Endor Labs and Bright Security Partner to Close the Gap Between Discovery and Remediation

We're excited to announce a technology partnership between Endor Labs and Bright Security, bringing together reachability-backed static analysis and AI-validated dynamic testing & validated Remediation so mutual customers can act on findings that are confirmed exploitable

Endor Labs is the agentic application security platform built on the code context graph, a continuously updated model of how an application behaves across first-party code, open source dependencies, and containers. Full-stackreachability analysis traces the path from input to the vulnerable function called in application code across every layer, which is how Endor Labs customers cut SAST, SCA, and container scanning noise by roughly 95% on average before a finding ever reaches a developer. Endor Labs secures more than 5 million applications for teams at companies including Atlassian, Cursor, Dropbox, Robinhood, Rubrik, and Snowflake.

Bright Security is the developer-first application security testing platform behind Bright STAR, which combines DAST,  API security testing & Agentic Offensive Security with AI-driven runtime validation. Bright STAR tests running applications and APIs the way an attacker would, generating context-aware payloads and confirming exploitability before a finding is ever reported, holding false positive rates under 3% in a category where legacy DAST tools routinely clear 30%. Bright Security serves enterprise customers across finance, technology, and consumer industries who need security testing that keeps pace with continuous delivery.

Together, Endor Labs and Bright Security give security and engineering teams a single, evidence-based view of risk that spans from source code to running application, backed by proof from both products instead of a finding from either tool alone. This partnership delivers:

• Reachability-narrowed dynamic testing: Endor Labs' full-stackreachability analysis identifies which vulnerabilities in first-party code, open source, and container images sit on a call path from untrusted input, so Bright STAR can confirm exploitability, instead of testing everything a static scanner surfaced or using EPSS to approximate.
• Runtime-confirmed prioritization: Findings that Bright Security confirms are exploitable at runtime are elevated automatically, giving teams a prioritized list backed by both static evidence and a live proof of concept, not a severity score alone.
• Lower token and compute costs for AI-driven remediation: Verified, machine-readable evidence from both platforms means AI coding and remediation agents spend their reasoning on real problems instead of re-deriving reachability or re-checking findings neither tool has confirmed.

“The future of AppSec isn’t more findings; it’s better evidence. Reachability tells you whether a vulnerability can matter in your application, and runtime validation proves whether it can actually be exploited. Together, Endor Labs and Bright give developers and AI agents the context to prioritize real risk and remediate with confidence.”
- Varun Badhwar, Co-Founder and CEO, Endor Labs

“Security teams don’t need another disconnected stream of findings-they need evidence they can act on. By pairing Endor Labs’ reachability intelligence with Bright’s AI-driven runtime validation, we help teams focus remediation on vulnerabilities that are both reachable and demonstrably exploitable, so developers and AI agents can fix what matters with confidence.”
- Gadi Bashvitz, CEO, Bright Security

Someone pays for the noise

Past models were built for a world where humans wrote the code and humans triaged the findings. Neither is true anymore. Pull requests are up triple digits year over year, a growing share of them AI-generated, and the agents reviewing and fixing that code are themselves burning tokens on every finding they touch. A false positive isn't just wasted developer time now. It's wasted inference, wasted tool calls, and wasted reasoning by an agent with no way to tell a theoretical flaw from an exploitable one.

That's the problem this partnership is built to solve.

Every finding that reaches a developer or an AI coding agent costs something to resolve, whether that's an engineer's afternoon or a chain of tool calls and re-reasoning an agent burns figuring out whether the finding is real. Endor Labs' own benchmarking found that an agent working without deterministic security context needed roughly 12x more tokens to answer the same reachability and exploitability questions as an agent working with verified evidence already in hand. Most of that overhead wasn't reasoning. It was the agent re-deriving, over and over, evidence a tool could have handed it in one call.

Bright Security sees the same tax from the runtime side. Unvalidated findings and unverified AI-generated fixes don't just waste developer time, they explode compute and token costs for every agent that has to re-check them. An AI fix agent that "resolves" a false positive has spent real inference on a problem that never existed, and an agent that patches an unvalidated finding incorrectly can introduce a regression that costs more to unwind than the original issue would have.

Static reachability and dynamic validation each cut noise before it reaches a triage queue. Combined, they cut it twice, once on the theoretical side and once on the exploitable side, which is the difference between a backlog that shrinks by 90% and one that shrinks by closer to 99%.

How the integration works

Endor Labs' function-level reachability analysis narrows the candidate list first. Out of every open source vulnerability and code flaw in a codebase, it flags which ones sit on a call path from untrusted input. That candidate list, already stripped of unreachable hands the SARIF file to the Bright Security which confirms which of those reachable findings are exploitable in its run. Endor SAST + STAR as a CI gate: vulnerable code gets caught and proven exploitable before it ever reaches the production branch, so the team spends its time only on issues that are real.

The results confirm what Endor Labs' code context graph generated. A finding that's reachable and confirmed exploitable gets prioritized differently than one that's reachable but unproven, and both get prioritized ahead of the noise neither tool would have flagged as urgent in the first place. Developers and their AI coding agents see one list, backed by two independent forms of proof, instead of two disconnected reports to reconcile themselves.

Built for the agents doing the fixing, not just the humans reading the report

An AI agent can only act as well as the evidence it's given. A coding agent asked to fix "a SQL injection vulnerability" with no reachability context and no runtime confirmation will do exactly what an under-informed human would do: ignore it, or over-fix it into a regression.

Verified, machine-readable evidence changes that. When a finding arrives with a call path from Endor Labs and a confirmed exploit path from Bright Security attached, a remediation agent has enough grounding to generate a fix scoped to the actual problem, and enough evidence to skip the findings that don't need touching at all. That's the same logic behind Endor Labs' OWASP LLM Top 10 coverage in AI SAST and Bright Security's dynamic testing for prompt injection and insecure output handling in LLM-powered applications: static and dynamic evidence for the AI-specific risks in an application, not only the traditional ones.

Security stops being a report someone reads on a Friday and becomes intelligence an agent can act on the moment code is written and the moment it runs.

Get started

If you're evaluating how static reachability and dynamic validation fit into an AI-accelerated SDLC, or you're the one currently paying the token bill for an agent second-guessing findings neither tool actually confirmed, that's exactly the problem this partnership is built to solve. Contact us today to get started.