Platform
Shift Left AppSec Platform
Learn More
Code Scanning

Unify security scanners in one platform that cuts through noise.

Remediation

Fix what’s easy, patch what's hard, and avoid breaking changes.

AI Code Security

Prepare for AI adoption and increase AppSec productivity.

Ecosystem
Languages & Integrations
Microsoft Defender for Cloud
GitHub Advanced Security
Use Cases
Reachability & Remediation Based SCA
AI Security Code Review
OSS Security Patches
CI/CD Security
SAST & Secrets
Container Scanning
AI Governance
SBOM & VEX
Learn
Blog
Documentation
Events
LeanAppSec
Learn by Topic
AI/ML
CI/CD Security
Compliance & SBOM
Developer Productivity
First Party Code
Open Source
SCA
Learn by Category
See All
Blog
Customer Story
Ebook / Report
Events
Solution Brief
Video
Featured resources
View All
Artifact Signing
SCA for Bazel
SCA for Python and AI Apps
Tools
TEI Calculator
Risk Explorer
Company
About
Careers
News
Partners
Achievements
SOC 2
$93M Series B
Gartner Cool Vendor
CRN Stellar Startup
Intellyx Digital Innovation Award
Recent resources
View All
Why Security Policies Frustrate Developers (and How We Can Fix Them)
Open Source Gets Political: What The easyjson Debate Misses (and what to do about it)
Why We Raised a $93M Series B (In This Market)
LeanAppSec
LeanAppSec
Pricing
Docs
Login
Book a Demo
Book Demo

Endor Labs Privacy Policy

Last updated on
April 9, 2024
Title goes here

Endor Labs Privacy Policy

Last updated on
April 9, 2024
Enter your email to be notified of changes to this list.

At Endor Labs Inc. (the “Company,” “us,” “we,” or “our”), we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. By using or accessing our Site, Saas Services, or other products or services (collectively, the “Services”) in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use and disclose your information as described in this Privacy Policy. 

Remember that your use of our Services is at all times subject to our Product Terms of Use and our Website Terms of Use (together, the “Terms of Use”), which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Use. 

As we continually work to improve our Services, we may need to change this Privacy Policy from time to time. We will alert you of material changes by placing a notice on our Site, by sending you an email and/or by some other means. Please note that if you’ve opted not to receive legal notice emails from us (or you haven’t provided us with your email address), those legal notices will still govern your use of the Services, and you are still responsible for reading and understanding them. If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes.

What this Privacy Policy Covers

This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. “Personal Data” means any information that identifies or relates to a particular individual and also includes information referred to as “personally identifiable information” or “personal information” under applicable data privacy laws, rules or regulations. This Privacy Policy does not cover the practices of companies we don’t own or control or people we don’t manage.

Personal Data

Categories of Personal Data We Collect

This chart details the categories of Personal Data that we collect and have collected over the past 12 months:


Category of Personal Data (and Examples)
Categories of Third Parties With Whom We Disclose this Personal Data 
Profile or Contact Data such as first and last name, email, phone number, and username used to access the Services. 
  • Service Providers

  • Advertising Partners

  • Analytics Partners

  • Business Partners

  • Parties You Authorize, Access or Authenticate

Device/IP Data such as IP address, device ID, domain server, and type of device/ operating system/ browser used to access the Services.
  • Service Providers

  • Advertising Partners

  • Analytics Partners

  • Business Partners

  • Parties You Authorize, Access or Authenticate

Web Analytics such as web page interactions, referring webpage/source through which you accessed the Services, non-identifiable request IDs, and statistics associated with the interaction between device or browser and the Services. 
  • Service Providers

  • Advertising Partners

  • Analytics Partners

  • Business Partners

  • Parties You Authorize, Access or Authenticate

Professional or Employment-Related Data such as job title. 
  • Service Providers

  • Advertising Partners

  • Analytics Partners

  • Business Partners

  • Parties You Authorize, Access or Authenticate

Geolocation Data such as IP-address-based location information.
  • Service Providers

  • Advertising Partners

  • Analytics Partners

  • Business Partners

  • Parties You Authorize, Access or Authenticate

Other Identifying Information that You Voluntarily Choose to Provide such as emails, letters, texts, or other communications you send us.
  • Service Providers

  • Advertising Partners

  • Analytics Partners

  • Business Partners

  • Parties You Authorize, Access or Authenticate

Our Commercial or Business Purposes for Collecting Personal Data

  • Providing, Customizing and Improving the Services
    • Creating and managing your account or other user profiles.
    • Processing orders or other transactions; billing.
    • Providing you with the products, services or information you request.
    • Meeting or fulfilling the reason you provided the information to us.
    • Providing support and assistance for the Services.
    • Improving the Services, including testing, research, internal analytics and product development.
    • Personalizing the Services, website content and communications based on your preferences.
    • Doing fraud protection, security and debugging.
  • Marketing the Services
    • Marketing and selling the Services.
    • Showing you advertisements, including interest-based, online behavioral or targeted advertising.
  • Corresponding with You
    • Responding to correspondence that we receive from you, contacting you when necessary or requested, and sending you information about the Company or the Services.
    • Sending emails and other communications according to your preferences.

Other Permitted Purposes for Processing Personal Data

In addition, each of the above referenced categories of Personal Data may be collected, used, and disclosed with the government, including law enforcement, or other parties to meet certain legal requirements and enforcing legal terms including: fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities; protecting the rights, property or safety of you, the Company, or another party; enforcing any agreements with you; responding to claims that any posting or other content violates third-party rights; and resolving disputes.

We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated or incompatible purposes without providing you notice or obtaining your consent. 

Categories of Sources of Personal Data

We collect Personal Data about you from the following categories of sources:

  • You
    • When you provide such information directly to us.
      • When you create an account or use our interactive tools and Services.
      • When you voluntarily provide information in free-form text boxes through the Services or through responses to surveys or questionnaires.
      • When you send us an email or otherwise contact us.  
    • When you use the Services and such information is collected automatically.
      • Through Cookies (defined in the “Tracking Tools, Advertising and Opt-Out” section below).
      • If you download our mobile application or use a location-enabled browser, we may receive information about your location and mobile device, as applicable.
      • If you download and install certain applications and software we make available, we may receive and collect information transmitted from your computing device for the purpose of providing you the relevant Services, such as information regarding when you are logged on and available to receive updates or alert notices.
  • Public Records
    • From the government or other sources.
  • Third Parties
    • Vendors
      • We may use analytics providers to analyze how you interact and engage with the Services, or third parties may help us provide you with customer support.
      • We may use vendors to obtain information to generate leads and create user profiles.
    • Advertising Partners
      • We receive information about you from some of our vendors who assist us with marketing or promotional services related to how you interact with our websites, applications, products, Services, advertisements or communications.
    • Third-Party Credentials

If you provide your third-party account credential to us or otherwise sign in to the Services through a third-party site or service, some account-related information (such as your username) may be transmitted to us. 

