Endor Labs Named a Representative Vendor in the 2026 Gartner® Innovation Insight for Agentic Application Security Testing

Endor Labs has been named a Representative Vendor in the 2026 Gartner® Innovation Insight for Agentic Application Security Testing. The report names and defines the thing we've spent the last year building: AURI by Endor Labs, an agentic system that reasons about your code the way a security engineer would, instead of matching patterns and hoping for the best.

Gartner uses the term "agentic AST." Most of the market calls it AI SAST. Either way, the definition is the same: a tool that uses model reasoning inside a structured workflow to find the complex, context-dependent flaws that deterministic scanners miss. And the report is refreshingly clear-eyed about what that takes.

The harness matters more than the model

The single most important line in the report, at least the one we'd underline twice, is that the agent harness matters more than the underlying LLM models. We couldn’t agree more, but that runs against the prevailing market narrative.

The frontier labs have suggested that if you point a capable enough model at your code, it will surface the rare, long-dormant flaws no other tool can find. We benchmarked exactly that assumption and found it doesn't hold up. On a hand-verified ground truth across eight real projects, Endor Labs AI SAST found 192 real vulnerabilities, 2.6x what the strongest frontier model surfaced on its own, and more than any traditional pattern-based scanner in the test. The full benchmark has the tool-by-tool numbers.

We’ve seen similar results when benchmarking AI coding agents on their ability to generate secure code. The same model can deliver widely different outcomes depending on the harness for both functional and security correctness.

This gaps comes down to harness engineering and architecture. Prompted to scan a repo on its own, a frontier model has to brute-force through the code using grep or ripgrep, essentially re-building context every time. In our testing on a large enterprise Java project, the security-relevant code the models actually reviewed dropped below 10%. A pattern-based scanner is the mirror image: it covers every file but can't reason about behavior, so it drowns you in false positives while missing the real flaws. 

Gartner describes the answer as a harness of specialized agents. We built ours around the same idea, and the benchmark is what a good harness buys you: 63 findings no other tool in the test caught, and 2x greater CWE coverage.

What an agent harness actually looks like

Gartner lays out the common stages of an agentic AST harness: reconnaissance, vulnerability discovery, validation, prioritization, and remediation. That maps almost one-to-one to how Endor Labs AI SAST works, because we started from the reachability engine we built for software composition analysis and adapted those tools for agents to re-use for first-party code analysis.

• Reconnaissance. We index code from across all the repos in your environment into a unified code graph, then map the infrastructure deployed around it, including the frameworks, protections in place, or whether a service is exposed to the internet.
• Discovery. Agents use another tool to traverse the code context graph, trace how untrusted data flows from where it enters to where it's used, following calls across files and services. We index for maximum coverage to limit false negatives.
• Validation. Once the agents identify locations of interest, potential vulnerabilities in the code, they get double checked by a more capable model that checks for mitigations, like a sanitizer in another service that neutralizes the issues, so false positives get removed early.
• Prioritization. Gartner singles out reachability as the most important prioritization signal: can an attacker actually reach the flaw? That's the exact question our engine was built to answer, and severity is scored against your application's context, not a generic CVSS number.
• Remediation. Every confirmed finding ships with the evidence behind it, the data flow and call paths, plus exploit validation and suggested code changes.

Gartner is candid that remediation is still the hard part. We agree, which is why every fix we suggest comes with the evidence a developer or an agent needs to verify it, not a black-box patch to trust on faith.

The findings deterministic tools can't reach

The report calls out the vulnerability classes where agentic AST earns its keep: broken access control, authentication bypasses, race conditions, insecure direct object references, and heap overflows. Flaws that depend on how an application behaves, not on a string you can grep for.

Those are the exact categories where our benchmark findings clustered. In Shopizer, a production e-commerce platform, we flagged an IDOR in the product-image delete endpoint where one merchant could delete another's images because the handler never checked ownership.. And in buffa, Anthropic's Rust protobuf library, a source-to-sink dataflow that amplifies a small input into a ~22x memory blow-up (CVE-2026-55407) on a memory-safe language, where there's no overflow to pattern-match.

Cost in an architecture question

Gartner is direct about the biggest risk around token consumption costs and the potential to make agentic application security testing more expensive.

This is where the harness pays off a second time. We benchmarked two identical agent setups on the same security tasks, same model, same prompts. One got compact, deterministic evidence from Endor Labs, reachability, call paths, upgrade impact. The other got the raw repo and its own reasoning. The agent left to reason alone burned 79.5M tokens; the one with deterministic context used 6.6M. Same answers, 91.7% fewer tokens, and 2.8x faster.

The lesson maps directly to Gartner's guidance to combine agentic AST with deterministic capabilities rather than replace them. Why ask a model to run a calculation when you can hand it a calculator? You let deterministic systems do deterministic work, reachability, call graphs, dependency analysis, and spend the model's expensive reasoning only where judgment is genuinely required. That's not just cheaper. It's what makes agentic AST viable to run continuously instead of selectively.

Where we disagree

Gartner claims that AI SAST doesn’t replace your existing static analysis tooling. Instead, they recommend adding it as a specialized tier for complex logic on mission-critical applications. While that aligns to guidance from frontier AI model companies, we think advanced harness engineering like we’ve done at Endor Labs is actually the better alternative. We’re seeing costs drop, not increase, and as a result can provide predictable pricing while also delivering 2x-3x more true positives than frontier AI models.

Gartner's strategic planning assumption is that by 2028, half of all organizations with an application security testing program will integrate their SAST with agentic AST. We think that's conservative, given how fast AI is writing production code,  and how fast attackers are turning that same leverage against it. Either way, the teams that come out ahead won't be the ones with the biggest model. They'll be the ones with the best harness.

Endor Labs AI SAST is generally available now. If you want to see what it surfaces in your own codebase, with the call paths and evidence behind every finding, book a demo.

Gartner, Innovation Insight for Agentic Application Security Testing, Dionisio Zumerle, 5 June 2026.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.