Mastering Security Automation: Exception and Remediation Policies
Learn how Endor Labs cuts through security noise, stops unnecessary build breaks, and keeps developers focused on real risks—making security policy automation truly developer-friendly.
Learn how Endor Labs cuts through security noise, stops unnecessary build breaks, and keeps developers focused on real risks—making security policy automation truly developer-friendly.
Learn how Endor Labs cuts through security noise, stops unnecessary build breaks, and keeps developers focused on real risks—making security policy automation truly developer-friendly.
Learn how Endor Labs cuts through security noise, stops unnecessary build breaks, and keeps developers focused on real risks—making security policy automation truly developer-friendly.
Learn how Endor Labs cuts through security noise, stops unnecessary build breaks, and keeps developers focused on real risks—making security policy automation truly developer-friendly.
In our previous blog, we explored why security policies frustrate developers and showed finding and action policies from Endor Labs help security teams cut through the noise, empowering developers to focus on meaningful tasks. But effective security management isn't just about identifying and responding to issues—it's also about navigating the gray areas and complexities that inevitably arise in real-world software environments.
Today, we're diving deeper into two additional policy types from Endor Labs—exception and remediation policies—that handle specific, practical scenarios teams frequently encounter.
Exception policies: managing complex real-world situations
Every software environment has unique quirks—what's a critical vulnerability in one scenario might not matter as much in another. Exception policies allow teams to effectively handle these situations, clearly defining when and why certain issues can be safely ignored or accepted temporarily.
Exception policies offer:
- Clear exception categories (such as false positive, risk accepted, temporary exception)
- Contextual explanations that document the rationale behind each exception
- Consistency across various stages of the software development lifecycle
- Precision in scope, allowing exceptions to apply either broadly across an organization or narrowly within specific projects
- Control over who can create or modify exceptions to prevent misuse
Real-world example: One Endor Labs customer used exception policies to streamline triage when the same vulnerability appeared in both SCA and container scans. Because Endor Labs already correlates findings, the customer could easily apply an exception policy to only show the application result. This reduced confusion and helped developers focus on fixing the issue at the source.
Remediation policies: safe dependency upgrades
One common developer concern about addressing vulnerabilities is straightforward: "Will upgrading break my code?" Endor Labs directly tackles this issue with remediation policies, backed by Upgrade Impact Analysis.
Upgrade Impact Analysis evaluates dependency upgrades based on:
- Breaking Change Detection: Clearly identifying actual API changes and potential disruptions.
- Reachability Analysis: Determining whether the vulnerable code is actively used within your application.
- Transitive Dependency Risks: Ensuring upgrades don't inadvertently introduce new vulnerabilities downstream.
- Testing Coverage: Assessing whether existing tests adequately cover the affected dependency.
Real-world scenario: Suppose your team encounters a critical vulnerability in a widely-used library. Rather than blindly suggesting upgrades, Endor Labs' remediation policies use Upgrade Impact Analysis to analyze the dependency thoroughly. If the upgrade is deemed safe—meaning no breaking changes, confirmed reachability, and adequate test coverage—Endor Labs automatically creates a detailed Jira ticket for developers. This eliminates guesswork and ensures that when developers take action, it's meaningful and safe.
Custom policies: addressing unique security concerns
Every organization faces unique security challenges. Endor Labs provides over 100 standard policies out-of-the-box and supports extensive customization, ensuring policies fit seamlessly into your existing workflows and requirements.
Teams can create custom policies using Rego by the Open Policy Agent (OPA) project, a powerful and flexible policy definition language.
Whether your security concern involves unusual issues like unsigned commits, specific compliance requirements, or newly emerging risks like data transmission concerns from certain AI models, custom policies let you precisely target and manage these specific risks.
For example, here is a custom policy that blocks any usage of DeepSeek AI models:
package deepseek
contains_deepseek_ai(val) {
regex.match(".*deepseek.*", val)
}
match_deepseek_finding[result] {
some i
hf_finding := data.resources.Finding[i]
hf_finding.spec.finding_categories[_] == "FINDING_CATEGORY_AI_MODELS"
hf_finding.spec.level == "FINDING_LEVEL_CRITICAL"
contains_deepseek_ai(hf_finding.spec.target_dependency_name)
result = {
"Endor": {
"Finding": data.resources.Finding[i].uuid,
}
}
}
Wrapping Up
Exception and remediation policies at Endor Labs provide teams with practical tools to handle real-world complexities and dependencies safely and effectively. Rather than just adding more rules, these policies give context and intelligent guidance, ensuring developers deal with fewer disruptions and can remain focused on their core responsibilities.
By clearly defining when security issues genuinely matter and providing safe, actionable solutions, Endor Labs strengthens collaboration and reduces friction between security and development teams. Schedule a demo to learn more.