How We Disclose Your Personal Data

We disclose your Personal Data to the categories of service providers and other parties listed in this section. Depending on state laws that may be applicable to you, some of these disclosures may constitute a “sale” of your Personal Data. For more information, please refer to the state-specific sections below.

  • Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include:
    • Hosting, technology and communication providers.
    • Security and fraud prevention consultants.
    • Support and customer service vendors.
    • Product fulfillment and delivery providers.
  • Advertising Partners. These parties help us market our services and provide you with other offers that may be of interest to you. They include:
    • Ad networks.
    • Data brokers.
    • Marketing providers.
  • Analytics Partners. These parties provide analytics on web traffic or usage of the Services. They include:
    • Companies that track how users found or were referred to the Services.
    • Companies that track how users interact with the Services.
  • Business Partners. These parties partner with us in offering various services. They include:
    • Businesses that you have a relationship with.
    • Companies that we partner with to offer joint promotional offers or opportunities.
  • Parties You Authorize, Access or Authenticate
    • Third parties you access through the services.
    • Social media services.
    • Other users.

Legal Obligations

We may disclose any Personal Data that we collect with third parties in conjunction with any of the activities set forth under “Other Permitted Purposes for Processing Personal Data” section above. 

Business Transfers

All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part). 

Data that is Not Personal Data

We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and disclose it with third parties for our lawful business purposes, including to analyze, build and improve the Services and promote our business, provided that we will not disclose such data in a manner that could identify you.  

Tracking Tools, Advertising, and Opt-Out

The Services use cookies and similar technologies such as pixel tags, web beacons, clear GIFs and JavaScript (collectively, “Cookies”) to enable our servers to recognize your web browser, tell us how and when you visit and use our Services, analyze trends, learn about our user base and operate and improve our Services. Cookies are small pieces of data– usually text files – placed on your computer, tablet, phone or similar device when you use that device to access our Services. We may also supplement the information we collect from you with information received from third parties, including third parties that have placed their own Cookies on your device(s). 

Please note that because of our use of Cookies, the Services do not support “Do Not Track” requests sent from a browser at this time.

We use the following types of Cookies:

  • Essential Cookies. Essential Cookies are required for providing you with features or services that you have requested. For example, certain Cookies enable you to log into secure areas of our Services. Disabling these Cookies may make certain features and services unavailable.
  • Functional Cookies. Functional Cookies are used to record your choices and settings regarding our Services, maintain your preferences over time and recognize you when you return to our Services. These Cookies help us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
  • Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how visitors use our Services. They do this by collecting information about the number of visitors to the Services, what pages visitors view on our Services and how long visitors are viewing pages on the Services. Performance/Analytical Cookies also help us measure the performance of our advertising campaigns in order to help us improve our campaigns and the Services’ content for those who engage with our advertising. For example, Google LLC (“Google”) uses cookies in connection with its Google Analytics services. Google’s ability to use and disclose information collected by Google Analytics about your visits to the Services is subject to the Google Analytics Terms of Use and the Google Privacy Policy. You have the option to opt-out of Google’s use of Cookies by visiting the Google advertising opt-out page at www.google.com/privacy_ads.html or the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout/.
  • Retargeting/Advertising Cookies. Retargeting/Advertising Cookies collect data about your online activity and identify your interests so that we can provide advertising that we believe is relevant to you. For more information about this, please see the section below titled “Information about Interest-Based Advertisements.”

You can decide whether or not to accept Cookies through your internet browser’s settings. Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new Cookie in a variety of ways. You can also delete all Cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit our website and some of the Services and functionalities may not work. 

To explore what Cookie settings are available to you or to modify your preferences with respect to Cookies, you can access your Cookie management settings by clicking [LINK]. To find out more information about Cookies generally, including information about how to manage and delete Cookies, please visit http://www.allaboutcookies.org/ or https://ico.org.uk/for-the-public/online/cookies/ if you are located in the European Union.

Session Replay Technology

We may use session replay technology in order to identify and resolve customer issues, to monitor and analyze how you use our Services, to better understand user behavior, and to improve our Services. By continuing to use the Services, you consent to the use of session replay technology. If you would like to change your settings with respect to session replay technology, you can access your Cookie management settings by clicking [LINK].

Information about Interest-Based Advertisements

We may serve advertisements, and also allow third-party ad networks, including third-party ad servers, ad agencies, ad technology vendors and research firms, to serve advertisements through the Services. These advertisements may be targeted to users who fit certain general profile categories or display certain preferences or behaviors (“Interest-Based Ads”). Information for Interest-Based Ads (including Personal Data) may be provided to us by you, or derived from the usage patterns of particular users on the Services and/or services of third parties. Such information may be gathered through tracking users’ activities across time and unaffiliated properties, including when you leave the Services. To accomplish this, we or our service providers may deliver Cookies, including a file (known as a “web beacon”) from an ad network to you through the Services. Web beacons allow ad networks to provide anonymized, aggregated auditing, research and reporting for us and for advertisers. Web beacons also enable ad networks to serve targeted advertisements to you when you visit other websites. Web beacons allow ad networks to view, edit or set their own Cookies on your browser, just as if you had requested a web page from their site.

Data Security

We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data. You should also help protect your data by appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

Data Retention

We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting your Personal Data. When establishing a retention period for specific categories of data, we consider who we collected the data from, our need for the Personal Data, why we collected the Personal Data, and the sensitivity of the Personal Data. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.

For example:

  • We retain your profile information and credentials for as long as you have an account with us.
  • We retain your device/IP data for as long as we need it to ensure that our systems are working appropriately, effectively and efficiently.

Personal Data of Children

As noted in the Terms of Use, we do not knowingly collect or solicit Personal Data from children under 18 years of age; if you are a child under the age of 18, please do not attempt to register for or otherwise use the Services or send us any Personal Data. If we learn we have collected Personal Data from a child under 18 years of age, we will delete that information as quickly as possible. If you believe that a child under 18 years of age may have provided Personal Data to us, please contact us at privacy@endor.ai. 

U.S. State Law Privacy Rights

California Resident Rights

Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Data to third parties for such third parties’ direct marketing purposes; in order to submit such a request, please contact us at privacy@endor.ai. 

Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services that you do not wish such operators to track certain of your online activities over time and across different websites. Our Services do not support Do Not Track requests at this time. To find out more about “Do Not Track,” you can visit www.allaboutdnt.com.

Nevada Resident Rights

If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties. You can exercise this right by contacting us at privacy@endor.ai with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account. Please note that we do not currently sell your Personal Data as sales are defined in Nevada Revised Statutes Chapter 603A.

