Software Composition Analysis

SCA, but with reachability analysis that cuts 92% of noise.

You developers use open source packages, AI models, and AI services. Find out what they're using and fix risks fast.

Welcome to the resistance

Oops! Something went wrong, please try again.

How it works

Identify all dependencies

Go beyond classic SCA to discover all direct and transitive dependencies, including AI models and services.

Prioritize by danger

Combine reachability and EPSS to determine which vulnerabilities are the most dangerous, and remediate those first.

Fix faster

Identify upgrades that can be performed without risk of breaking changes and help engineering plan for the hard ones.

Securing code written by humans and AI at:

Software Composition Analysis

SCA, but with reachability analysis that cuts 92% of noise.

You developers use open source packages, AI models, and AI services. Find out what they're using and fix risks fast.

Loved by security teams, painless for developers at:

How it works

Identify all dependencies

Go beyond classic SCA to discover all direct and transitive dependencies, including AI models and services.

Prioritize by danger

Combine reachability and EPSS to determine which vulnerabilities are the most dangerous, and remediate those first.

Fix faster

Identify upgrades that can be performed without risk of breaking changes and help engineering plan for the hard ones.

Without the tedium and minutia of tracking down individual items that might not matter, we can focus on the remaining vulnerabilities that would impact customers and our FedRAMP compliance."

Raphael Theberge

Head of Security Enablement at Relativity

Identify

Know what’s in your code

The Endor Labs platform uses an unparalleled knowledge base of open source libraries and code relationships to understand your 3rd party dependencies— including open source libraries, AI models, and AI services.

Get an accurate inventory (direct and transitive dependencies) and export SBOM / VEX documents
Correlate inventory to the Endor Labs Vulnerability Database, based on NVD, GHSA, and OSV data along with a manually-annotated, function-level database for vulnerabilities going back to 2018 for 12 languages (and growing)
Detect OWASP Top 10 risks for open source, including CVEs, malicious code, and license risks

Book a Demo

Prioritize

See which vulnerabilities are riskiest

Endor Labs provides several filters to reduce false positives and decide which risks to address first. When used together, customers achieve a 92% reduction in findings, leaving just a handful to fix.

Is it in production code (not test code)?
Is there a fix available?
Is the affected function reachable?
Is there a high probability of exploit (high EPSS)?
How severe could the impact be (CVSS)?

‍

Book a Demo

Remediate

Actually fix vulnerabilities

Give developers the information needed to upgrade dependencies with confidence.

For each version upgrade option, identify whether conflicts with other dependencies will cause problems (like breaking changes)
Compare the number of findings fixed by a single upgrade to the effort it will take to perform the upgrade
Improve mean time to remediation (MTTR) with smarter automatic pull requests and Endor Patches

‍

Not even your developers have this information! They’ll thank you for saying “This upgrade will be easy” or “This other one might take a few sprints because there are breaking changes.”

Book a Demo

Start a Trial

AppSec for The Software Development Revolution

Book a Demo

AppSec for The Software Development Revolution

Welcome to the resistance

Oops! Something went wrong, please try again.

Article

Remediating Vulnerabilities vs. Maintaining Current Dependencies

Learn about the pros and cons of maintaining current dependencies, backed by a TU Delft study on 262 Java projects on Github

Click to read

Article

Prioritizing SCA Findings with Reachability Analysis - On-Demand Webinar

Watch this 30-minute on-demand webinar to learn how reachability analysis works.

Click to read

Article

Signing Your Artifacts For Security, Quality, and Compliance

Code Signing and other Artifact Signing enable application provenance to enhance admission control, incident response, and other essential capabilities.

Click to read

Article

Detect Malicious Packages Among Your Open Source Dependencies

Learn about emerging malicious code trends, including typosquatting and dependency confusion attacks, and two techniques for detecting malware in your applications.

Click to read

Article

Tom Gleason Joins Endor Labs as VP of Customer Solutions

Tom Gleason is a security enthusiast with a knack for building and leading technically-focused customer teams. Formerly at Snyk, Akamai, and Palo Alto Networks, Tom joins Endor Labs to lead Customer Solutions.

Click to read

Article

Introducing CI/CD Security with Endor Labs

Endor Labs CI/CD helps organizations secure their pipelines through pipeline discovery, repository security posture management, and build integrity verification (artifact signing).

Click to read

Article

How to Improve SCA in GitHub Advanced Security - Tutorial

In this short video we demonstrate how to use Endor Labs and GitHub Advanced Security to manage and prioritize open source risk.

Click to read

Article

How to Ingest and Manage SBOMs - Tutorial

In this short video we demonstrate how to ingest 1st and 3rd party software bills of material, manage them centrally, and detect new vulnerabilities in a timely manner.

Click to read

Article

VMware Achieves SBOM Compliance for Over 100 Services with Endor Labs

Learn how the VMWare compliance team built a a scalable process to collect and attest to SBOMs using Endor Labs.

