Since implementing Endor Labs, Astronomer successfully transitioned their open source dependency risk program from high-friction to high-result. 

"Endor Labs is like noise counseling headphones for vulnerability management and AppSec. We're able to focus only on the signal and avoid the noise. Our engineering team stays focused on shipping great products, security focuses on mitigating risk, and the company is focused on being a profitable company.”

— Joshua Domagalski, CISO @ Astronomer

Rebuilt engineering trust with 99.1% fewer findings

The most immediate shift occurred in the relationship between the security and engineering teams. By utilizing Endor Labs’ call graphs and reachability analysis, the security team provides technical evidence when a vulnerable function is actually being imported and utilized, effectively ending the endless tax of investigating unreachable CVEs.

"Having something that was able to say, ‘We’re only focusing on things that are reachable, and we’re able to provide proof that it is reachable,’ was a huge win with the engineering team because they knew we were actually focused on solving real problems." 

— Joshua Domagalski, CISO @ Astronomer

Reduced risk of breaking changes

Astronomer maintains a mature software development practice that prioritizes platform stability. They use Endor Labs’ reachability analysis to ensure that security only requests upgrades when absolutely necessary. Upgrade Impact Analysis tells them whether an upgrade will be a small or large lift before the work even begins, and helps them strategically schedule large lifts for a future sprint. And in cases where an upstream fix or patch is not yet available, call graphs show exactly where a vulnerable dependency is being imported so they can create targeted specific mitigation strategies, such as sanitizing inputs or implementing other various controls directly on the reachable path to neutralize the risk without needing to wait for an external update.

"One of the main reasons we increased investment in Endor Labs was the additional telemetry for fix requirements. It allows us to further prioritize work, for example we can schedule a larger fix with many breaking changes for a later sprint while getting the easier ones done quickly."

— Joshua Domagalski, CISO @ Astronomer

Supported global expansion and compliance rigor

Astronomer’s rapid expansion into the European market requires a sophisticated security posture capable of satisfying both internal risk standards and complex global regulations. They utilize Endor Labs as the technical foundation for data-driven evidence required by international customers. By focusing on high-fidelity findings, Astronomer efficiently navigates frameworks like DORA and the EU AI Act without sacrificing production velocity. 

"Endor Labs greatly reduced our CVE backlog, which helps satisfy the near zero tolerance for vulnerabilities often seen in highly regulated markets." 

— Joshua Domagalski, CISO @ Astronomer‍