European Union and United Kingdom Data Subject Rights

EU and UK Residents

If you are a resident of the European Union (“EU”), United Kingdom (“UK”), Lichtenstein, Norway or Iceland, you may have additional rights under the EU or UK General Data Protection Regulation (the “GDPR”) with respect to your Personal Data, as outlined below.

For this section, we use the terms “Personal Data” and “processing” as they are defined in the GDPR, but “Personal Data” generally means information that can be used to individually identify a person, and “processing” generally covers actions that can be performed in connection with data such as collection, use, storage and disclosure. 

If there are any conflicts between this this section and any other provision of this Privacy Policy, the policy or portion that is more protective of Personal Data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following applies to you, please contact us at privacy@endor.ai. If we are the processor of your Personal Data (i.e., not the controller), please contact the controller party in the first instance to address your rights with respect to such data. 

Personal Data We Collect

The “Categories of Personal Data We Collect” section above details the Personal Data that we collect from you.

Personal Data Use and Processing Grounds

The “Our Commercial or Business Purposes for Collecting Personal Data” section above explains how we use your Personal Data.

We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity and our “legitimate interests” or the legitimate interest of others, as further described below.

  • Contractual Necessity:  We process the following categories of Personal Data as a matter of “contractual necessity”, meaning that we need to process the data to perform under our Terms of Use with you, which enables us to provide you with the Services. When we process data due to contractual necessity, failure to provide such Personal Data will result in your inability to use some or all portions of the Services that require such data.
    • Profile and Contact Data
    • Payment Data 
    • Other Identifying Information that You Voluntarily Choose to Provide 
  • Legitimate Interest:  We process the following categories of Personal Data when we believe it furthers the legitimate interest of us or third parties:
    • Profile or Contact Data 
    • Device/IP Data 
    • Web Analytics 
    • Professional or Employment-Related Data 
    • Geolocation Data 
    • Other Identifying Information that You Voluntarily Choose to Provide 

We may also de-identify or anonymize Personal Data to further our legitimate interests. 

Examples of these legitimate interests include (as described in more detail above):

  • Providing, customizing and improving the Services.
  • Marketing the Services.
  • Corresponding with you.
  • Meeting legal requirements and enforcing legal terms.
  • Completing corporate transactions.
  • Consent:  In some cases, we process Personal Data based on the consent you expressly grant to us at the time we collect such data. When we process Personal Data based on your consent, it will be expressly indicated to you at the point and time of collection. 
  • Other Processing Grounds:  From time to time we may also need to process Personal Data to comply with a legal obligation, if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest.

Disclosing Personal Data

The “How We Disclose Your Personal Data” section above details how we disclose your Personal Data with third parties. 

EU, UK and Swiss Data Subject Rights

You have certain rights with respect to your Personal Data, including those set forth below. If you have any questions about these rights, or would like to submit a request, please email us at privacy@endor.ai . Please note that in some circumstances, we may not be able to fully comply with your request, such as if it is frivolous or extremely impractical, if it jeopardizes the rights of others, or if it is not required by law, but in those circumstances, we will still respond to notify you of such a decision. In some cases, we may also need you to provide us with additional information, which may include Personal Data, if necessary to verify your identity and the nature of your request.  

  • Access:  You can request more information about the Personal Data we hold about you and request a copy of such Personal Data by emailing privacy@endor.ai. 
  • Rectification:  If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data by emailing privacy@endor.ai. 
  • Erasure:  You can request that we erase some or all of your Personal Data from our systems.
  • Withdrawal of Consent:  If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please note, however, that if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your Personal Data, if such use or disclosure is necessary to enable you to utilize some or all of our Services.
  • Portability:  You can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
  • Objection:  You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes.
  • Restriction of Processing:  You can ask us to restrict further processing of your Personal Data.
  • Right to File Complaint:  You have the right to lodge a complaint about the Company’s practices with respect to your Personal Data with the supervisory authority of your country or EU Member State. A list of Supervisory Authorities is available here: https://edpb.europa.eu/about-edpb/board/members_en.

Transfers of Personal Data

The Services are hosted and operated in the United States (“U.S.”) through the Company and its service providers, and if you do not reside in the U.S., laws in the U.S. may differ from the laws where you reside. By using the Services, you acknowledge that any Personal Data about you, regardless of whether provided by you or obtained from a third party, is being provided to the Company in the U.S. and will be hosted on U.S. servers, and you authorize the Company to transfer, store and process your information to and in the U.S., and possibly other countries. In some circumstances, your Personal Data may be transferred to the U.S. pursuant to a data processing agreement incorporating standard data protection clauses. 

Contact Information

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Data or your choices and rights regarding such collection and use, please do not hesitate to contact us at:

  • www.endorlabs.com 
  • privacy@endor.ai
Endor Labs logo
HomePricingContact Us
Company
AboutCareers
Login
LEARN
BlogDocumentationeBook / ReportsEventsLeanAppSecSolution BriefVideo
Tools
TEI CalculatorRisk Explorer
Why Us?
vs. Snykvs. Traditional SCAvs. Runtime SCA
Product
Products
Endor Labs Supply Chain
Endor Open Source
Endor CI/CD
Endor SBOM Hub
Use Cases
Code ScanningCode Scanning
SAST & Secret DetectionSAST & Secret Detection
AI Code GovernanceAI Code Governance
Upgrades & RemediationUpgrades & Remediation
SBOM IngestionSBOM Ingestion
AI AppsAI Apps
Bazel MonoreposBazel Monorepos
Digital Operational Resilience Act (DORA)Digital Operational Resilience Act (DORA)
PCI DSSPCI DSS
Container ScanningContainer Scanning
RSPMRSPM
GitHub ActionsGitHub Actions
CI/CD DiscoveryCI/CD Discovery
Artifact SigningArtifact Signing
Compliance & SBOMCompliance & SBOM
SCA with ReachabilitySCA with Reachability
Integrations
Microsoft Defender for CloudMicrosoft Defender for Cloud
RustRust
BitbucketBitbucket
VantaVanta
BazelBazel
GitHubGitHub
PHPPHP
SwiftSwift
ScalaScala
.NET (C#).NET (C#)
RubyRuby
TypeScriptTypeScript
JavaScriptJavaScript
PythonPython
GoGo
KotlinKotlin
JavaJava
SlackSlack
JenkinsJenkins
CircleCICircleCI
GitLabGitLab
JiraJira
IDEIDE
GitHubGitHub
© 2025 Endor Labs. All rights reserved.
Legal and PrivacyTrust and Security

All names, logos, and brands of third parties listed on our site are trademarks of their respective owners. Endor Labs and its products and services are not endorsed by, sponsored by, or affiliated with these third parties. Our use of these names, logos, and brands is for identification purposes only, and does not imply any such endorsement, sponsorship, or affiliation.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Article

Why Security Policies Frustrate Developers (and How We Can Fix Them)

Most security policies create more problems than they solve, overwhelming developers with noise and unnecessary build breaks. Here's what a better approach looks like.