Click to read

Article

AI-Supported Environment Debugging for Endor Labs

Testing and installing new security tools is painful. Using generative AI, DroidGPT by Endor Labs makes it easy to troubleshoot and even prevent compatibility errors when installing the platform.

Click to read

Article

How to Generate SBOM and VEX - Tutorial

In this short video we demonstrate how to use Endor Labs to produce SBOM and VEX documents.

Click to read

Article

How to Use AI for Open Source Selection - Tutorial

In this short video we demonstrate how to use DroidGPT to research open source packages in a conversational manner.

Click to read

Article

Introducing a Better Way to SCA for Monorepos and Bazel

Endor Labs’ reachability-based SCA now supports Bazel so you can get fully accurate results without any of the messy workarounds usually required for monorepos.

Click to read

Article

5 Types of Reachability Analysis (and Which is Right for You)

Explore the five key categories of reachability and their practical applications in AppSec and development. Learn the differences between SCA and container scanning, and understand how various tools like Function-Level Reachability, Package Baselining, and Internet Reachability play crucial roles in identifying and prioritizing security risks.

Click to read

Article

What’s in a Name? A Look at the Software Identification Ecosystem

Learn best practices for a proper software identification ecosystem that supports asset inventory, version control, vulnerability management, incident response, and more.

Click to read

Article

What You Need to Know About Apache Struts and CVE-2023-50164

Discover the critical details of CVE-2023-50164, a severe vulnerability in Apache Struts.

Click to read

Article

Introducing JavaScript Reachability and Phantom Dependency Detection

Endor Labs’ JavaScript SCA capabilities cut down noise with a program analysis approach that outperforms manifest scanning SCA tools like Snyk, Veracode, and BlackDuck.

Click to read

Article

MileIQ Securely Reimagines a Decade Old Product with Endor Labs

Lean MileIQ, the #1 mileage tracking app, selected Endor Labs to help their security and engineering teams focus on the software supply chain risks that actually matter.

Click to read

Article

How CycloneDX VEX Makes Your SBOM Useful

Explore the challenges of modern vulnerability management and the efficiency of the Vulnerability Exploitability eXchange (VEX) in our latest blog post. Learn how VEX helps identify and communicate the true exploitability of vulnerabilities, streamlining cybersecurity efforts in the face of overwhelming scanner findings.

Click to read

Article

How to Scan and Prioritize Valid Secrets - Tutorial

In this short video we demonstrate how to use Endor Labs to discover if your organization has leaked valid secrets and provide developers with instructions for resolving the leak.

Click to read

Article

SBOM Requirements for Medical Devices

Learn about the 2023 FDA rule for medical devices, including requirements for SBOMs, a mitigation plan, and secure software development practices.

Click to read

Article

CISA and NCSC's Take on Secure AI Development

A breakdown of the "Guidelines for Secure AI System Development document from CISA and NCSC.

Click to read

Article

Open Source Security 101: How to Evaluate Your Open Source Security Posture

Organizations need to evolve their approach to using open source securely. Find four fundamental considerations to consider when it comes to securely using OSS.

Click to read

Article

Endor Labs is a CRN 2023 Stellar Startup!

CRN®, a brand of The Channel Company, has named Endor Labs to its 2023 Stellar Startups list in the Security category. Learn more about the list and us here.

Click to read

Article

How to Prioritize Reachable Open Source Software (OSS) Vulnerabilities - Tutorial

In this short video we demonstrate how to use Endor Labs for reachability-based SCA and noise reduction.

Click to read

Article

Open Source Security for Python and AI Apps

Gain visibility into your hidden Python dependencies and prioritize reachable, exploitable risks.

Click to read

Article

How To Evaluate Secret Detection Tools

An overview of 3 requirements for a secret detection program, and how to do it with Endor Labs.

Click to read

Article

Why SCA Tools Can't Agree if Something is a CVE

One scanner says this is a CVE, and the other says it's not. Which is right?

Click to read

Article

5 Federal Software Supply Chain Requirements You Should Be Aware Of

If you’ve been watching the software supply chain security space evolve, you likely know that a lot of the momentum and effort is coming out of the U.S. Federal government. This may seem surprising at first, but it shouldn’t be, when you account for the fact that the Federal government is one of the single largest procurers of technology and software in the world.

Click to read

Article

You Found Vulnerabilities in Your Dependencies, Now What?

Third-party open source dependencies offer convenience but also pose a significant security risk. Learn how tools like Endor Labs can detect & address vulnerabilities here.

Click to read

Article

Dependency Resolution in Python: Beware The Phantom Dependency

Phantom dependencies are dependencies used by your code that are not declared in the manifest. If you miss them, they can sneak reachable risks into your application, lead to false positives, or inaccurate SBOMs. All very spooky. This article breaks down how phantom dependencies happen, and how to catch them.

Click to read

Article

Chris Hughes Joins Endor Labs as Chief Security Advisor

Chris Hughes brings nearly 20 years of IT and cybersecurity experience to his role as Chief Security Advisor. Learn what made him choose Endor Labs.

