Endor Labs 
Supply Chain

Most security policies create more problems than they solve, overwhelming developers with noise and unnecessary build breaks. Here's what a better approach looks like.

A look at the easyjson controversy, open source provenance, and how Go's built-in protections help teams manage risk without overreacting.

Endor Labs raised a $93M Series B to accelerate its mission of securing the AI-driven software era. Learn why top investors preempted the round—and how Endor is redefining AppSec for modern development.

This solution brief shows how application security teams can fix risks from AI-generated code earlier in development and become the catalyst for secure, scalable adoption of AI coding tools like GitHub Copilot and Cursor in their organizations.

This whitepaper introduces how AI Security Code Review works, what it detects, how it integrates into your workflows, and why it represents the next generation of code scanning technology — built for the complexity and speed of AI-native software development.

Endor Labs MCP Server powers real security fixes for vibe coding and AI-generated code—reduce noise and help AI tools fix risks for you.

Endor Labs helps application security teams identify the few code changes that impact their security architecture across thousands of pull requests.

The era of vibe coding is here. Learn how Endor Labs is helping AppSec teams secure and fix AI-generated code with a new agentic AI platform.

Endor Labs advisory: Critical CVE-2025-30065 in Apache Parquet lets attackers run code via schema parsing. Patch now by upgrading to version 1.15.1.

OWASP OSS Risk 2: Explore the compromise of legitimate open-source packages, with an in-depth case study of the tj-actions/changed-files GitHub Action supply chain attack.

Analysis of the tj-actions/changed-files GitHub Actions compromise, assessing the impact and damage from the attack.

Cyber Essentials helps UK businesses guard against internet-based attacks and prove their security measures are truly effective.

GitHub Action tj-actions/changed-files was compromised, exposing CI/CD secrets. Learn how this attack impacts repositories and what steps to take now.

Learn when application security posture management (ASPM) solutions work, their limitations, and alternatives for cutting through security alert noise.

Endor Patches are backported open-source security fixes. Learn how we build and test Endor Patches for compatibility and security.

Each stage of the application security maturity staircase evolves your program—and Endor Labs is your escalator to the top.

Improve your mean time to remediation (MTTR) with smarter automatic pull requests that use upgrade impact analysis to reduce alert fatigue for developers.

Learn how to evaluate security risk factors for DeepSeek R1, and about important considerations for working with open source AI models.

Use Endor Labs to discover, evaluate, and enforce policies governing the usage of open source AI models from Hugging Face in your applications.

CVE-2024-53677 and CVE-2023-50164 are vulnerabilities in Apache Struts that could pave the way for remote code execution, or RCE. Learn how to figure out if you’re affected, and if so what to do about it

Opengrep is a fork of Semgrep's open source static code analysis engine. Learn about the benefits and how you can contribute.

Vulnerability metrics can help you uncover remediation and SLA trends, and demonstrate the value of AppSec investments to your leadership.

False positives can make FedRAMP ConMon costly. Learn why it’s hard to accurately identify false positives and some tactics for making this process less challenging.

Learn how Endor Labs targets the critical dependencies that are responsible for most of the open source vulnerabilities in the software supply chain.

JavaScript reachability is tricky for SCA tools because of how JavaScript approaches dependency resolution, dependency imports, and functions.

When upgrading is too risky, complex, or time consuming due to regressions, breaking changes, or new bugs, you can use Endor Patches to stay safe now while still meeting your SLA requirements.

Grip Security replaced their traditional SCA tool with Endor Labs to improve their ability to build trust with customers without taxing developers.

Grip Security values strong application security because it helps them build trust with their customers. Learn how a security company approaches AppSec.

Learn where common industry sayings such as “stay up to date” come from and how you can help Endor Labs help you overcome those challenges.

Endor Labs reduces false positives and prioritizes real vulnerabilities, helping your team meet FedRAMP requirements with less stress and lower costs.