Click to read

Article

Open Source Gets Political: What The easyjson Debate Misses (and what to do about it)

A look at the easyjson controversy, open source provenance, and how Go's built-in protections help teams manage risk without overreacting.

Click to read

Article

Why We Raised a $93M Series B (In This Market)

Endor Labs raised a $93M Series B to accelerate its mission of securing the AI-driven software era. Learn why top investors preempted the round—and how Endor is redefining AppSec for modern development.

Click to read

Article

Secure AI-Generated Code at the Source

This solution brief shows how application security teams can fix risks from AI-generated code earlier in development and become the catalyst for secure, scalable adoption of AI coding tools like GitHub Copilot and Cursor in their organizations.

Click to read

Article

AI Security Code Review: A Multi-Agent Approach for Detecting Security Design Flaws at Scale

This whitepaper introduces how AI Security Code Review works, what it detects, how it integrates into your workflows, and why it represents the next generation of code scanning technology — built for the complexity and speed of AI-native software development.

Click to read

Article

Introducing the Endor Labs MCP Server: fix-first security for the vibe coding era

Endor Labs MCP Server powers real security fixes for vibe coding and AI-generated code—reduce noise and help AI tools fix risks for you.

Click to read

Article

Introducing AI Security Code Review

Endor Labs helps application security teams identify the few code changes that impact their security architecture across thousands of pull requests.

Click to read

Article

Meet the application security platform built for the AI era

The era of vibe coding is here. Learn how Endor Labs is helping AppSec teams secure and fix AI-generated code with a new agentic AI platform.

Click to read

Article

Critical RCE Vulnerability in Apache Parquet (CVE-2025-30065) – Advisory and Analysis

Endor Labs advisory: Critical CVE-2025-30065 in Apache Parquet lets attackers run code via schema parsing. Patch now by upgrading to version 1.15.1.

Click to read

Article

OWASP OSS Risk 2: Compromise of Legitimate Package

OWASP OSS Risk 2: Explore the compromise of legitimate open-source packages, with an in-depth case study of the tj-actions/changed-files GitHub Action supply chain attack.

Click to read

Article

Blast Radius of the tj-actions/changed-files Supply Chain Attack

Analysis of the tj-actions/changed-files GitHub Actions compromise, assessing the impact and damage from the attack.

Click to read

Article

What You Need to Know About UK Cyber Essentials Certification

Cyber Essentials helps UK businesses guard against internet-based attacks and prove their security measures are truly effective.

Click to read

Article

GitHub Action tj-actions/changed-files supply chain attack: what you need to know

GitHub Action tj-actions/changed-files was compromised, exposing CI/CD secrets. Learn how this attack impacts repositories and what steps to take now.

Click to read

Article

Application Security Posture Management (ASPM) Explained

Learn when application security posture management (ASPM) solutions work, their limitations, and alternatives for cutting through security alert noise.

Click to read

Article

How Endor Patches Are Built and Tested

Endor Patches are backported open-source security fixes. Learn how we build and test Endor Patches for compatibility and security.

Click to read

Article

The AppSec Maturity Staircase: Climbing Faster, Not Harder with Endor Labs

Each stage of the application security maturity staircase evolves your program—and Endor Labs is your escalator to the top.

Click to read

Article

How to Get Developers to Accept Security PRs Faster

Improve your mean time to remediation (MTTR) with smarter automatic pull requests that use upgrade impact analysis to reduce alert fatigue for developers.

Click to read

Article

DeepSeek R1: What Security Teams Need to Know

Learn how to evaluate security risk factors for DeepSeek R1, and about important considerations for working with open source AI models.

Click to read

Article

How to Discover Open Source AI Models in Your Code

Use Endor Labs to discover, evaluate, and enforce policies governing the usage of open source AI models from Hugging Face in your applications.

Click to read

Article

Remote Code Execution Vulnerabilities in Apache Struts

CVE-2024-53677 and CVE-2023-50164 are vulnerabilities in Apache Struts that could pave the way for remote code execution, or RCE. Learn how to figure out if you’re affected, and if so what to do about it

Click to read

Article

Everything You Need to Know About Opengrep

Opengrep is a fork of Semgrep's open source static code analysis engine. Learn about the benefits and how you can contribute.

Click to read

Article

Uncover Trends and Show AppSec Value with the Endor Labs Dashboard

Vulnerability metrics can help you uncover remediation and SLA trends, and demonstrate the value of AppSec investments to your leadership.

Click to read

Article

Identifying and Tracking FedRAMP False Positives

False positives can make FedRAMP ConMon costly. Learn why it’s hard to accurately identify false positives and some tactics for making this process less challenging.

Click to read

Article

How Endor Labs Prioritizes Open Source Security Patches

Learn how Endor Labs targets the critical dependencies that are responsible for most of the open source vulnerabilities in the software supply chain.

Click to read

Article

Why Reachability Analysis for JavaScript Is Hard (and How We Fixed It)

JavaScript reachability is tricky for SCA tools because of how JavaScript approaches dependency resolution, dependency imports, and functions.

Click to read

Article

Endor Patches Whitepaper

When upgrading is too risky, complex, or time consuming due to regressions, breaking changes, or new bugs, you can use Endor Patches to stay safe now while still meeting your SLA requirements.

Click to read

Article

Grip Security Reduces Noise by 99%

Grip Security replaced their traditional SCA tool with Endor Labs to improve their ability to build trust with customers without taxing developers.

Click to read

Article

Grip Security Builds Customer Trust with AppSec

Grip Security values strong application security because it helps them build trust with their customers. Learn how a security company approaches AppSec.

Click to read

Article

The Uncomfortable Truth of Vulnerable and Outdated Software Components

Learn where common industry sayings such as “stay up to date” come from and how you can help Endor Labs help you overcome those challenges.

Click to read

Article

Reduce FedRAMP Compliance Costs

Endor Labs reduces false positives and prioritizes real vulnerabilities, helping your team meet FedRAMP requirements with less stress and lower costs.

Click to read

Article

Why OVAL Feeds Outperform NVD for Linux Vulnerability Management

Learn why OVAL feeds, curated by Linux distributions, offer more precise vulnerability data than the NVD, reducing container scanning false positives and wasted efforts.

Click to read

Article

Achieving FedRAMP’s Container Scanning Requirements

Click to read

Article

Breaking Changes, Breaking Trust

Breaking Changes, Breaking Trust

Click to read

Article

Reducing FedRAMP Compliance Costs with Endor Labs

Vulnerability Management for FedRAMP compliance is expensive; your SCA tool should help you make it cheaper and easier.

