Compliance and SBOM programs that improve software transparency.

Ensure compliance across the SDLC by detecting legal and licensing risk, and centrally create, manage, and analyze SBOM & VEX.

Welcome to the resistance

Oops! Something went wrong, please try again.

How it works

One-click SBOM & VEX

Prepare for mandates by exporting accurate SBOMs & VEX documents that automatically annotates which vulnerabilities impact you.

Detect legal & license risk

Keep track of license risks in your open source dependencies and enforce policies that ensure new packages use the right licenses.

Prioritize for FedRamp & PCI

Discover gaps in security coverage across pipelines and enforce policies that detect violations of standards like CIS Benchmark.

Securing code written by humans and AI at:

Compliance and SBOM programs that improve software transparency.

Ensure compliance across the SDLC by detecting legal and licensing risk, and centrally create, manage, and analyze SBOM & VEX.

Loved by security teams, painless for developers at:

How it works

One-click SBOM & VEX

Prepare for mandates by exporting accurate SBOMs & VEX documents that automatically annotates which vulnerabilities impact you.

Detect legal & license risk

Keep track of license risks in your open source dependencies and enforce policies that ensure new packages use the right licenses.

Prioritize for FedRamp & PCI

Discover gaps in security coverage across pipelines and enforce policies that detect violations of standards like CIS Benchmark.

No items found.

Store centrally and automate import/export
Detect new risks in 3rd party code
Enrich 1st party SBOMs with VEX
Create SBOMs for every supported language

Book a Demo

Restrict license types or specific licenses
Prioritize legal risk for in-use dependencies
Find licenses that match your risk profile

Book a Demo

Determine code provenance
Prioritize applicable vulnerabilities for PCI-DSS and FedRamp
Accelerate compliance with CIS, NIST, SSDF, SLSA, EO 14028, and more

Book a Demo

Discover every tool that touches your code
Find gaps in your security coverage
Define policies to keep repositories compliant

Book a Demo

Start a Trial

Book a Demo

Welcome to the resistance

Oops! Something went wrong, please try again.

Article

Endor Labs Named to Rising in Cyber by CISOs and Venture Capital Investors

Company Recognized for Creating Secure Supply Chains that Improve Application Development Productivity

Click to read

Article

Evaluating and Scoring OSS Packages

How can you tell if an OSS package is “good” or “bad”? A rigorous evaluation model, such as the Endor Score, can help developers make quick and informed decisions.

Click to read

Article

Demystifying Transitive Dependency Vulnerabilities

95% of vulnerabilities are found in transitive dependencies. Learn how they’re unique from direct dependencies and how to incorporate them into your risk management program.

Click to read

Article

Surprise! Your GitHub Actions Are Dependencies, Too

GitHub Actions are open source dependencies - secure them accordingly! Learn how to effectively manage the security risks associated with GitHub Actions with a proactive approach focusing on three key areas: visibility, hardening, and dependency management.

Click to read

Article

OSS Vulnerabilities and the Digital Operational Resilience Act (DORA)

Learn how your organization can achieve DORA compliance for managing open source software vulnerabilities with reachability-based SCA, SBOMs, and more.

Click to read

Article

Protect Mobile Apps with Kotlin and Swift SCA

Learn about the mobile application threat landscape and how you can protect mobile apps from security and legal risk associated with open source software with Endor Labs Open Source.

Click to read

Article

Intro to Endor Labs - On-Demand Webinar

Watch this 30-minute on-demand webinar to learn how to Endor Labs supports a Software Supply Chain Security program.

Click to read

Article

OWASP OSS Risk 1: Known Vulnerabilities

Known vulnerabilities are a well-understood software risk…but managing and prioritizing them is anything but simple. Learn about key considerations when building a program to detect and remediate CVEs.

Click to read

Article

Low-Code/No Code Artifact Signing

A low-code/no code artifact signing solution makes it easy to implement an enterprise solution for verifying authenticity of software artifacts and tracing their origins.

Click to read

Article

An Auditor’s Perspective on Addressing OSS Vulnerabilities for PCI DSS v4

Learn how your organization can achieve PCI DSS v4 compliance for managing open source software vulnerabilities with reachability-based SCA and more.

Click to read

Article

Your Git Repo is a Supply Chain Risk

Source code repository misconfigurations can expose your organization to supply chain attacks. Repository Security Posture Management (RSPM) can offer a reliable system to enforce best practices.

Click to read

Article

Guide to Implementing Software Supply Chain Security

In this free guide, experts answer key questions like "what is it?", "why is it important?", "and how do I secure it?" so you can make informed decisions and thoughtfully design your organization's SSCS program.

Click to read

Article

Improve Kubernetes Security with Signed Artifacts and Admission Controllers

Control which images get deployed in Kubernetes by configuring an admission controller to admit only those which have been signed by Endor Labs.

Click to read

Article

AppSec Goes to Devnexus: Lessons from a Thriving, Modern Java Community

What happens when an AppSec professional attends a Java conference? Great conversations on productivity, tool pain, AI/ML, and vulnerability management.

Click to read

Article

Artifact Signing 101 - On-Demand Webinar

Watch this 30-minute on-demand webinar to learn using strong cryptographic artifact signatures to enable strong admission control, provenance, and traceability that support effective security, quality, and compliance programs.

Click to read

Article

XZ Backdoor: How to Prepare for the Next One

While it’s improbable to prevent all exposure to supply chain risks, organizations can absolutely focus on a strategy to reduce the probability of successful attacks and reduce the time it takes them to respond to such threats.

