By clicking “Accept”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.
DenyAccept
18px_cookie
e-remove

Endor Labs Research

From AI coding agent benchmarks to software supply chain risks, Endor Labs research gives security teams the context they need to make faster, smarter decisions.

Threat Research

A continuously updated database of CVEs enriched with reachability and exploitability context, not just CVSS scores. Know which vulnerabilities actually matter in your codebase.

CVEs
Malware — coming soon
Explore CVEs
Glowing green digital graphic depicting an unlocked padlock and a warning symbol. Text reads "CVE-2026-XXXXX", suggesting cybersecurity vulnerability.

Supply Chain Risk Hub

Evaluate open source packages and AI models for security, license, and operational risks.

Models
Packages
Explore risks
Abstract geometric pattern featuring overlapping hexagons. Central hexagon in pink contrasts with surrounding green hexagons on a dark background.

AI Coding Agent Benchmark

How secure is AI-generated code? We benchmark popular coding agents across 200 real-world tasks and 77 CWE classes — independently, with no vendor involvement.

View Benchmark
Leaderboard table titled "Security View (OWASP/CWE)" with agent results. Codex at 62.6% functional, 17.3% secure. Cursor at 73.7% functional, 13.4% secure.
A digital illustration of three translucent green browser windows with lines representing code, layered against a dark background.

Reports

In-depth research reports from the Endor Labs team. Original data and analysis on the state of open source security, AI code risk, and dependency management.

State of Dependency Management 2025
View all reports

Risk Explorer

Explore interactive research on software supply chain attack patterns, threat relationships, and real-world exploit paths.

Explore Research
Highlighted section of programming code showing the Euclidean algorithm function, with a magnifying glass icon emphasizing part of the code.

OWASP Top 10 for Open Source

A practical framework highlighting the most critical open source software security risks and dependency management challenges.

View Top 10 Risks
List of the top 10 OWASP OSS risks including vulnerabilities, compromised packages, name confusion, outdated and untracked dependencies, and license risks.

Latest Research

The rest of the EU Cyber Resiliency Act lands on December 11th, 2027.
Blog
The rest of the EU Cyber Resiliency Act lands on December 11th, 2027.
Read More
Same analysis, your account: BYOK for Endor Labs AI SAST
Blog
Same analysis, your account: BYOK for Endor Labs AI SAST
Read More
Endor Labs and Bright Security Partner to Close the Gap Between Discovery and Remediation
Blog
Endor Labs and Bright Security Partner to Close the Gap Between Discovery and Remediation
Read More

See for yourself why Endor Labs is the fastest growing AppSec company ever.

This is some text inside of a div block.