Click to read

Article

Microsoft Defender for Cloud Natively Integrates with Endor Labs

Integrate Microsoft Defender for Cloud with Endor Labs for reachability analysis and attack path visibility — available natively within the Defender for Cloud console. Prioritize what to fix without switching tools.

Click to read

Article

Hugging Face Model Score Curation at Endor Labs

Understand how models are factored and scored at Endor Labs, new exploration tab for HuggingFace models

Click to read

Article

Endor Labs Announces Integrated SAST Offerings

Endor Labs now integrates Static Application Security Testing (SAST) into your application security testing stack.

Click to read

Article

Understanding the Cyber Resilience Act

The Cyber Resilience Act (CRA) sets mandatory security requirements for hardware and software. This blog covers key compliance objectives, challenges with OSS vulnerabilities, and best practices for maintaining security throughout the product life cycle.

Click to read

Article

Start Clean With AI: Select Safer LLM Models with Endor Labs

You can now use Endor Labs to evaluate AI models on HuggingFace for security, popularity, quality, and activity.

Click to read

Article

The U.S. Government Prioritizes Open Source Governance and Security

The U.S. Federal government's FY 2026 Cybersecurity Priorities focus on securing open source software, improving governance, and supporting OSS sustainability to strengthen the software supply chain.

Click to read

Article

Understanding the Basics of Large Language Models (LLMs)

Understand what LLMs are, how foundational LLMs are built, the opportunities they offer and the risks they pose.

Click to read

Article

Container Layer Analysis: Clarity in Remediation

Container layer analysis tells you which layer contains a vulnerability so you can prioritize remediation efforts more effectively and meet SLAs like FedRAMP.

Click to read

Article

Endor Labs Achieves 92% Reduction in SCA Alerts

Endor Labs reduces open-source vulnerability noise by 92%, boosting productivity and improving collaboration between development and security teams.

Click to read

Article

Karl Mattson Joins Endor Labs as Chief Information Security Officer

We're thrilled to have Karl Mattson as Endor Labs first Chief Information Security Officer (CISO)!

Click to read

Article

Highlights from Our 2024 Dependency Management Webinar

Get key insights from the 2024 Dependency Management webinar with Darren Meyer and Henrik Plate. We discuss how to prioritize vulnerabilities, navigate breaking changes, and leverage public vulnerability databases effectively.

Click to read

Article

Relativity Blocks Risks with Endor Labs

Relativity changed their security program from a blocker to an enabler by integrating security into developer workflows and empowering developers to prevent risks before they ship to production.

Click to read

Article

Blocking with Confidence: Relativity's Dev Experience Journey

Relativity changed their security program from a blocker to an enabler by integrating security into developer workflows and empowering developers to prevent risks before they ship to production.

Click to read

Article

48 most popular open source tools for Python applications, scored

Discover the top open-source tools for Python applications, ranked by Endor Scores based on security, activity, popularity, and code quality.

Click to read

Article

FedRAMP Requirements for Vulnerability Management and Dependency Upgrades

This blog covers key steps to simplify FedRAMP vulnerability management, helping you reduce risks and meet compliance timelines. It also provides practical tips to empower developers and streamline fixes for a smoother FedRAMP process.

Click to read

Article

Fix Vulnerabilities Faster with Auto Patching and Endor Patches

Automatically patch open source libraries with Endor Patches during the build process, ensuring software is continuously protected against vulnerabilities without manual intervention.

Click to read

Article

2024 Dependency Management Report

Click to read

Article

Announcing the 2024 Dependency Management Report

Our third-annual Dependency Management Report explores how emerging trends in open source security should guide SDLC security strategy.

Click to read

Article

Starburst Gets 98.3% Noise Reduction with Endor Labs

Starburst, an open data lakehouse, replaced Rezillion with Endor Labs for SCA. They improved their ability to identify and prioritize open source while complementing the developer experience.

Click to read

Article

Building a DevSecOps Practice at Starburst

Wondering how to build or revamp a DevSecOps program? Get some immediately useful tips that you can apply to your startup or mature enterprise…or anywhere in between.

Click to read

Article

What is CI/CD Security and What Tools Do You Need to Do it?

Learn what CI/CD security is, why it’s important, and discover the key tools Endor Labs offers to help you secure your CI/CD pipelines.

Click to read

Article

PWN Request Threat: A Hidden Danger in GitHub Actions

Endor Labs provides comprehensive CI/CD security for GitHub action workflows that detect patterns that may indicate PWN request threats.

Click to read

Article

Address Open Source Risks with Endor Labs

Click to read

Article

Endor Labs Brand Guidelines

Click to read

Article

Give Devs the Confidence to Fix: Making Remediation Less Painful

Endor Labs’ newest capabilities help you reduce the research required to understand the impact of dependency upgrades and Endor Magic Patches help you stay safe without changing versions.

Click to read

Article

Endor Labs Partners with Microsoft to Strengthen Software Supply Chains

Endor Labs is now available on Azure Marketplace!

Click to read

Article

Prioritize Open Source Risks with Endor Labs

Endor Labs provides several filters to help you prioritize which risks to address first, resulting in an average 92% noise reduction.

Click to read

Article

Discover Open Source Risks with Endor Labs

Use Endor Labs to get accurate dependency inventories and complete vulnerability data sources.

Click to read

Article

48 most popular open source tools for npm applications, scored

Discover the 48 most popular open-source npm tools, complete with Endor Scores, to help you choose the best dependencies for your projects based on security, activity, popularity, and code quality.

Click to read

Article

Benchmarking Endor Labs vs. Snyk’s GitHub Apps

Compare Endor Labs and Snyk GitHub Apps.

Click to read

Article

Using Artifact Signing to Establish Provenance for SLSA

Use artifact signing, a feature of Endor Labs, to support build provenance requirements for SLSA.

Click to read

Article

Fixed is Better than Found | Upgrades & Remediation with Endor Labs

At Endor Labs, we believe your application security tooling must go beyond alerting—it should also helpyou fast-track remediation.

Click to read

Article

How to Fix Vulnerabilities Without Breaking Changes

Click to read

Article

Introducing Upgrades & Remediation: Give Developers the Confidence to Fix

Upgrade Impact Analysis shows you what breaking changes a fix could cause. Endor Patches are trusted patches you can use when upgrades are too painful.

Click to read

Article

Static SCA vs. Dynamic SCA: Which is Better (and Why It's Neither)

Software composition analysis (SCA) tools can take a static or dynamic approach. Learn the pros and cons of each option and see how the results differ.

Click to read

Article

33 Most Popular Open Source Tools for Maven Applications, Scored

Explore the top 33 open source tools for Maven, scored by Endor Labs on security, activity, popularity, and code quality.