Click to read

Article

Understanding Python Manifest Files

In this blog, we delve into the various Python manifest files used to declare dependencies and how they collaborate seamlessly.

Click to read

Article

Why Your SCA is Always Wrong

A breakdown of why your SCA results are always so full of false positives (and sometimes false negatives), and why treating source code as a first class citizen can lead us to the solution.

Click to read

Article

Endor Labs Named 2023 SINET16 Innovator Award Winner

SINET, an organization with the mission to accelerate Cybersecurity innovation through public-private partnerships, announced today that Endor Labs is one of the winners of its annual SINET16 Innovator Award. Endor Labs and 15 other emerging companies are identified as the most innovative and compelling technologies in their fields to address Cybersecurity threats and vulnerabilities.

Click to read

Article

Combining EPSS and Reachability Analysis to Optimize Vulnerability Management

Exploit Prediction Scoring Systems (EPSS) is a data set that helps you understand the likelihood that a CVE will be exploited. Learn what the EPSS includes and how to use it to prioritize vulnerability remediation.

Click to read

Article

Reachability Analysis for Python, Go, C# - Webinar

In this on-demand webinar, get an in-depth reachability analysis for Python, Go, and C#. Watch now.

Click to read

Article

Introducing Reachability-Based SCA for Python, Go, and C#

Announcing new language support for Endor Labs Open Source

Click to read

Article

The Open Source Security Index Top 5

What’s the best of the best when it comes to open source security tools?We’ve previously talked about the OpenSSF Scorecard, which gives developers a high-level snapshot of the security of any given open source project. But in this post, we’ll talk about a related project, the Open Source Security Index (OSSI), which does something slightly different and complementary.

Click to read

Article

Faster SCA with Endor Labs and npm Workspaces

As projects grow larger and more complex, developers face challenges in maintaining a clean and efficient development workflow. Fortunately, npm workspaces offer an essential solution to streamline JavaScript development. In this blog post, we will explore the concept of npm/yarn workspaces, its importance, and how Endor Labs works with them.

Click to read

Article

Key Questions for Your SBOM Program

All the questions (and some of the answers) you need before kicking off your SBOM program.

Click to read

Article

Endor Labs & Github Advanced Security: AppSec Without The Productivity Tax

Endor Labs integrates with GitHub Advanced Security to enable developers to easily view and remediate SCA alerts without ever needing to leave GitHub.

Click to read

Article

Endor Labs Raises $70M in Series A Funding to Reform Application Security

Endor Labs raises a total of $70M to achieve application security without the developer productivity tax. Here's what we're doing, and where we're going.

Click to read

Article

How Should I Prioritize Software Vulnerabilities?

CVSS, KEV, SVCC, EPSS, and reachability analysis are 5 method used to prioritize open source vulnerabilities for remediation. Do you need all 5? Which is the best? It turns out a combination of factors (and a tool that can bring it all together) is the best solution.

Click to read

Article

Divide and Hide: How Malicious Code Lived on PyPI for 3 months

The Station 9 research team discovered malicious code that was divided and distributed across different packages, remaining obfuscated for months while getting nearly 2000 downloads.

Click to read

Article

Endor Labs’ ‘State of Dependency Management 2023’ Report Offers Insight on Explosive Popularity of AI and LLMs—and How They Impact Application Security

The State of Dependency Management 2023 reports on the latest research on dependency management and how AI is impacting the application security landscape.

Click to read

Article

State of Dependency Management 2023

Emerging trends impacting open source dependency management

Click to read

Article

Endor Labs Recognized as a Cool Vendor in the 2023 Gartner® Cool Vendors™ in Platform Engineering for Scaling Application Security Practices

Endor Labs is committed to providing cutting-edge solutions that address the challenges faced by platform engineering and DevSecOps teams in meeting application security needs.

Click to read

Article

Visualizing the Impact of Call Graphs on Open Source Security

A call graph is a visualization of invocation of vulnerable open source methods by a given client. Learn how to use call graphs to understand relevancy and impact of vulnerabilities.

Click to read

Article

Why Different SCA Tools Produce Different Results

Like anything in computer science and programming, there’s more than one way to solve a problem or get a result. SCA (software composition analysis) is no different.

Click to read

Article

Strengthening Security in .NET Development with packages.lock.json

Learn how packages.lock.json can help maintain a secure .NET development and why it should be part of your development workflow.

Click to read

Article

Highlights from State of Dependency Management 2022 - Webinar

In this on-demand webinar we discuss the key research findings from our 2022 report "State of Dependency Management."

Click to read

Article

How Security and Engineering Can Scale Open Source Security - Webinar

In this on-demand video we discuss open source dependency management and considerations for implementing AppSec programs to protect OSS.

Click to read

Article

Endor Labs is SOC 2 Type II Certified!