Click to read

Article

XZ is A Wake Up Call For Software Security: Here's Why

The xz backdoor shines a light on everything we're doing wrong in software supply chain security. Get an overview of the incident, what we can learn from it, and what we can do about it.

Click to read

Article

SSDF Compliance and Attestation

Learn ways to comply with SSDF requirements for secure environments, trusted source code supply chains, code and artifact provenance, and vulnerabilities.

Click to read

Article

You Have a Shadow Pipeline Problem

Learn how to establish automated CI/CD controls to reveal what’s running in your pipelines and which configs don’t align with risk and compliance requirements.

Click to read

Article

Remediating Vulnerabilities vs. Maintaining Current Dependencies

Learn about the pros and cons of maintaining current dependencies, backed by a TU Delft study on 262 Java projects on Github

Click to read

Article

Prioritizing SCA Findings with Reachability Analysis - On-Demand Webinar

Watch this 30-minute on-demand webinar to learn how reachability analysis works.

Click to read

Article

Signing Your Artifacts For Security, Quality, and Compliance

Code Signing and other Artifact Signing enable application provenance to enhance admission control, incident response, and other essential capabilities.

Click to read

Article

Detect Malicious Packages Among Your Open Source Dependencies

Learn about emerging malicious code trends, including typosquatting and dependency confusion attacks, and two techniques for detecting malware in your applications.

Click to read

Article

Tom Gleason Joins Endor Labs as VP of Customer Solutions

Tom Gleason is a security enthusiast with a knack for building and leading technically-focused customer teams. Formerly at Snyk, Akamai, and Palo Alto Networks, Tom joins Endor Labs to lead Customer Solutions.

Click to read

Article

Introducing CI/CD Security with Endor Labs

Endor Labs CI/CD helps organizations secure their pipelines through pipeline discovery, repository security posture management, and build integrity verification (artifact signing).

Click to read

Article

How to Improve SCA in GitHub Advanced Security - Tutorial

In this short video we demonstrate how to use Endor Labs and GitHub Advanced Security to manage and prioritize open source risk.

Click to read

Article

How to Ingest and Manage SBOMs - Tutorial

In this short video we demonstrate how to ingest 1st and 3rd party software bills of material, manage them centrally, and detect new vulnerabilities in a timely manner.

Click to read

Article

VMware Achieves SBOM Compliance for Over 100 Services with Endor Labs

Learn how the VMWare compliance team built a a scalable process to collect and attest to SBOMs using Endor Labs.

Click to read

Article

AI-Supported Environment Debugging for Endor Labs

Testing and installing new security tools is painful. Using generative AI, DroidGPT by Endor Labs makes it easy to troubleshoot and even prevent compatibility errors when installing the platform.

Click to read

Article

How to Generate SBOM and VEX - Tutorial

In this short video we demonstrate how to use Endor Labs to produce SBOM and VEX documents.

Click to read

Article

How to Use AI for Open Source Selection - Tutorial

In this short video we demonstrate how to use DroidGPT to research open source packages in a conversational manner.

Click to read

Article

Introducing a Better Way to SCA for Monorepos and Bazel

Endor Labs’ reachability-based SCA now supports Bazel so you can get fully accurate results without any of the messy workarounds usually required for monorepos.

Click to read

Article

5 Types of Reachability Analysis (and Which is Right for You)

Explore the five key categories of reachability and their practical applications in AppSec and development. Learn the differences between SCA and container scanning, and understand how various tools like Function-Level Reachability, Package Baselining, and Internet Reachability play crucial roles in identifying and prioritizing security risks.

Click to read

Article

What’s in a Name? A Look at the Software Identification Ecosystem

Learn best practices for a proper software identification ecosystem that supports asset inventory, version control, vulnerability management, incident response, and more.

Click to read

Article

What You Need to Know About Apache Struts and CVE-2023-50164

Discover the critical details of CVE-2023-50164, a severe vulnerability in Apache Struts.

Click to read

Article

Introducing JavaScript Reachability and Phantom Dependency Detection

Endor Labs’ JavaScript SCA capabilities cut down noise with a program analysis approach that outperforms manifest scanning SCA tools like Snyk, Veracode, and BlackDuck.

Click to read

Article

MileIQ Securely Reimagines a Decade Old Product with Endor Labs

Lean MileIQ, the #1 mileage tracking app, selected Endor Labs to help their security and engineering teams focus on the software supply chain risks that actually matter.

Click to read

Article

How CycloneDX VEX Makes Your SBOM Useful

Explore the challenges of modern vulnerability management and the efficiency of the Vulnerability Exploitability eXchange (VEX) in our latest blog post. Learn how VEX helps identify and communicate the true exploitability of vulnerabilities, streamlining cybersecurity efforts in the face of overwhelming scanner findings.

Click to read

Article

How to Scan and Prioritize Valid Secrets - Tutorial

In this short video we demonstrate how to use Endor Labs to discover if your organization has leaked valid secrets and provide developers with instructions for resolving the leak.

Click to read

Article

SBOM Requirements for Medical Devices

Learn about the 2023 FDA rule for medical devices, including requirements for SBOMs, a mitigation plan, and secure software development practices.

Click to read

Article

CISA and NCSC's Take on Secure AI Development

A breakdown of the "Guidelines for Secure AI System Development document from CISA and NCSC.

Click to read

Article

Open Source Security 101: How to Evaluate Your Open Source Security Posture

Organizations need to evolve their approach to using open source securely. Find four fundamental considerations to consider when it comes to securely using OSS.

Click to read

Article

Endor Labs is a CRN 2023 Stellar Startup!