Learn why OVAL feeds, curated by Linux distributions, offer more precise vulnerability data than the NVD, reducing container scanning false positives and wasted efforts.

Breaking Changes, Breaking Trust

Vulnerability Management for FedRAMP compliance is expensive; your SCA tool should help you make it cheaper and easier.

Integrate Microsoft Defender for Cloud with Endor Labs for reachability analysis and attack path visibility — available natively within the Defender for Cloud console. Prioritize what to fix without switching tools.

Understand how models are factored and scored at Endor Labs, new exploration tab for HuggingFace models

Endor Labs now integrates Static Application Security Testing (SAST) into your application security testing stack.

The Cyber Resilience Act (CRA) sets mandatory security requirements for hardware and software. This blog covers key compliance objectives, challenges with OSS vulnerabilities, and best practices for maintaining security throughout the product life cycle.

You can now use Endor Labs to evaluate AI models on HuggingFace for security, popularity, quality, and activity.

The U.S. Federal government's FY 2026 Cybersecurity Priorities focus on securing open source software, improving governance, and supporting OSS sustainability to strengthen the software supply chain.

Understand what LLMs are, how foundational LLMs are built, the opportunities they offer and the risks they pose.

Container layer analysis tells you which layer contains a vulnerability so you can prioritize remediation efforts more effectively and meet SLAs like FedRAMP.

Endor Labs reduces open-source vulnerability noise by 92%, boosting productivity and improving collaboration between development and security teams.

We're thrilled to have Karl Mattson as Endor Labs first Chief Information Security Officer (CISO)!

Get key insights from the 2024 Dependency Management webinar with Darren Meyer and Henrik Plate. We discuss how to prioritize vulnerabilities, navigate breaking changes, and leverage public vulnerability databases effectively.

Relativity changed their security program from a blocker to an enabler by integrating security into developer workflows and empowering developers to prevent risks before they ship to production.

Relativity changed their security program from a blocker to an enabler by integrating security into developer workflows and empowering developers to prevent risks before they ship to production.

Discover the top open-source tools for Python applications, ranked by Endor Scores based on security, activity, popularity, and code quality.

This blog covers key steps to simplify FedRAMP vulnerability management, helping you reduce risks and meet compliance timelines. It also provides practical tips to empower developers and streamline fixes for a smoother FedRAMP process.

Automatically patch open source libraries with Endor Patches during the build process, ensuring software is continuously protected against vulnerabilities without manual intervention.

Our third-annual Dependency Management Report explores how emerging trends in open source security should guide SDLC security strategy.

Starburst, an open data lakehouse, replaced Rezillion with Endor Labs for SCA. They improved their ability to identify and prioritize open source while complementing the developer experience.

Wondering how to build or revamp a DevSecOps program? Get some immediately useful tips that you can apply to your startup or mature enterprise…or anywhere in between.

Learn what CI/CD security is, why it’s important, and discover the key tools Endor Labs offers to help you secure your CI/CD pipelines.

Endor Labs provides comprehensive CI/CD security for GitHub action workflows that detect patterns that may indicate PWN request threats.

Endor Labs’ newest capabilities help you reduce the research required to understand the impact of dependency upgrades and Endor Magic Patches help you stay safe without changing versions.

Endor Labs is now available on Azure Marketplace!

Endor Labs provides several filters to help you prioritize which risks to address first, resulting in an average 92% noise reduction.

Use Endor Labs to get accurate dependency inventories and complete vulnerability data sources.

Discover the 48 most popular open-source npm tools, complete with Endor Scores, to help you choose the best dependencies for your projects based on security, activity, popularity, and code quality.

Compare Endor Labs and Snyk GitHub Apps.

Use artifact signing, a feature of Endor Labs, to support build provenance requirements for SLSA.

At Endor Labs, we believe your application security tooling must go beyond alerting—it should also helpyou fast-track remediation.