Click to read

Article

Endor Labs Partner Program Overview

Click to read

Article

Jellyfish Enables Data-Driven AppSec with Endor Labs

Jellyfish replaced Snyk with Endor Labs to improve their ability to identify, prioritize, address, and predict open source risk. Learn more!

Click to read

Article

Jellyfish’s Data-Driven Security Program

Learn how Jellyfish’s security team uses a data-driven approach to risk management and the role SCA plays in their strategy.

Click to read

Article

What's a Security Pipeline? - On-Demand Webinar

Learn about common patterns and tradeoffs for security pipelines in this introductory webinar.

Click to read

Article

Secure Everything Your Code Depends On With Endor Labs

While conventional code security tools drown teams in false positives, Endor Labs zeroes in on real risks, empowering developers without without slowing them down.

Click to read

Article

Endor Labs Receives Strategic Investment from Citi Ventures

Endor Labs, a leader in software supply chain security, today announced a strategic investment from Citi Ventures.

Click to read

Article

We made the Inc. Best Workplaces List for 2024!

Endor Labs is named to Inc.’s annual Best Workplaces list for 2024.

Click to read

Article

New CocoaPods CVEs: Swift and Objective-C Supply Chains Are Fragile

Three CocoaPods CVEs raise serious security concerns for consumers of Swift and Objective-C libraries used for macOS and iOS mobile development.

Click to read

Article

Questions to Ask Your Software Composition Analysis Vendor

When choosing an SCA tool, you’ll need to understand how the tool generates an inventory, correlates to risks, helps you prioritize results, and integrates into your toolchain.

Click to read

Article

Backstage and Endor Labs: AppSec in a Dev’s Dream Workspace

The Endor Labs plugins for Backstage create an application security experience that doesn’t require developers to leave Backstage.

Click to read

Article

Managing Open Source Vulnerabilities for PCI DSS Compliance - On-Demand Webinar

Watch this 30-minute on-demand webinar to learn about changes to PCI DSS that impact OSS vulnerability management.

Click to read

Article

Container Scanning + SCA = Better Together

We’re excited to announce that Endor Labs now extends our software supply chain platform to include container scanning.

Click to read

Article

Endor Labs Named to Rising in Cyber by CISOs and Venture Capital Investors

Company Recognized for Creating Secure Supply Chains that Improve Application Development Productivity

Click to read

Article

Evaluating and Scoring OSS Packages

How can you tell if an OSS package is “good” or “bad”? A rigorous evaluation model, such as the Endor Score, can help developers make quick and informed decisions.

Click to read

Article

Demystifying Transitive Dependency Vulnerabilities

95% of vulnerabilities are found in transitive dependencies. Learn how they’re unique from direct dependencies and how to incorporate them into your risk management program.

Click to read

Article

Surprise! Your GitHub Actions Are Dependencies, Too

GitHub Actions are open source dependencies - secure them accordingly! Learn how to effectively manage the security risks associated with GitHub Actions with a proactive approach focusing on three key areas: visibility, hardening, and dependency management.

Click to read

Article

OSS Vulnerabilities and the Digital Operational Resilience Act (DORA)

Learn how your organization can achieve DORA compliance for managing open source software vulnerabilities with reachability-based SCA, SBOMs, and more.

Click to read

Article

Protect Mobile Apps with Kotlin and Swift SCA

Learn about the mobile application threat landscape and how you can protect mobile apps from security and legal risk associated with open source software with Endor Labs Open Source.

Click to read

Article

Endor Labs Partners with GuidePoint Security to Secure The Software Supply Chain

Click to read

Article

Intro to Endor Labs - On-Demand Webinar

Watch this 30-minute on-demand webinar to learn how to Endor Labs supports a Software Supply Chain Security program.

Click to read

Article

OWASP OSS Risk 1: Known Vulnerabilities

Known vulnerabilities are a well-understood software risk…but managing and prioritizing them is anything but simple. Learn about key considerations when building a program to detect and remediate CVEs.

Click to read

Article

Low-Code/No Code Artifact Signing

A low-code/no code artifact signing solution makes it easy to implement an enterprise solution for verifying authenticity of software artifacts and tracing their origins.

Click to read

Article

An Auditor’s Perspective on Addressing OSS Vulnerabilities for PCI DSS v4

Learn how your organization can achieve PCI DSS v4 compliance for managing open source software vulnerabilities with reachability-based SCA and more.

Click to read

Article

Your Git Repo is a Supply Chain Risk

Source code repository misconfigurations can expose your organization to supply chain attacks. Repository Security Posture Management (RSPM) can offer a reliable system to enforce best practices.

Click to read

Article

Guide to Implementing Software Supply Chain Security

In this free guide, experts answer key questions like "what is it?", "why is it important?", "and how do I secure it?" so you can make informed decisions and thoughtfully design your organization's SSCS program.

Click to read

Article

Improve Kubernetes Security with Signed Artifacts and Admission Controllers

Control which images get deployed in Kubernetes by configuring an admission controller to admit only those which have been signed by Endor Labs.

Click to read

Article

AppSec Goes to Devnexus: Lessons from a Thriving, Modern Java Community

What happens when an AppSec professional attends a Java conference? Great conversations on productivity, tool pain, AI/ML, and vulnerability management.

Click to read

Article

Artifact Signing 101 - On-Demand Webinar

Watch this 30-minute on-demand webinar to learn using strong cryptographic artifact signatures to enable strong admission control, provenance, and traceability that support effective security, quality, and compliance programs.

Click to read

Article

XZ Backdoor: How to Prepare for the Next One

While it’s improbable to prevent all exposure to supply chain risks, organizations can absolutely focus on a strategy to reduce the probability of successful attacks and reduce the time it takes them to respond to such threats.

Click to read

Article

XZ is A Wake Up Call For Software Security: Here's Why

The xz backdoor shines a light on everything we're doing wrong in software supply chain security. Get an overview of the incident, what we can learn from it, and what we can do about it.

Click to read

Next
Event

Lightsaber Stunt Training Series - North America

Lightsaber Stunt Training Series - North America

Click to view

Event

Lightsaber Stunt Training Series - Europe

Lightsaber Stunt Training Series - Europe

Click to view

Event

AppSec Brews and Rooftop Views Social

BBQ & Bytes: AppSec Social Copenhagen

Click to view

Event

OWASP Global AppSec EU 2025

OWASP Global AppSec EU 2025

Click to view

Event

OWASP Washington, D.C. Meetup

OWASP Washington, D.C. Meetup Evolving Your AppSec Program in the Era of AI

Click to view

Event

The Crossroad of Agentic AI and Security: Chicago Edition

The Crossroad of Agentic AI and Security: Chicago Edition

Click to view

Event

FS-ISAC EMEA Summit

FS-ISAC EMEA Summit

Click to view

Event

Cloud & AI Security Azure Immersion Day

Join us at Cloud & AI Security Azure Immersion Day!