CRN®, a brand of The Channel Company, has named Endor Labs to its 2023 Stellar Startups list in the Security category. Learn more about the list and us here.

Click to read

Article

How to Prioritize Reachable Open Source Software (OSS) Vulnerabilities - Tutorial

In this short video we demonstrate how to use Endor Labs for reachability-based SCA and noise reduction.

Click to read

Article

Open Source Security for Python and AI Apps

Gain visibility into your hidden Python dependencies and prioritize reachable, exploitable risks.

Click to read

Article

How To Evaluate Secret Detection Tools

An overview of 3 requirements for a secret detection program, and how to do it with Endor Labs.

Click to read

Article

Why SCA Tools Can't Agree if Something is a CVE

One scanner says this is a CVE, and the other says it's not. Which is right?

Click to read

Article

5 Federal Software Supply Chain Requirements You Should Be Aware Of

If you’ve been watching the software supply chain security space evolve, you likely know that a lot of the momentum and effort is coming out of the U.S. Federal government. This may seem surprising at first, but it shouldn’t be, when you account for the fact that the Federal government is one of the single largest procurers of technology and software in the world.

Click to read

Article

You Found Vulnerabilities in Your Dependencies, Now What?

Third-party open source dependencies offer convenience but also pose a significant security risk. Learn how tools like Endor Labs can detect & address vulnerabilities here.

Click to read

Article

Dependency Resolution in Python: Beware The Phantom Dependency

Phantom dependencies are dependencies used by your code that are not declared in the manifest. If you miss them, they can sneak reachable risks into your application, lead to false positives, or inaccurate SBOMs. All very spooky. This article breaks down how phantom dependencies happen, and how to catch them.

Click to read

Article

Chris Hughes Joins Endor Labs as Chief Security Advisor

Chris Hughes brings nearly 20 years of IT and cybersecurity experience to his role as Chief Security Advisor. Learn what made him choose Endor Labs.

Click to read

Article

Understanding Python Manifest Files

In this blog, we delve into the various Python manifest files used to declare dependencies and how they collaborate seamlessly.

Click to read

Article

Why Your SCA is Always Wrong

A breakdown of why your SCA results are always so full of false positives (and sometimes false negatives), and why treating source code as a first class citizen can lead us to the solution.

Click to read

Article

Endor Labs Named 2023 SINET16 Innovator Award Winner

SINET, an organization with the mission to accelerate Cybersecurity innovation through public-private partnerships, announced today that Endor Labs is one of the winners of its annual SINET16 Innovator Award. Endor Labs and 15 other emerging companies are identified as the most innovative and compelling technologies in their fields to address Cybersecurity threats and vulnerabilities.

Click to read

Article

Combining EPSS and Reachability Analysis to Optimize Vulnerability Management

Exploit Prediction Scoring Systems (EPSS) is a data set that helps you understand the likelihood that a CVE will be exploited. Learn what the EPSS includes and how to use it to prioritize vulnerability remediation.

Click to read

Article

Reachability Analysis for Python, Go, C# - Webinar

In this on-demand webinar, get an in-depth reachability analysis for Python, Go, and C#. Watch now.

Click to read

Article

Introducing Reachability-Based SCA for Python, Go, and C#

Announcing new language support for Endor Labs Open Source

Click to read

Article

The Open Source Security Index Top 5

What’s the best of the best when it comes to open source security tools?We’ve previously talked about the OpenSSF Scorecard, which gives developers a high-level snapshot of the security of any given open source project. But in this post, we’ll talk about a related project, the Open Source Security Index (OSSI), which does something slightly different and complementary.

Click to read

Article

Faster SCA with Endor Labs and npm Workspaces

As projects grow larger and more complex, developers face challenges in maintaining a clean and efficient development workflow. Fortunately, npm workspaces offer an essential solution to streamline JavaScript development. In this blog post, we will explore the concept of npm/yarn workspaces, its importance, and how Endor Labs works with them.

Click to read

Article

Key Questions for Your SBOM Program

All the questions (and some of the answers) you need before kicking off your SBOM program.

Click to read

Article

Endor Labs Raises $70M in Series A Funding to Reform Application Security

Endor Labs raises a total of $70M to achieve application security without the developer productivity tax. Here's what we're doing, and where we're going.

Click to read

Article

How Should I Prioritize Software Vulnerabilities?

CVSS, KEV, SVCC, EPSS, and reachability analysis are 5 method used to prioritize open source vulnerabilities for remediation. Do you need all 5? Which is the best? It turns out a combination of factors (and a tool that can bring it all together) is the best solution.

Click to read

Article

Divide and Hide: How Malicious Code Lived on PyPI for 3 months

The Station 9 research team discovered malicious code that was divided and distributed across different packages, remaining obfuscated for months while getting nearly 2000 downloads.

Click to read

Article

Endor Labs’ ‘State of Dependency Management 2023’ Report Offers Insight on Explosive Popularity of AI and LLMs—and How They Impact Application Security

The State of Dependency Management 2023 reports on the latest research on dependency management and how AI is impacting the application security landscape.

Click to read

Article

State of Dependency Management 2023

Emerging trends impacting open source dependency management

Click to read

Article

Endor Labs Recognized as a Cool Vendor in the 2023 Gartner® Cool Vendors™ in Platform Engineering for Scaling Application Security Practices

Endor Labs is committed to providing cutting-edge solutions that address the challenges faced by platform engineering and DevSecOps teams in meeting application security needs.