Proving once again open source governance doesn’t have to SOC, yes I made that joke again and I’m not sorry. We’re excited to announce we have received a clean audit result on our SOC2 Type II certification.

Click to read

Article

Reviewing Malware with LLMs: OpenAI vs. Vertex AI

At Endor Labs, we continue evaluating the use of large language models (LLMs) for all kinds of use-cases related to application security. And we continue to be amazed about high-quality responses … until we’re amused about the next laughably wrong answer.

Click to read

Article

Endor Labs Wins Intellyx Digital Innovation Award

We've been named a winner of the 2023 Intellyx Digital Innovator Award, recognizing technology providers driving enterprise digital transformation. Learn more.

Click to read

Article

Endor Labs Recognized As a 2023 Bay Area Best Place to Work

I mean, who wouldn't want to work with a bunch of Ewoks?

Click to read

Article

Make Developers' Lives Easier with Endor Labs & GitHub Advanced Security

Developers are bombarded with information every day. Constant context switching and information overload are among the biggest barriers to productivity. There are simply too many demands for their attention. One day the sales team will understand. Right?

Click to read

Article

LLM-assisted Malware Review: AI and Humans Join Forces to Combat Malware

Experiments with GPT-3.5 suggest that LLM-based malware reviews can complement, but not yet substitute human reviews. 1800 binary classifications performed with GPT-3.5 included false-positives and false-negatives.

Click to read

Article

Endor Labs Selected as Finalist for RSA Conference 2023 Innovation Sandbox

Endor Labs recognized for innovation in helping enterprises manage open source risk.

Click to read

Article

Announcing the Endor Labs Hyperdrive Program for Resellers and Solution Providers

The Hyperdrive partner program enables organizations of all sizes to embrace open source software with confidence.

Click to read

Article

Endor Labs partners with Zinfinity to help enterprise safely adopt Open Source Software

We’re excited to announce our latest partnership with Zinfinity as a strategic partner. Zinfinity is a global provider of technology solutions and services with a focus on Cyber Security, Cloud and Digital Infrastructure.

Click to read

Article

OWASP Top 10 Risks for Open Source

Emerging trends impacting open source dependency management

Click to read

Article

How to Quickly Measure SBOM Accuracy for Maven Projects (for Free)

SBOM-Lab is an open source tool that lets you quickly compare SBOM generation methods for Maven projects and find the right one for you.

Click to read

Article

Endor Labs is SOC2 Certified!

Open Source security doesn't have to SOC (sorry, I had to). We're excited to announce we have received a clean audit result on our SOC2 Type 1 certification.

Click to read

Article

Introduction to Open Source Security - Webinar

In this on-demand webinar we help you understand the basics of dependency management and how they can be vulnerable to security risks.

Click to read

Article

Comparing SBOMs Generated at Different Lifecycle Stages - Webinar

In this on-demand webinar, we share research on the variation in SBOMs depending on tool and when the documents are generated.

Click to read

Article

SBOM vs. SBOM: Comparing SBOMs from Different Tools and Lifecycle Stages

Software vendors active in certain verticals will soon be required to provide customers with SBOMs for their products. But how and when should an SBOM for a given piece of software be produced?

Click to read

Article

What Breaking Changes Teach Us about Security

GitHub rolled out a release that had some breaking changes to Git. Here's what we learned from it.

Click to read

Article

Open Source Licensing Simplified: A Comparative Overview of Popular Licenses

Explore the different types of open source licenses and how they impact the use, modification, and distribution of open source software. From GPL to Apache, MIT and more, learn the key differences between permissive and restrictive licenses and how to choose the right one for your project.

Click to read

Article

What is VEX and Why Should I Care?

An SBOM without VEX is like peanut butter without jelly. SBOM is a top buzzword in cybersecurity, but it's important to understand why VEX (Vulnerability Exploitability eXchange) is such a critical companion document.

Click to read

Article

Whatfuscator, Malicious Open Source Packages, and Other Beasts

Join Henrik to learn how his journey into Go programming turned into a path of malicious OSS packages.

Click to read

Article

Exploring Risk: Understanding Software Supply Chain Attacks

Naming and understanding the attack vectors at the disposal of our adversaries.

Click to read

Article

Endor Labs and Intuitive Partner to Help Enterprises Leverage OSS

Endor Labs and Intuitive.Cloud announce strategic partnership and investment with the goal of taking on OSS sprawl.

Click to read

Article

What is Reachability-Based Dependency Analysis?

Reachability analysis increases reliability of SCA results, allowing teams to quickly prioritize just the risks that matter.

Click to read

Article

State of Dependency Management 2022

In their inaugural report, the Station 9 research team explores the complexities of open source dependencies and the top security considerations for open source adoption at the enterprise.

Click to read

Article

Why We Need Static Analysis When Prioritizing Vulnerabilities - Webinar

In this on-demand webinar, we explain the role of static analysis of open source dependencies in an application security program.

Click to read

Article

What are Maven Dependency Scopes and Their Related Security Risks?

