitability of vulnerabilities, streamlining cybersecurity efforts in the face of overwhelming scanner findings.

Learn about the 2023 FDA rule for medical devices, including requirements for SBOMs, a mitigation plan, and secure software development practices.

A breakdown of the "Guidelines for Secure AI System Development document from CISA and NCSC.

Organizations need to evolve their approach to using open source securely. Find four fundamental considerations to consider when it comes to securely using OSS.

CRN®, a brand of The Channel Company, has named Endor Labs to its 2023 Stellar Startups list in the Security category. Learn more about the list and us here.

An overview of 3 requirements for a secret detection program, and how to do it with Endor Labs.

One scanner says this is a CVE, and the other says it's not. Which is right?

If you’ve been watching the software supply chain security space evolve, you likely know that a lot of the momentum and effort is coming out of the U.S. Federal government. This may seem surprising at first, but it shouldn’t be, when you account for the fact that the Federal government is one of the single largest procurers of technology and software in the world. 

Third-party open source dependencies offer convenience but also pose a significant security risk. Learn how tools like Endor Labs can detect & address vulnerabilities here.

Phantom dependencies are dependencies used by your code that are not declared in the manifest. If you miss them, they can sneak reachable risks into your application, lead to false positives, or inaccurate SBOMs. All very spooky. This article breaks down how phantom dependencies happen, and how to catch them.

Chris Hughes brings nearly 20 years of IT and cybersecurity experience to his role as Chief Security Advisor. Learn what made him choose Endor Labs.

In this blog, we delve into the various Python manifest files used to declare dependencies and how they collaborate seamlessly.