Click to read

Article

Visualizing the Impact of Call Graphs on Open Source Security

A call graph is a visualization of invocation of vulnerable open source methods by a given client. Learn how to use call graphs to understand relevancy and impact of vulnerabilities.

Click to read

Article

Why Different SCA Tools Produce Different Results

Like anything in computer science and programming, there’s more than one way to solve a problem or get a result. SCA (software composition analysis) is no different.

Click to read

Article

Strengthening Security in .NET Development with packages.lock.json

Learn how packages.lock.json can help maintain a secure .NET development and why it should be part of your development workflow.

Click to read

Article

Highlights from State of Dependency Management 2022 - Webinar

In this on-demand webinar we discuss the key research findings from our 2022 report "State of Dependency Management."

Click to read

Article

How Security and Engineering Can Scale Open Source Security - Webinar

In this on-demand video we discuss open source dependency management and considerations for implementing AppSec programs to protect OSS.

Click to read

Article

Endor Labs is SOC 2 Type II Certified!

Proving once again open source governance doesn’t have to SOC, yes I made that joke again and I’m not sorry. We’re excited to announce we have received a clean audit result on our SOC2 Type II certification.

Click to read

Article

Reviewing Malware with LLMs: OpenAI vs. Vertex AI

At Endor Labs, we continue evaluating the use of large language models (LLMs) for all kinds of use-cases related to application security. And we continue to be amazed about high-quality responses … until we’re amused about the next laughably wrong answer.

Click to read

Article

Endor Labs Wins Intellyx Digital Innovation Award

We've been named a winner of the 2023 Intellyx Digital Innovator Award, recognizing technology providers driving enterprise digital transformation. Learn more.

Click to read

Article

Endor Labs Recognized As a 2023 Bay Area Best Place to Work

I mean, who wouldn't want to work with a bunch of Ewoks?

Click to read

Article

Make Developers' Lives Easier with Endor Labs & GitHub Advanced Security

Developers are bombarded with information every day. Constant context switching and information overload are among the biggest barriers to productivity. There are simply too many demands for their attention. One day the sales team will understand. Right?

Click to read

Article

LLM-assisted Malware Review: AI and Humans Join Forces to Combat Malware

Experiments with GPT-3.5 suggest that LLM-based malware reviews can complement, but not yet substitute human reviews. 1800 binary classifications performed with GPT-3.5 included false-positives and false-negatives.

Click to read

Article

Endor Labs Selected as Finalist for RSA Conference 2023 Innovation Sandbox

Endor Labs recognized for innovation in helping enterprises manage open source risk.

Click to read

Article

Announcing the Endor Labs Hyperdrive Program for Resellers and Solution Providers

The Hyperdrive partner program enables organizations of all sizes to embrace open source software with confidence.

Click to read

Article

Endor Labs partners with Zinfinity to help enterprise safely adopt Open Source Software

We’re excited to announce our latest partnership with Zinfinity as a strategic partner. Zinfinity is a global provider of technology solutions and services with a focus on Cyber Security, Cloud and Digital Infrastructure.

Click to read

Article

OWASP Top 10 Risks for Open Source

Emerging trends impacting open source dependency management

Click to read

Article

How to Quickly Measure SBOM Accuracy for Maven Projects (for Free)

SBOM-Lab is an open source tool that lets you quickly compare SBOM generation methods for Maven projects and find the right one for you.

Click to read

Article

Endor Labs is SOC2 Certified!

Open Source security doesn't have to SOC (sorry, I had to). We're excited to announce we have received a clean audit result on our SOC2 Type 1 certification.

Click to read

Article

Introduction to Open Source Security - Webinar

In this on-demand webinar we help you understand the basics of dependency management and how they can be vulnerable to security risks.

Click to read

Article

Comparing SBOMs Generated at Different Lifecycle Stages - Webinar

In this on-demand webinar, we share research on the variation in SBOMs depending on tool and when the documents are generated.

Click to read

Article

SBOM vs. SBOM: Comparing SBOMs from Different Tools and Lifecycle Stages

Software vendors active in certain verticals will soon be required to provide customers with SBOMs for their products. But how and when should an SBOM for a given piece of software be produced?

Click to read

Article

What Breaking Changes Teach Us about Security

GitHub rolled out a release that had some breaking changes to Git. Here's what we learned from it.

Click to read

Article

Open Source Licensing Simplified: A Comparative Overview of Popular Licenses

Explore the different types of open source licenses and how they impact the use, modification, and distribution of open source software. From GPL to Apache, MIT and more, learn the key differences between permissive and restrictive licenses and how to choose the right one for your project.

Click to read

Article

What is VEX and Why Should I Care?

An SBOM without VEX is like peanut butter without jelly. SBOM is a top buzzword in cybersecurity, but it's important to understand why VEX (Vulnerability Exploitability eXchange) is such a critical companion document.

Click to read

Article

Whatfuscator, Malicious Open Source Packages, and Other Beasts

Join Henrik to learn how his journey into Go programming turned into a path of malicious OSS packages.

Click to read

Article

Exploring Risk: Understanding Software Supply Chain Attacks

Naming and understanding the attack vectors at the disposal of our adversaries.

Click to read

Article

Endor Labs and Intuitive Partner to Help Enterprises Leverage OSS

Endor Labs and Intuitive.Cloud announce strategic partnership and investment with the goal of taking on OSS sprawl.

Click to read

Article

What is Reachability-Based Dependency Analysis?

Reachability analysis increases reliability of SCA results, allowing teams to quickly prioritize just the risks that matter.

Click to read

Article

State of Dependency Management 2022

In their inaugural report, the Station 9 research team explores the complexities of open source dependencies and the top security considerations for open source adoption at the enterprise.