This article explores Maven dependency scopes: What are they, what are they used for, and how do they impact security risks?

Click to read

Article

The Government's Role in Maintaining Open Source Security

This blog summarizes highlights from Tragedy of the Digital Commons, by Strauss Center scholar and lecturer Chinmayi Sharma, where she shares the OSS state of affairs and her thoughts on improving security.

Click to read

Article

Introduction to Program Analysis

Program analysis is the process of checking whether or not a piece of software fulfills certain properties. This article explores the basics of program analysis, so we could then dive deeper into the world of call graphs.

Click to read

Article

More Than 30 Industry-Leading CISOs Personally Invest in Endor Labs

After a comprehensive diligence process on startups in the supply chain and open source security space, over 30 CISOs have chosen to personally back Endor Labs.

Click to read

Article

From Cloud Security to Code Security: Why We've Raised $25M to Take on OSS Dependency Sprawl

Endor Labs raises $25M seed round.

Click to read

Article

Endor Labs Launches with $25M Seed Financing to Tackle Massive Sprawl of Open Source Software (OSS)

Solution from category-defining entrepreneurs and world-renowned experts helps developers spend less time dealing with security issues, more time accelerating their development through safe code reuse.

Click to read

Article

SBOMs are Just a Means to an End

Do you know what goes into the software your company consumes? If your answer was sticky tape and glue, you clearly work in technology. Congratulations, this article is for you.

Click to read

Article

Introducing the OpenSSF Scorecard API

The Scorecard API makes it easier to automate and enforce your dependency policies. Naveen is one of the key contributors to the Scorecard projects, in this article, he walks through how it works!

Click to read

Article

How to Get the Most out of GitHub API Rate Limits

Thinking about using Github's REST API within your system, or already doing so? If you have not already encountered this concept, one important thing to keep in mind while developing is Github's concept of rate limiting.

Click to read

Article

Why I Joined Endor Labs to Build our India Team

Sriram Subramanian recently left his position as VP of Engineering at Citrix to lead the India R&D center at Endor Labs. We asked him what made him take the leap and what's his vision for the India team.

Click to read

Article

How Zero Trust Principles Can Accelerate Enterprise Adoption of OSS

Learn how Zero Trust principles help OSS adoption

Click to read

Article

What Security Teams Need to Know about Software Development

Learn how to begin threat models and make more informed risk management decisions regarding their software development practices.

Click to read

Article

CSRB Log4j Report - The Response is as Dangerous as the Vulnerability

The recent report from the CSRB gives a step by step account of Log4j, from discovery to remediation, and uncovers a painful insight - sometimes the response is just as dangerous as the vulnerability.

Click to read

Article

Polyrepo vs. Monorepo - How Does it Impact Dependency Management?

In this article, we explore the impact of using a monorepo vs a polyrepo architecture on dependency management.

Click to read

Sorry, we couldn't find what you're looking for.

View All Results

By clicking “Accept”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.

Deny Accept

SCA, but with reachability analysis that cuts 92% of noise.

You developers use open source packages, AI models, and AI services. Find out what they're using and fix risks fast.

Start Trial

Identify all dependencies

Go beyond classic SCA to discover all direct and transitive dependencies, including AI models and services.

Prioritize by danger

Combine reachability and EPSS to determine which vulnerabilities are the most dangerous, and remediate those first.

Fix faster

Identify upgrades that can be performed without risk of breaking changes and help engineering plan for the hard ones.

How It Works

Without the tedium and minutia of tracking down individual items that might not matter, we can focus on the remaining vulnerabilities that would impact customers and our FedRAMP compliance."

Raphael Theberge

Head of Security Enablement at Relativity

Automated Governance

Identify

Know what’s in your code

Get an accurate inventory (direct and transitive dependencies) and export SBOM / VEX documents
Correlate inventory to the Endor Labs Vulnerability Database, based on NVD, GHSA, and OSV data along with a manually-annotated, function-level database for vulnerabilities going back to 2018 for 12 languages (and growing)
Detect OWASP Top 10 risks for open source, including CVEs, malicious code, and license risks

Continuous Risk Monitoring

Prioritize

See which vulnerabilities are riskiest

Is it in production code (not test code)?
Is there a fix available?
Is the affected function reachable?
Is there a high probability of exploit (high EPSS)?
How severe could the impact be (CVSS)?

‍

Built for Developers

Remediate

Actually fix vulnerabilities

Give developers the information needed to upgrade dependencies with confidence.

For each version upgrade option, identify whether conflicts with other dependencies will cause problems (like breaking changes)
Compare the number of findings fixed by a single upgrade to the effort it will take to perform the upgrade
Improve mean time to remediation (MTTR) with smarter automatic pull requests and Endor Patches

‍

Not even your developers have this information! They’ll thank you for saying “This upgrade will be easy” or “This other one might take a few sprints because there are breaking changes.”

Get a Free Trial

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.