Click to view

Event

OWASP London Meetup

OWASP London Meetup

Click to view

Event

OWASP Vancouver Meetup

OWASP Vancouver Meetup

Click to view

Event

BBQ & Bytes: AppSec Social Copenhagen

BBQ & Bytes: AppSec Social Copenhagen

Click to view

Event

V2 Security Copenhagen

V2 Security Copenhagen

Click to view

Event

Birds of a Feather [Women's Only Event]

Click to view

Event

CISO Sanctuary Breakfast hosted by Hitch Partners

Click to view

Event

Bricks, Blocks, and Big Ideas: A LEGO Workshop with Tyler Clites

Click to view

Event

Request your VIP pass to the Endor Labs' Base at RSAC

Click to view

Event

CSA Summit 2025

CSA Summit 2025: Transformation: Ushering in the Next Generation of Cybersecurity.

Click to view

Event

AI vs. AI: Securing Software in the Era of AI-Generated Code

AI vs. AI: Securing Software in the Era of AI-Generated Code

Click to view

Event

RSAC 2025

Click to view

Event

AppSec Workshop: Fix Faster

AppSec Workshop: Fix Faster

Click to view

Event

Vibe Coding is Mid for Security

Learn what securing AI-generated code actually looks like. Endor Labs CTO Dimitri Stiliadis will do some vibe coding of his own, and then scan and fix vulnerabilities live.

Click to view

Event

Cybersecurity Identity Summit 2025

Cybersecurity Identity Summit

Click to view

Event

BSides Seattle

BSides Seattle

Click to view

Event

KCJUG Meetup

KCJUG Meetup

Click to view

Event

OWASP Antonio Meetup

OWASP Antonio Meetup AI for AppSec - A discussion of AppSec Best Practices

Click to view

Event

Innovate Cybersecurity Summit - Nashville

Innovate Cybersecurity Summit - Nashville

Click to view

Event

AppSec AI Summit

AppSec AI Summit

Click to view

Event

OWASP Bristol: Stormy Seas of Supply Chain Security

OWASP Bristol: Stormy Seas of Supply Chain Security

Click to view

Event

NCAA March Madness

NCAA March Madness

Click to view

Event

OWASP Vancouver

OWASP Vancouver

Click to view

Event

Boston Security March 2025 Meetup

Boston Security March 2025 Meetup

Click to view

Event

GPSec Security Forum Boston

GPSec Security Forum Boston

Click to view

Event

InfoSec Anti-Summit

InfoSec Anti-Summit

Click to view

Event

SANS Institute Cyber Solutions Fest

SANS Institute Cyber Solutions Fest

Click to view

Event

SnowFROC

SnowFROC

Click to view

Event

DevOps Live London

DevOps Live London

Click to view

Event

FS-ISAC Spring Americas Summit

FS-ISAC Spring Americas Summit

Click to view

Event

Lightsaber Stunt Training for AppSec Nerds

Meet other AppSec practitioners, learn some stage combat lightsaber moves from a legit stunt choreographer, and enjoy snacks and drinks on us.

Click to view

Event

Software Supply Chain (SSC) Security & Craft Beer

Software Supply Chain (SSC) Security & Craft Beer

Click to view

Event

Innovate Peer Panel - Atlanta

Innovate Peer Panel - Atlanta

Click to view

Event

GuidePoint Security CKO

GuidePoint Security CKO

Click to view

Event

Chicago Java Users Group Meetup

Chicago Java Users Group Meetup

Click to view

Event

NDC Security

NDC Security

Click to view

Event

Lightsaber Stunt Training for AppSec Nerds

Meet other AppSec practitioners, learn some stage combat lightsaber moves from a legit stunt choreographer, and enjoy snacks and drinks on us.

Click to view

Event

Black Hat Europe 2024

Black Hat Europe 2024

Click to view

Event

OWASP Birmingham December Meeting

OWASP Birmingham

Click to view

Event

OWASP BeNeLux Days

OWASP BeNeLux Days

Click to view

Event

C-Vision National CIO & CISO Summit

C-Vision National CIO & CISO Summit

Click to view

Event

GitHub Universe

GitHub Universe

Click to view

Event

FS-ISAC Fall Americas Summit 2024

Register Today!

Click to view

Event

LASCON 2024

Register Today!

Click to view

Event

OWASP New York Meetup

OWASP NY Meetup

Click to view

Event

SINET New York 2024

SINET New York 2024

Click to view

Event

Lightsaber Stage Combat Training for AppSec Nerds - New York

Lightsaber Stage Combat Training for AppSec Nerds - New York

Click to view

Event

CISO XC

CISO XC

Click to view

Event

Innovate Cybersecurity Summit, Scottsdale

Innovate Cybersecurity Summit, Scottsdale

Click to view

Event

Information Warfare Summit

Information Warfare Summit

Click to view

Event

OWASP MSP October Meetup

OWASP MSP October Meetup

Click to view

Event

OWASP 2024 Global AppSec, SF

Meet Endor Labs at OWASP Global AppSec SF

Click to view

Event

Dependency Management Report 2024

The Dependency Management Report explores emerging OSS dependency trends to consider as part of an SDLC security strategy.

Click to view

Event

Nordic Software Security Summit

Request a Meeting

Click to view

Event

Bay Area Bazel Meet-up

Bay Area Bazel Meet-up

Click to view

Event

OWASP Tampa Chapter 2024 Q3 Lunch and Learn

OWASP Tampa Chapter 2024 Q3 Lunch and Learn

Click to view

Event

Mastering OSS Security: Validating Vulnerabilities with Code-Level Reachability Analysis

Join this 45-minute webinar to learn how to prioritize OSS vulnerabilities using code-level reachability analysis, call graphs, and other parameters for effective vulnerability management

Click to view

Event

Give Devs the Confidence to Fix: Making Remediation Less Painful

Join this 60-minute webinar to learn how you can reduce the research required to understand the impact of dependency upgrades.

Click to view

Event

Black Hat - Las Vegas, USA 2024

Meet Endor Labs at Black Hat - Las Vegas, USA 2024

Click to view

Event

CSA San Francisco July Chapter Meetup

CSA - San Francisco Chapter Meetup

Click to view

Event

What's a Security Pipeline?

Join this 30-minute webinar to learn about common patterns and tradeoffs for security pipelines.

Click to view

Event

Happy Hour at OWASP Global 2024 AppSec

Endor Labs Happy Hour at OWASP Global 2024 AppSec

Click to view

Event

OWASP - LA Monthly Meet-up In-Person, June 2024

Meet Endor Labs at OWASP - Los Angeles, Monthly Meet-up

Click to view

Event

Meet Endor Labs at Evanta New York CISO Executive Summit

Register today!