Click to read

Article

Why We Need Static Analysis When Prioritizing Vulnerabilities - Webinar

In this on-demand webinar, we explain the role of static analysis of open source dependencies in an application security program.

Click to read

Article

What are Maven Dependency Scopes and Their Related Security Risks?

This article explores Maven dependency scopes: What are they, what are they used for, and how do they impact security risks?

Click to read

Article

The Government's Role in Maintaining Open Source Security

This blog summarizes highlights from Tragedy of the Digital Commons, by Strauss Center scholar and lecturer Chinmayi Sharma, where she shares the OSS state of affairs and her thoughts on improving security.

Click to read

Article

Introduction to Program Analysis

Program analysis is the process of checking whether or not a piece of software fulfills certain properties. This article explores the basics of program analysis, so we could then dive deeper into the world of call graphs.

Click to read

Article

More Than 30 Industry-Leading CISOs Personally Invest in Endor Labs

After a comprehensive diligence process on startups in the supply chain and open source security space, over 30 CISOs have chosen to personally back Endor Labs.

Click to read

Article

From Cloud Security to Code Security: Why We've Raised $25M to Take on OSS Dependency Sprawl

Endor Labs raises $25M seed round.

Click to read

Sorry, we couldn't find what you're looking for.

View All Results

By clicking “Accept”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.

Deny Accept

Compliance and SBOM programs that improve software transparency.

Ensure compliance across the SDLC by detecting legal and licensing risk, and centrally create, manage, and analyze SBOM & VEX.

Start Trial

One-click SBOM & VEX

Prepare for mandates by exporting accurate SBOMs & VEX documents that automatically annotates which vulnerabilities impact you.

Detect legal & license risk

Keep track of license risks in your open source dependencies and enforce policies that ensure new packages use the right licenses.

Prioritize for FedRamp & PCI

Discover gaps in security coverage across pipelines and enforce policies that detect violations of standards like CIS Benchmark.

How It Works

No items found.

Automate SBOM & VEX

Store centrally and automate import/export
Detect new risks in 3rd party code
Enrich 1st party SBOMs with VEX
Create SBOMs for every supported language

Help Devs Use the Right License

Restrict license types or specific licenses
Prioritize legal risk for in-use dependencies
Find licenses that match your risk profile

Comply with Emerging Standards

Determine code provenance
Prioritize applicable vulnerabilities for PCI-DSS and FedRamp
Accelerate compliance with CIS, NIST, SSDF, SLSA, EO 14028, and more

Ensure security coverage across pipelines

Discover every tool that touches your code
Find gaps in your security coverage
Define policies to keep repositories compliant

Get a Free Trial

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.

Get a free trial

Get a demo
of Endor Labs

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Article

Under the Hood: People.ai's Proactive Approach to AI Security

Hear how a CISO at an AI-first company is thinking about securing AI, and how AI should improve security programs.

Click to read

Article

People.ai transforms security and compliance with Endor Labs

People.ai uses Endor Labs for application security that provides an outstanding developer experience and makes it easier (and cheaper) to hit compliance targets.

Click to read

Article

Streamline Investigation with Enriched Vulnerability Search

Endor Labs Vulnerability Search helps you investigate CVEs with enriched metadata, call paths, and precise impact analysis—resolving conflicts across public feeds.

Click to read

Article

What is AppSec? A 2025 Guide for Security Practitioners

Learn what Application Security (AppSec) is, why it matters, and how to build a modern, scalable AppSec program across the SDLC.

Click to read

Article

Cracking the Code: Solving the Challenges of C/C++ Software Composition Analysis

This whitepaper details Endor Labs’ novel approach to indexing open source dependencies and detecting vulnerabilities in C and C++ codebases.

Click to read

Article

Mysten Labs Improves DevEx with Endor Labs

Within weeks of deployment, Endor Labs helped Mysten Labs transform its application security strategy.

Click to read

Article

Under the Hood: Mysten Labs’ Strategies for Building the Most Secure Blockchain

How Mysten Labs builds secure and low-friction systems for blockchain by focusing on code ownership, usability, and AppSec strategy.

Click to read

Article

Zebra Technologies Cuts SCA Noise by 97% with Endor Labs

With fewer alerts and more accuracy, Zebra Technologies now spends more time building and less time chasing false positives.

Click to read

Article

Next-Gen SCA for C/C++: Closing the Detection Gap

A new method for identifying OSS dependencies and vulnerabilities in C/C++ with greater accuracy and precision than legacy tools.

Click to read

Article

Critical SQL Injection Vulnerability in LlamaIndex (CVE-2025-1793) – Advisory and Analysis

The critical SQL injection vulnerability in LlamaIndex shows how LLMs can be a backdoor into your vector store

Click to read

Article

AppSec’s Exploitation Era: What Verizon, Mandiant, and Datadog Are Telling Us

A breakdown of DBIR, M-Trends, and DevSecOps reports and what they reveal about the future of AppSec in the age of AI.

Click to read

Article

Benchmarking Opengrep Performance Improvements

Opengrep's improvements to rule load times resulted in 3.15x faster average scan times than Semgrep

Click to read

Article

The UK Software Security Code of Practice through a Software Supply Chain Lens

How the UK Software Security Code of Practice reshapes supply chain security—and how Endor Labs helps vendors meet its core requirements.