Get a free trial

Get a demo
of Endor Labs

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Article

Remediating Vulnerabilities vs. Maintaining Current Dependencies

Learn about the pros and cons of maintaining current dependencies, backed by a TU Delft study on 262 Java projects on Github

Click to read

Article

Prioritizing SCA Findings with Reachability Analysis - On-Demand Webinar

Watch this 30-minute on-demand webinar to learn how reachability analysis works.

Click to read

Article

Signing Your Artifacts For Security, Quality, and Compliance

Code Signing and other Artifact Signing enable application provenance to enhance admission control, incident response, and other essential capabilities.

Click to read

Article

Detect Malicious Packages Among Your Open Source Dependencies

Learn about emerging malicious code trends, including typosquatting and dependency confusion attacks, and two techniques for detecting malware in your applications.

Click to read

Article

Tom Gleason Joins Endor Labs as VP of Customer Solutions

Click to read

Article

Introducing CI/CD Security with Endor Labs

Endor Labs CI/CD helps organizations secure their pipelines through pipeline discovery, repository security posture management, and build integrity verification (artifact signing).

Click to read

Article

How to Improve SCA in GitHub Advanced Security - Tutorial

In this short video we demonstrate how to use Endor Labs and GitHub Advanced Security to manage and prioritize open source risk.

Click to read

Article

How to Ingest and Manage SBOMs - Tutorial

In this short video we demonstrate how to ingest 1st and 3rd party software bills of material, manage them centrally, and detect new vulnerabilities in a timely manner.

Click to read

Article

VMware Achieves SBOM Compliance for Over 100 Services with Endor Labs

Learn how the VMWare compliance team built a a scalable process to collect and attest to SBOMs using Endor Labs.

Click to read

Article

AI-Supported Environment Debugging for Endor Labs

Testing and installing new security tools is painful. Using generative AI, DroidGPT by Endor Labs makes it easy to troubleshoot and even prevent compatibility errors when installing the platform.

Click to read

Article

How to Generate SBOM and VEX - Tutorial

In this short video we demonstrate how to use Endor Labs to produce SBOM and VEX documents.

Click to read

Article

How to Use AI for Open Source Selection - Tutorial

In this short video we demonstrate how to use DroidGPT to research open source packages in a conversational manner.

Click to read

Article

Introducing a Better Way to SCA for Monorepos and Bazel

Endor Labs’ reachability-based SCA now supports Bazel so you can get fully accurate results without any of the messy workarounds usually required for monorepos.

Click to read

Article

5 Types of Reachability Analysis (and Which is Right for You)

Click to read

Article

What’s in a Name? A Look at the Software Identification Ecosystem

Learn best practices for a proper software identification ecosystem that supports asset inventory, version control, vulnerability management, incident response, and more.

Click to read

Article

What You Need to Know About Apache Struts and CVE-2023-50164

Discover the critical details of CVE-2023-50164, a severe vulnerability in Apache Struts.

Click to read

Article

Introducing JavaScript Reachability and Phantom Dependency Detection

Endor Labs’ JavaScript SCA capabilities cut down noise with a program analysis approach that outperforms manifest scanning SCA tools like Snyk, Veracode, and BlackDuck.

Click to read

Article

MileIQ Securely Reimagines a Decade Old Product with Endor Labs

Lean MileIQ, the #1 mileage tracking app, selected Endor Labs to help their security and engineering teams focus on the software supply chain risks that actually matter.

Click to read

Article

How CycloneDX VEX Makes Your SBOM Useful

Click to read

Article

How to Scan and Prioritize Valid Secrets - Tutorial

In this short video we demonstrate how to use Endor Labs to discover if your organization has leaked valid secrets and provide developers with instructions for resolving the leak.

Click to read

Article

SBOM Requirements for Medical Devices

Learn about the 2023 FDA rule for medical devices, including requirements for SBOMs, a mitigation plan, and secure software development practices.

Click to read

Article

CISA and NCSC's Take on Secure AI Development

A breakdown of the "Guidelines for Secure AI System Development document from CISA and NCSC.

Click to read

Article

Open Source Security 101: How to Evaluate Your Open Source Security Posture

Organizations need to evolve their approach to using open source securely. Find four fundamental considerations to consider when it comes to securely using OSS.

Click to read

Article

Endor Labs is a CRN 2023 Stellar Startup!

CRN®, a brand of The Channel Company, has named Endor Labs to its 2023 Stellar Startups list in the Security category. Learn more about the list and us here.

Click to read

Article

How to Prioritize Reachable Open Source Software (OSS) Vulnerabilities - Tutorial

In this short video we demonstrate how to use Endor Labs for reachability-based SCA and noise reduction.

Click to read

Article

Open Source Security for Python and AI Apps

Gain visibility into your hidden Python dependencies and prioritize reachable, exploitable risks.

Click to read

Article

How To Evaluate Secret Detection Tools

An overview of 3 requirements for a secret detection program, and how to do it with Endor Labs.