Click to view

Event

OWASP 2024 Global AppSec, Lisbon 2024

Meet Endor Labs at OWASP Global AppSec Lisbon

Click to view

Event

London Java Community Summer Unconference 2024

Schedule a Meeting

Click to view

Event

OWASP Amsterdam, Netherlands - June 2024 Chapter Meetup

Join us for a conversation on harnessing reachability analysis to discern real threats.

Click to view

Event

Managing Open Source Vulnerabilities for PCI DSS Compliance

Click to view

Event

OWASP AppSec Days Pacific Northwest Conference - 2024

Register Today!

Click to view

Event

Engineering Leader Mixer

An interactive event for engineering leaders to network and get ideas for how to ship secure code

Click to view

Event

OWASP Porto, Portugal - May 2024 Chapter Meetup

Join us for a conversation on harnessing reachability analysis to discern real threats.

Click to view

Event

OWASP Lisboa - May 2024 Chapter Meetup

Join us for a conversation on harnessing reachability analysis to discern real threats.

Click to view

Event

Security Executive Round Table & Dinner in Hartford

Join us at a restaurant in Hartford, CT for executive round table and dinner

Click to view

Event

GuidePoint Security Cup at Geneva National Resort 2024

Register today!

Click to view

Event

Software Supply Chain Summit: Bridging Theory and Practice

Register today!

Click to view

Event

Meet Endor Labs at FS-ISAC EMEA

Register today!

Click to view

Event

PyCon US 2024

We will be at the PyCon Main Conference from May 17 to May 19

Click to view

Event

OWASP Northern Virginia - May 2024 Chapter Meetup

Join us for a conversation on managing open source vulnerabilities for PCI DSS compliance.

Click to view

Event

OWASP Portland - May 2024 Chapter Meetup

Join us for a conversation on managing open source vulnerabilities for PCI DSS compliance.

Click to view

Event

Intro to Endor Labs

Learn how Endor Labs supports a software supply chain security program, from OSS code to pipelines to compliance.

Click to view

Event

Join Endor Labs and GitHub for a Directors' Breakfast at RSA

Please join Endor Labs & GitHub on May 7th for an interactive executive breakfast focused on navigating the software supply chain security landscape without taxing developers.

Click to view

Event

Join Endor Labs and GitHub for an Executive Breakfast at RSA

Please join Endor Labs & GitHub on May 7th for an interactive executive breakfast focused on navigating the software supply chain security landscape without taxing developers.

Click to view

Event

Escape the RSA Chaos with Endor Labs and GitHub at the AppSec Lounge

Join Endor Labs and GitHub to refuel and refresh at TRACE before heading back to the Moscone Center to enjoy RSAC.

Click to view

Event

Meet Endor Labs at Day of Shecurity

Register today!

Click to view

Event

ISC2 Worcester 2024 | What's in Your AI Code

Join us as we speak about 'What's in your AI code?' at ISC2 Chapter Eastern Massachusetts

Click to view

Event

2nd Annual NFL Draft Party

Register for a great tech talk featuring Karthik Swarnam (ArmorCode), Karl Mattson (Noname Security) & Chris Hughes (Endor Labs) to discuss current trends in application security & vulnerability management.

Click to view

Event

Supply Chain Cyber Security Summit 2024

Join us for the Panel Discussion on Boosting Software Supply Chain Maturity to the Next Level with SBOM

Click to view

Event

Let's Taco 'bout Cyber

Join us at Barrio in Chicago for networking, gourmet tacos, and a discussion on how CISOs respond to securing AI initiatives.

Click to view

Event

Meet Endor Labs at Devnexus 2024

Join us at Devnexus, a largest Java Ecosystem Conference as we uncover the open source security for Java apps.

Click to view

Event

Artifact Signing 101

Join Endor Labs for a webinar on how to use artifact signing to enable code traceability, admission control, and provenance. Register now.

Click to view

Event

Meet Endor Labs at SnowFroc

Click to view

Event

Prioritizing SCA Findings with Reachability Analysis

Join Endor Labs for a webinar on how reachability analysis can reduce SCA noise by 80%+. Register now.

Click to view

Event

Meet Endor Labs at FS-ISAC America's Spring Summit

RSVP today!

Click to view

Product

Endor Open Source

Automate OSS selection and approval, identify applicable risks, reduce SCA noise by 92%, and remediate issues faster.

Click to view

Product

Endor SBOM Hub

Centralize your SBOM management with Endor SBOM Hub, featuring comprehensive risk analysis and continuous monitoring capabilities.

Click to view

Product

Endor CI/CD

Optimize your CI/CD pipelines with Endor Labs for superior code security, complete build integrity verification, and robust repository protection.

Click to view

Use case

Code Scanning

Endor Labs brings together Reachability-Based SCA, SAST, Secrets, CI/CD, and Container Scanning in a single, remediation-focused platform. Go beyond detection—correlating findings across scanners and cutting through the noise with reachability and deep program analysis.

Click to read

Use case

SAST & Secret Detection

Consolidate SAST, SCA, Container Scanning, and Secret Detection into a single platform with Endor Labs.

Click to read

Use case

AI Code Governance

Evaluate open source packages and AI Models for security, popularity, quality and activity.

Click to read

Use case

SCA with Reachability

Target the most critical vulnerabilities in your OSS packages for better code health and security.

Click to read

Use case

Container Scanning

Reduce noise by consolidating SCA and containers.

Click to read

Use case

Compliance & SBOM

Centrally manage SBOMs and VEX for compliance, including legal and licensing integrity.

Click to read

Use case

Upgrades & Remediation

Fix what’s easy, and magically patch hard-to-upgrade packages

Click to read

Use case

Artifact Signing

Enable application provenance for admission control, incident response, and compliance.

Click to read

Use case

AI Apps

SCA for Python-based AI applications

Click to read

Use case

Bazel Monorepos

SCA for Bazel including native Bazel rules for Java, Python, and Golang.

Click to read

Use case

Digital Operational Resilience Act (DORA)

Achieve DORA compliance for managing open source software vulnerabilities.

Click to read

Use case

PCI DSS

Achieve PCI DSS v4 compliance for managing open source software vulnerabilities.

Click to read

Use case

SBOM Ingestion

A one-stop-shop to store, manage, and analyze SBOMs with continuous risk monitoring.

Click to read

Use case

RSPM

Enforce source code best practices with Repository Security Posture Management.

Click to read

Use case

GitHub Actions

Prevent pipeline attacks caused by vulnerabilities and malware in CI workflows.

Click to read

Use case

CI/CD Discovery

Establish automated controls to reveal what’s running in your pipelines.

Click to read

Sorry, we couldn't find what you're looking for.
View All Results