Click to read

Article

CVE-2025-47949 Reveals Flaw in samlify That Opens Door to SAML Single Sign-On Bypass

Information on the likelihood and impact of CVE-2025-47949

Click to read

Article

Endor Labs Policies: Developer-Friendly Security Automation

This whitepaper talks about how Endor Labs uses context-aware security policies, like finding, action, exception, and remediation policies, to reduce noise, improve remediation speed, and help developers focus on real risks.

Click to read

Article

CVE-2025-4641 is Critical, But Likely Unreachable

Critical CVE-2025-4641 in WebDriverManager likely poses low real-world risk, but it should still be on radar. Here’s what you need to know, plus quick steps to check versions, upgrade, and secure CI pipelines.

Click to read

Article

Mastering Security Automation: Exception and Remediation Policies

Learn how Endor Labs cuts through security noise, stops unnecessary build breaks, and keeps developers focused on real risks—making security policy automation truly developer-friendly.

Click to read

Article

5 Tips for Managing Bazel Dependencies (Without Losing Friends)

Upgrading dependencies in a Bazel monorepo? Learn 5 tips to avoid breakages, reduce risk, and keep your team (and builds) running smoothly.

Click to read

Article

Why Security Policies Frustrate Developers (and How We Can Fix Them)

Most security policies create more problems than they solve, overwhelming developers with noise and unnecessary build breaks. Here's what a better approach looks like.

Click to read

Article

Open Source Gets Political: What The easyjson Debate Misses (and what to do about it)

A look at the easyjson controversy, open source provenance, and how Go's built-in protections help teams manage risk without overreacting.

Click to read

Article

Why We Raised a $93M Series B (In This Market)

Endor Labs raised a $93M Series B to accelerate its mission of securing the AI-driven software era. Learn why top investors preempted the round—and how Endor is redefining AppSec for modern development.

Click to read

Article

Secure AI-Generated Code at the Source

This solution brief shows how application security teams can fix risks from AI-generated code earlier in development and become the catalyst for secure, scalable adoption of AI coding tools like GitHub Copilot and Cursor in their organizations.

Click to read

Article

AI Security Code Review: A Multi-Agent Approach for Detecting Security Design Flaws at Scale

This whitepaper introduces how AI Security Code Review works, what it detects, how it integrates into your workflows, and why it represents the next generation of code scanning technology — built for the complexity and speed of AI-native software development.

Click to read

Article

Introducing the Endor Labs MCP Server: fix-first security for the vibe coding era

Endor Labs MCP Server powers real security fixes for vibe coding and AI-generated code—reduce noise and help AI tools fix risks for you.

Click to read

Article

Introducing AI Security Code Review

Endor Labs helps application security teams identify the few code changes that impact their security architecture across thousands of pull requests.

Click to read

Article

Meet the application security platform built for the AI era

The era of vibe coding is here. Learn how Endor Labs is helping AppSec teams secure and fix AI-generated code with a new agentic AI platform.

Click to read

Article

Critical RCE Vulnerability in Apache Parquet (CVE-2025-30065) – Advisory and Analysis

Endor Labs advisory: Critical CVE-2025-30065 in Apache Parquet lets attackers run code via schema parsing. Patch now by upgrading to version 1.15.1.

Click to read

Article

OWASP OSS Risk 2: Compromise of Legitimate Package

OWASP OSS Risk 2: Explore the compromise of legitimate open-source packages, with an in-depth case study of the tj-actions/changed-files GitHub Action supply chain attack.

Click to read

Article

Blast Radius of the tj-actions/changed-files Supply Chain Attack

Analysis of the tj-actions/changed-files GitHub Actions compromise, assessing the impact and damage from the attack.

Click to read

Article

What You Need to Know About UK Cyber Essentials Certification

Cyber Essentials helps UK businesses guard against internet-based attacks and prove their security measures are truly effective.

Click to read

Article

GitHub Action tj-actions/changed-files supply chain attack: what you need to know

GitHub Action tj-actions/changed-files was compromised, exposing CI/CD secrets. Learn how this attack impacts repositories and what steps to take now.

Click to read

Article

Application Security Posture Management (ASPM) Explained

Learn when application security posture management (ASPM) solutions work, their limitations, and alternatives for cutting through security alert noise.

Click to read

Article

How Endor Patches Are Built and Tested

Endor Patches are backported open-source security fixes. Learn how we build and test Endor Patches for compatibility and security.

Click to read

Article

The AppSec Maturity Staircase: Climbing Faster, Not Harder with Endor Labs

Each stage of the application security maturity staircase evolves your program—and Endor Labs is your escalator to the top.

Click to read

Article

How to Get Developers to Accept Security PRs Faster

Improve your mean time to remediation (MTTR) with smarter automatic pull requests that use upgrade impact analysis to reduce alert fatigue for developers.

Click to read

Article

DeepSeek R1: What Security Teams Need to Know

Learn how to evaluate security risk factors for DeepSeek R1, and about important considerations for working with open source AI models.

Click to read

Article

How to Discover Open Source AI Models in Your Code

Use Endor Labs to discover, evaluate, and enforce policies governing the usage of open source AI models from Hugging Face in your applications.

Click to read

Article

Remote Code Execution Vulnerabilities in Apache Struts

CVE-2024-53677 and CVE-2023-50164 are vulnerabilities in Apache Struts that could pave the way for remote code execution, or RCE. Learn how to figure out if you’re affected, and if so what to do about it

Click to read

Article

Everything You Need to Know About Opengrep

Opengrep is a fork of Semgrep's open source static code analysis engine. Learn about the benefits and how you can contribute.

Click to read

Article

Uncover Trends and Show AppSec Value with the Endor Labs Dashboard

Vulnerability metrics can help you uncover remediation and SLA trends, and demonstrate the value of AppSec investments to your leadership.