Click to read

Article

Why SCA Tools Can't Agree if Something is a CVE

One scanner says this is a CVE, and the other says it's not. Which is right?

Click to read

Article

5 Federal Software Supply Chain Requirements You Should Be Aware Of

Click to read

Article

You Found Vulnerabilities in Your Dependencies, Now What?

Third-party open source dependencies offer convenience but also pose a significant security risk. Learn how tools like Endor Labs can detect & address vulnerabilities here.

Click to read

Article

Dependency Resolution in Python: Beware The Phantom Dependency

Click to read

Article

Chris Hughes Joins Endor Labs as Chief Security Advisor

Chris Hughes brings nearly 20 years of IT and cybersecurity experience to his role as Chief Security Advisor. Learn what made him choose Endor Labs.

Click to read

Article

Understanding Python Manifest Files

In this blog, we delve into the various Python manifest files used to declare dependencies and how they collaborate seamlessly.

Click to read

Article

Why Your SCA is Always Wrong

A breakdown of why your SCA results are always so full of false positives (and sometimes false negatives), and why treating source code as a first class citizen can lead us to the solution.

Click to read

Article

Endor Labs Named 2023 SINET16 Innovator Award Winner

Click to read

Article

Combining EPSS and Reachability Analysis to Optimize Vulnerability Management

Click to read

Article

Reachability Analysis for Python, Go, C# - Webinar

In this on-demand webinar, get an in-depth reachability analysis for Python, Go, and C#. Watch now.

Click to read

Article

Introducing Reachability-Based SCA for Python, Go, and C#

Announcing new language support for Endor Labs Open Source

Click to read

Article

The Open Source Security Index Top 5

Click to read

Article

Faster SCA with Endor Labs and npm Workspaces

Click to read

Article

Key Questions for Your SBOM Program

All the questions (and some of the answers) you need before kicking off your SBOM program.

Click to read

Article

Endor Labs & Github Advanced Security: AppSec Without The Productivity Tax

Endor Labs integrates with GitHub Advanced Security to enable developers to easily view and remediate SCA alerts without ever needing to leave GitHub.

Click to read

Article

Endor Labs Raises $70M in Series A Funding to Reform Application Security

Endor Labs raises a total of $70M to achieve application security without the developer productivity tax. Here's what we're doing, and where we're going.

Click to read

Article

How Should I Prioritize Software Vulnerabilities?

Click to read

Article

Divide and Hide: How Malicious Code Lived on PyPI for 3 months

The Station 9 research team discovered malicious code that was divided and distributed across different packages, remaining obfuscated for months while getting nearly 2000 downloads.

Click to read

Article

Endor Labs’ ‘State of Dependency Management 2023’ Report Offers Insight on Explosive Popularity of AI and LLMs—and How They Impact Application Security

The State of Dependency Management 2023 reports on the latest research on dependency management and how AI is impacting the application security landscape.

Click to read

Article

State of Dependency Management 2023

Emerging trends impacting open source dependency management

Click to read

Article

Endor Labs Recognized as a Cool Vendor in the 2023 Gartner® Cool Vendors™ in Platform Engineering for Scaling Application Security Practices

Endor Labs is committed to providing cutting-edge solutions that address the challenges faced by platform engineering and DevSecOps teams in meeting application security needs.

Click to read

Article

Visualizing the Impact of Call Graphs on Open Source Security

A call graph is a visualization of invocation of vulnerable open source methods by a given client. Learn how to use call graphs to understand relevancy and impact of vulnerabilities.

Click to read

Article

Why Different SCA Tools Produce Different Results

Like anything in computer science and programming, there’s more than one way to solve a problem or get a result. SCA (software composition analysis) is no different.

Click to read

Article

Strengthening Security in .NET Development with packages.lock.json

Learn how packages.lock.json can help maintain a secure .NET development and why it should be part of your development workflow.

Click to read

Article

Highlights from State of Dependency Management 2022 - Webinar

In this on-demand webinar we discuss the key research findings from our 2022 report "State of Dependency Management."

Click to read

Article

How Security and Engineering Can Scale Open Source Security - Webinar

In this on-demand video we discuss open source dependency management and considerations for implementing AppSec programs to protect OSS.

Click to read

Article

Endor Labs is SOC 2 Type II Certified!

Click to read

Article

Reviewing Malware with LLMs: OpenAI vs. Vertex AI

Click to read

Article

Endor Labs Wins Intellyx Digital Innovation Award

We've been named a winner of the 2023 Intellyx Digital Innovator Award, recognizing technology providers driving enterprise digital transformation. Learn more.

Click to read

Article

Endor Labs Recognized As a 2023 Bay Area Best Place to Work

I mean, who wouldn't want to work with a bunch of Ewoks?

Click to read

Article

Make Developers' Lives Easier with Endor Labs & GitHub Advanced Security

Click to read

Article

LLM-assisted Malware Review: AI and Humans Join Forces to Combat Malware

Click to read

Article

Endor Labs Selected as Finalist for RSA Conference 2023 Innovation Sandbox

Endor Labs recognized for innovation in helping enterprises manage open source risk.