Upgrade Impact Analysis shows you what breaking changes a fix could cause. Endor Patches are trusted patches you can use when upgrades are too painful.

Software composition analysis (SCA) tools can take a static or dynamic approach. Learn the pros and cons of each option and see how the results differ.

Explore the top 33 open source tools for Maven, scored by Endor Labs on security, activity, popularity, and code quality.

Jellyfish replaced Snyk with Endor Labs to improve their ability to identify, prioritize, address, and predict open source risk. Learn more!

Learn how Jellyfish’s security team uses a data-driven approach to risk management and the role SCA plays in their strategy.

Learn about common patterns and tradeoffs for security pipelines in this introductory webinar.

While conventional code security tools drown teams in false positives, Endor Labs zeroes in on real risks, empowering developers without without slowing them down.

Endor Labs, a leader in software supply chain security, today announced a strategic investment from Citi Ventures.

Endor Labs is named to Inc.’s annual Best Workplaces list for 2024.

Three CocoaPods CVEs raise serious security concerns for consumers of Swift and Objective-C libraries used for macOS and iOS mobile development.

When choosing an SCA tool, you’ll need to understand how the tool generates an inventory, correlates to risks, helps you prioritize results, and integrates into your toolchain.

The Endor Labs plugins for Backstage create an application security experience that doesn’t require developers to leave Backstage.

Watch this 30-minute on-demand webinar to learn about changes to PCI DSS that impact OSS vulnerability management.

We’re excited to announce that Endor Labs now extends our software supply chain platform to include container scanning.

Company Recognized for Creating Secure Supply Chains that Improve Application Development Productivity

How can you tell if an OSS package is “good” or “bad”? A rigorous evaluation model, such as the Endor Score, can help developers make quick and informed decisions.

95% of vulnerabilities are found in transitive dependencies. Learn how they’re unique from direct dependencies and how to incorporate them into your risk management program.

GitHub Actions are open source dependencies - secure them accordingly! Learn how to effectively manage the security risks associated with GitHub Actions with a proactive approach focusing on three key areas: visibility, hardening, and dependency management.

Learn how your organization can achieve DORA compliance for managing open source software vulnerabilities with reachability-based SCA, SBOMs, and more.

Learn about the mobile application threat landscape and how you can protect mobile apps from security and legal risk associated with open source software with Endor Labs Open Source.

Watch this 30-minute on-demand webinar to learn how to Endor Labs supports a Software Supply Chain Security program.

Known vulnerabilities are a well-understood software risk…but managing and prioritizing them is anything but simple. Learn about key considerations when building a program to detect and remediate CVEs.

A low-code/no code artifact signing solution makes it easy to implement an enterprise solution for verifying authenticity of software artifacts and tracing their origins.

Learn how your organization can achieve PCI DSS v4 compliance for managing open source software vulnerabilities with reachability-based SCA and more.

Source code repository misconfigurations can expose your organization to supply chain attacks. Repository Security Posture Management (RSPM) can offer a reliable system to enforce best practices.

In this free guide, experts answer key questions like "what is it?", "why is it important?", "and how do I secure it?" so you can make informed decisions and thoughtfully design your organization's SSCS program.

Control which images get deployed in Kubernetes by configuring an admission controller to admit only those which have been signed by Endor Labs.

What happens when an AppSec professional attends a Java conference? Great conversations on productivity, tool pain, AI/ML, and vulnerability management.

Watch this 30-minute on-demand webinar to learn using strong cryptographic artifact signatures to enable strong admission control, provenance, and traceability that support effective security, quality, and compliance programs.

While it’s improbable to prevent all exposure to supply chain risks, organizations can absolutely focus on a strategy to reduce the probability of successful attacks and reduce the time it takes them to respond to such threats.

The xz backdoor shines a light on everything we're doing wrong in software supply chain security. Get an overview of the incident, what we can learn from it, and what we can do about it.