Click to read

Article

Identifying and Tracking FedRAMP False Positives

False positives can make FedRAMP ConMon costly. Learn why it’s hard to accurately identify false positives and some tactics for making this process less challenging.

Click to read

Article

How Endor Labs Prioritizes Open Source Security Patches

Learn how Endor Labs targets the critical dependencies that are responsible for most of the open source vulnerabilities in the software supply chain.

Click to read

Article

Why Reachability Analysis for JavaScript Is Hard (and How We Fixed It)

JavaScript reachability is tricky for SCA tools because of how JavaScript approaches dependency resolution, dependency imports, and functions.

Click to read

Article

Endor Patches Whitepaper

When upgrading is too risky, complex, or time consuming due to regressions, breaking changes, or new bugs, you can use Endor Patches to stay safe now while still meeting your SLA requirements.

Click to read

Article

Grip Security Reduces Noise by 99%

Grip Security replaced their traditional SCA tool with Endor Labs to improve their ability to build trust with customers without taxing developers.

Click to read

Article

Grip Security Builds Customer Trust with AppSec

Grip Security values strong application security because it helps them build trust with their customers. Learn how a security company approaches AppSec.

Click to read

Article

The Uncomfortable Truth of Vulnerable and Outdated Software Components

Learn where common industry sayings such as “stay up to date” come from and how you can help Endor Labs help you overcome those challenges.

Click to read

Article

Reduce FedRAMP Compliance Costs

Endor Labs reduces false positives and prioritizes real vulnerabilities, helping your team meet FedRAMP requirements with less stress and lower costs.

Click to read

Article

Why OVAL Feeds Outperform NVD for Linux Vulnerability Management

Learn why OVAL feeds, curated by Linux distributions, offer more precise vulnerability data than the NVD, reducing container scanning false positives and wasted efforts.

Click to read

Article

Achieving FedRAMP’s Container Scanning Requirements

Click to read

Article

Breaking Changes, Breaking Trust

Click to read

Article

Reducing FedRAMP Compliance Costs with Endor Labs

Vulnerability Management for FedRAMP compliance is expensive; your SCA tool should help you make it cheaper and easier.

Click to read

Article

Microsoft Defender for Cloud Natively Integrates with Endor Labs

Integrate Microsoft Defender for Cloud with Endor Labs for reachability analysis and attack path visibility — available natively within the Defender for Cloud console. Prioritize what to fix without switching tools.

Click to read

Article

Hugging Face Model Score Curation at Endor Labs

Understand how models are factored and scored at Endor Labs, new exploration tab for HuggingFace models

Click to read

Article

Endor Labs Announces Integrated SAST Offerings

Endor Labs now integrates Static Application Security Testing (SAST) into your application security testing stack.

Click to read

Article

Understanding the Cyber Resilience Act

The Cyber Resilience Act (CRA) sets mandatory security requirements for hardware and software. This blog covers key compliance objectives, challenges with OSS vulnerabilities, and best practices for maintaining security throughout the product life cycle.

Click to read

Article

Start Clean With AI: Select Safer LLM Models with Endor Labs

You can now use Endor Labs to evaluate AI models on HuggingFace for security, popularity, quality, and activity.

Click to read

Article

The U.S. Government Prioritizes Open Source Governance and Security

The U.S. Federal government's FY 2026 Cybersecurity Priorities focus on securing open source software, improving governance, and supporting OSS sustainability to strengthen the software supply chain.

Click to read

Article

Understanding the Basics of Large Language Models (LLMs)

Understand what LLMs are, how foundational LLMs are built, the opportunities they offer and the risks they pose.

Click to read

Article

Container Layer Analysis: Clarity in Remediation

Container layer analysis tells you which layer contains a vulnerability so you can prioritize remediation efforts more effectively and meet SLAs like FedRAMP.

Click to read

Article

Endor Labs Achieves 92% Reduction in SCA Alerts

Endor Labs reduces open-source vulnerability noise by 92%, boosting productivity and improving collaboration between development and security teams.

Click to read

Article

Karl Mattson Joins Endor Labs as Chief Information Security Officer

We're thrilled to have Karl Mattson as Endor Labs first Chief Information Security Officer (CISO)!

Click to read

Article

Highlights from Our 2024 Dependency Management Webinar

Get key insights from the 2024 Dependency Management webinar with Darren Meyer and Henrik Plate. We discuss how to prioritize vulnerabilities, navigate breaking changes, and leverage public vulnerability databases effectively.

Click to read

Article

Relativity Blocks Risks with Endor Labs

Relativity changed their security program from a blocker to an enabler by integrating security into developer workflows and empowering developers to prevent risks before they ship to production.

Click to read

Article

Blocking with Confidence: Relativity's Dev Experience Journey

Relativity changed their security program from a blocker to an enabler by integrating security into developer workflows and empowering developers to prevent risks before they ship to production.

Click to read

Article

48 most popular open source tools for Python applications, scored

Discover the top open-source tools for Python applications, ranked by Endor Scores based on security, activity, popularity, and code quality.

Click to read

Article

FedRAMP Requirements for Vulnerability Management and Dependency Upgrades

This blog covers key steps to simplify FedRAMP vulnerability management, helping you reduce risks and meet compliance timelines. It also provides practical tips to empower developers and streamline fixes for a smoother FedRAMP process.

Click to read

Article

Fix Vulnerabilities Faster with Auto Patching and Endor Patches

Automatically patch open source libraries with Endor Patches during the build process, ensuring software is continuously protected against vulnerabilities without manual intervention.