Click to read

Article

Announcing the Endor Labs Hyperdrive Program for Resellers and Solution Providers

The Hyperdrive partner program enables organizations of all sizes to embrace open source software with confidence.

Click to read

Article

Endor Labs partners with Zinfinity to help enterprise safely adopt Open Source Software

Click to read

Article

OWASP Top 10 Risks for Open Source

Emerging trends impacting open source dependency management

Click to read

Article

How to Quickly Measure SBOM Accuracy for Maven Projects (for Free)

SBOM-Lab is an open source tool that lets you quickly compare SBOM generation methods for Maven projects and find the right one for you.

Click to read

Article

Endor Labs is SOC2 Certified!

Open Source security doesn't have to SOC (sorry, I had to). We're excited to announce we have received a clean audit result on our SOC2 Type 1 certification.

Click to read

Article

Introduction to Open Source Security - Webinar

In this on-demand webinar we help you understand the basics of dependency management and how they can be vulnerable to security risks.

Click to read

Article

Comparing SBOMs Generated at Different Lifecycle Stages - Webinar

In this on-demand webinar, we share research on the variation in SBOMs depending on tool and when the documents are generated.

Click to read

Article

SBOM vs. SBOM: Comparing SBOMs from Different Tools and Lifecycle Stages

Software vendors active in certain verticals will soon be required to provide customers with SBOMs for their products. But how and when should an SBOM for a given piece of software be produced?

Click to read

Article

What Breaking Changes Teach Us about Security

GitHub rolled out a release that had some breaking changes to Git. Here's what we learned from it.

Click to read

Article

Open Source Licensing Simplified: A Comparative Overview of Popular Licenses

Click to read

Article

What is VEX and Why Should I Care?

Click to read

Article

Whatfuscator, Malicious Open Source Packages, and Other Beasts

Join Henrik to learn how his journey into Go programming turned into a path of malicious OSS packages.

Click to read

Article

Exploring Risk: Understanding Software Supply Chain Attacks

Naming and understanding the attack vectors at the disposal of our adversaries.

Click to read

Article

Endor Labs and Intuitive Partner to Help Enterprises Leverage OSS

Endor Labs and Intuitive.Cloud announce strategic partnership and investment with the goal of taking on OSS sprawl.

Click to read

Article

What is Reachability-Based Dependency Analysis?

Reachability analysis increases reliability of SCA results, allowing teams to quickly prioritize just the risks that matter.

Click to read

Article

State of Dependency Management 2022

In their inaugural report, the Station 9 research team explores the complexities of open source dependencies and the top security considerations for open source adoption at the enterprise.

Click to read

Article

Why We Need Static Analysis When Prioritizing Vulnerabilities - Webinar

In this on-demand webinar, we explain the role of static analysis of open source dependencies in an application security program.

Click to read

Article

What are Maven Dependency Scopes and Their Related Security Risks?

This article explores Maven dependency scopes: What are they, what are they used for, and how do they impact security risks?

Click to read

Article

The Government's Role in Maintaining Open Source Security

Click to read

Article

Introduction to Program Analysis

Click to read

Article

More Than 30 Industry-Leading CISOs Personally Invest in Endor Labs

After a comprehensive diligence process on startups in the supply chain and open source security space, over 30 CISOs have chosen to personally back Endor Labs.

Click to read

Article

From Cloud Security to Code Security: Why We've Raised $25M to Take on OSS Dependency Sprawl

Endor Labs raises $25M seed round.

Click to read

Article

Endor Labs Launches with $25M Seed Financing to Tackle Massive Sprawl of Open Source Software (OSS)

Click to read

Article

SBOMs are Just a Means to an End

Do you know what goes into the software your company consumes? If your answer was sticky tape and glue, you clearly work in technology. Congratulations, this article is for you.

Click to read

Article

Introducing the OpenSSF Scorecard API

The Scorecard API makes it easier to automate and enforce your dependency policies. Naveen is one of the key contributors to the Scorecard projects, in this article, he walks through how it works!

Click to read

Article

How to Get the Most out of GitHub API Rate Limits

Click to read

Article

Why I Joined Endor Labs to Build our India Team

Click to read

Article

How Zero Trust Principles Can Accelerate Enterprise Adoption of OSS

Learn how Zero Trust principles help OSS adoption

Click to read

Article

What Security Teams Need to Know about Software Development

Learn how to begin threat models and make more informed risk management decisions regarding their software development practices.

Click to read

Article

CSRB Log4j Report - The Response is as Dangerous as the Vulnerability

Click to read

Article

Polyrepo vs. Monorepo - How Does it Impact Dependency Management?

In this article, we explore the impact of using a monorepo vs a polyrepo architecture on dependency management.

Click to read

Sorry, we couldn't find what you're looking for.

View All Results