Click to read

Article

Dependency Management Report

Click to read

Article

Announcing the 2024 Dependency Management Report

Our third-annual Dependency Management Report explores how emerging trends in open source security should guide SDLC security strategy.

Click to read

Article

Starburst Gets 98.3% Noise Reduction with Endor Labs

Starburst, an open data lakehouse, replaced Rezillion with Endor Labs for SCA. They improved their ability to identify and prioritize open source while complementing the developer experience.

Click to read

Article

Building a DevSecOps Practice at Starburst

Wondering how to build or revamp a DevSecOps program? Get some immediately useful tips that you can apply to your startup or mature enterprise…or anywhere in between.

Click to read

Article

What is CI/CD Security and What Tools Do You Need to Do it?

Learn what CI/CD security is, why it’s important, and discover the key tools Endor Labs offers to help you secure your CI/CD pipelines.

Click to read

Article

PWN Request Threat: A Hidden Danger in GitHub Actions

Endor Labs provides comprehensive CI/CD security for GitHub action workflows that detect patterns that may indicate PWN request threats.

Click to read

Article

Address Open Source Risks with Endor Labs

Click to read

Article

Endor Labs Brand Guidelines

Click to read

Article

Give Devs the Confidence to Fix: Making Remediation Less Painful

Endor Labs’ newest capabilities help you reduce the research required to understand the impact of dependency upgrades and Endor Magic Patches help you stay safe without changing versions.

Click to read

Article

Endor Labs Partners with Microsoft to Strengthen Software Supply Chains

Endor Labs is now available on Azure Marketplace!

Click to read

Article

Prioritize Open Source Risks with Endor Labs

Endor Labs provides several filters to help you prioritize which risks to address first, resulting in an average 92% noise reduction.

Click to read

Article

Discover Open Source Risks with Endor Labs

Use Endor Labs to get accurate dependency inventories and complete vulnerability data sources.

Click to read

Article

48 most popular open source tools for npm applications, scored

Discover the 48 most popular open-source npm tools, complete with Endor Scores, to help you choose the best dependencies for your projects based on security, activity, popularity, and code quality.

Click to read

Article

Benchmarking Endor Labs vs. Snyk’s GitHub Apps

Compare Endor Labs and Snyk GitHub Apps.

Click to read

Article

Using Artifact Signing to Establish Provenance for SLSA

Use artifact signing, a feature of Endor Labs, to support build provenance requirements for SLSA.

Click to read

Article

Fixed is Better than Found | Upgrades & Remediation with Endor Labs

At Endor Labs, we believe your application security tooling must go beyond alerting—it should also helpyou fast-track remediation.

Click to read

Article

How to Fix Vulnerabilities Without Breaking Changes

Click to read

Article

Introducing Upgrades & Remediation: Give Developers the Confidence to Fix

Upgrade Impact Analysis shows you what breaking changes a fix could cause. Endor Patches are trusted patches you can use when upgrades are too painful.

Click to read

Article

Static SCA vs. Dynamic SCA: Which is Better (and Why It's Neither)

Software composition analysis (SCA) tools can take a static or dynamic approach. Learn the pros and cons of each option and see how the results differ.

Click to read

Article

33 Most Popular Open Source Tools for Maven Applications, Scored

Explore the top 33 open source tools for Maven, scored by Endor Labs on security, activity, popularity, and code quality.

Click to read

Article

Endor Labs Partner Program Overview

Click to read

Article

Jellyfish Enables Data-Driven AppSec with Endor Labs

Jellyfish replaced Snyk with Endor Labs to improve their ability to identify, prioritize, address, and predict open source risk. Learn more!

Click to read

Article

Jellyfish’s Data-Driven Security Program

Learn how Jellyfish’s security team uses a data-driven approach to risk management and the role SCA plays in their strategy.

Click to read

Article

What's a Security Pipeline? - On-Demand Webinar

Learn about common patterns and tradeoffs for security pipelines in this introductory webinar.

Click to read

Article

Secure Everything Your Code Depends On With Endor Labs

While conventional code security tools drown teams in false positives, Endor Labs zeroes in on real risks, empowering developers without without slowing them down.

Click to read

Article

Endor Labs Receives Strategic Investment from Citi Ventures

Endor Labs, a leader in software supply chain security, today announced a strategic investment from Citi Ventures.

Click to read

Article

We made the Inc. Best Workplaces List for 2024!

Endor Labs is named to Inc.’s annual Best Workplaces list for 2024.

Click to read

Article

New CocoaPods CVEs: Swift and Objective-C Supply Chains Are Fragile

Three CocoaPods CVEs raise serious security concerns for consumers of Swift and Objective-C libraries used for macOS and iOS mobile development.

Click to read

Article

Questions to Ask Your Software Composition Analysis Vendor

When choosing an SCA tool, you’ll need to understand how the tool generates an inventory, correlates to risks, helps you prioritize results, and integrates into your toolchain.

Click to read

Article

Backstage and Endor Labs: AppSec in a Dev’s Dream Workspace

The Endor Labs plugins for Backstage create an application security experience that doesn’t require developers to leave Backstage.

Click to read

Article

Managing Open Source Vulnerabilities for PCI DSS Compliance - On-Demand Webinar

Watch this 30-minute on-demand webinar to learn about changes to PCI DSS that impact OSS vulnerability management.

Click to read

Article

Container Scanning + SCA = Better Together

We’re excited to announce that Endor Labs now extends our software supply chain platform to include container scanning.

Click to read

Sorry, we couldn't find what you're looking for.

View All Results