Breaking Changes, Breaking Trust

Vulnerability Management for FedRAMP compliance is expensive; your SCA tool should help you make it cheaper and easier.

Integrate Microsoft Defender for Cloud with Endor Labs for reachability analysis and attack path visibility — available natively within the Defender for Cloud console. Prioritize what to fix without switching tools.

Understand how models are factored and scored at Endor Labs, new exploration tab for HuggingFace models

Endor Labs now integrates Static Application Security Testing (SAST) into your application security testing stack.

The Cyber Resilience Act (CRA) sets mandatory security requirements for hardware and software. This blog covers key compliance objectives, challenges with OSS vulnerabilities, and best practices for maintaining security throughout the product life cycle.

You can now use Endor Labs to evaluate AI models on HuggingFace for security, popularity, quality, and activity.

The U.S. Federal government's FY 2026 Cybersecurity Priorities focus on securing open source software, improving governance, and supporting OSS sustainability to strengthen the software supply chain.

Understand what LLMs are, how foundational LLMs are built, the opportunities they offer and the risks they pose.

Container layer analysis tells you which layer contains a vulnerability so you can prioritize remediation efforts more effectively and meet SLAs like FedRAMP.

Endor Labs reduces open-source vulnerability noise by 92%, boosting productivity and improving collaboration between development and security teams.

Relativity changed their security program from a blocker to an enabler by integrating security into developer workflows and empowering developers to prevent risks before they ship to production.

Relativity changed their security program from a blocker to an enabler by integrating security into developer workflows and empowering developers to prevent risks before they ship to production.

Get key insights from the 2024 Dependency Management webinar with Darren Meyer and Henrik Plate. We discuss how to prioritize vulnerabilities, navigate breaking changes, and leverage public vulnerability databases effectively.

We're thrilled to have Karl Mattson as Endor Labs first Chief Information Security Officer (CISO)!

Discover the top open-source tools for Python applications, ranked by Endor Scores based on security, activity, popularity, and code quality.

This blog covers key steps to simplify FedRAMP vulnerability management, helping you reduce risks and meet compliance timelines. It also provides practical tips to empower developers and streamline fixes for a smoother FedRAMP process.

Automatically patch open source libraries with Endor Patches during the build process, ensuring software is continuously protected against vulnerabilities without manual intervention.

Our third-annual Dependency Management Report explores how emerging trends in open source security should guide SDLC security strategy.

Wondering how to build or revamp a DevSecOps program? Get some immediately useful tips that you can apply to your startup or mature enterprise…or anywhere in between.

Starburst, an open data lakehouse, replaced Rezillion with Endor Labs for SCA. They improved their ability to identify and prioritize open source while complementing the developer experience.

Learn what CI/CD security is, why it’s important, and discover the key tools Endor Labs offers to help you secure your CI/CD pipelines.

Endor Labs provides comprehensive CI/CD security for GitHub action workflows that detect patterns that may indicate PWN request threats.

Endor Labs is now available on Azure Marketplace!

Endor Labs’ newest capabilities help you reduce the research required to understand the impact of dependency upgrades and Endor Magic Patches help you stay safe without changing versions.

Endor Labs provides several filters to help you prioritize which risks to address first, resulting in an average 92% noise reduction.

Use Endor Labs to get accurate dependency inventories and complete vulnerability data sources.

Discover the 48 most popular open-source npm tools, complete with Endor Scores, to help you choose the best dependencies for your projects based on security, activity, popularity, and code quality.

Use artifact signing, a feature of Endor Labs, to support build provenance requirements for SLSA.

Compare Endor Labs and Snyk GitHub Apps.

Upgrade Impact Analysis shows you what breaking changes a fix could cause. Endor Patches are trusted patches you can use when upgrades are too painful.

Software composition analysis (SCA) tools can take a static or dynamic approach. Learn the pros and cons of each option and see how the results differ.

Explore the top 33 open source tools for Maven, scored by Endor Labs on security, activity, popularity, and code quality.

Learn how Jellyfish’s security team uses a data-driven approach to risk management and the role SCA plays in their strategy.

Jellyfish replaced Snyk with Endor Labs to improve their ability to identify, prioritize, address, and predict open source risk. Learn more!

Learn about common patterns and tradeoffs for security pipelines in this introductory webinar.

Endor Labs, a leader in software supply chain security, today announced a strategic investment from Citi Ventures.

Endor Labs is named to Inc.’s annual Best Workplaces list for 2024.

Three CocoaPods CVEs raise serious security concerns for consumers of Swift and Objective-C libraries used for macOS and iOS mobile development.

When choosing an SCA tool, you’ll need to understand how the tool generates an inventory, correlates to risks, helps you prioritize results, and integrates into your toolchain.

Watch this 30-minute on-demand webinar to learn about changes to PCI DSS that impact OSS vulnerability management.

The Endor Labs plugins for Backstage create an application security experience that doesn’t require developers to leave Backstage.

We’re excited to announce that Endor Labs now extends our software supply chain platform to include container scanning.

How can you tell if an OSS package is “good” or “bad”? A rigorous evaluation model, such as the Endor Score, can help developers make quick and informed decisions.

Company Recognized for Creating Secure Supply Chains that Improve Application Development Productivity

95% of vulnerabilities are found in transitive dependencies. Learn how they’re unique from direct dependencies and how to incorporate them into your risk management program.

GitHub Actions are open source dependencies - secure them accordingly! Learn how to effectively manage the security risks associated with GitHub Actions with a proactive approach focusing on three key areas: visibility, hardening, and dependency management.

Learn about the mobile application threat landscape and how you can protect mobile apps from security and legal risk associated with open source software with Endor Labs Open Source.

Learn how your organization can achieve DORA compliance for managing open source software vulnerabilities with reachability-based SCA, SBOMs, and more.

Watch this 30-minute on-demand webinar to learn how to Endor Labs supports a Software Supply Chain Security program.

Known vulnerabilities are a well-understood software risk…but managing and prioritizing them is anything but simple. Learn about key considerations when building a program to detect and remediate CVEs.

A low-code/no code artifact signing solution makes it easy to implement an enterprise solution for verifying authenticity of software artifacts and tracing their origins.

Learn how your organization can achieve PCI DSS v4 compliance for managing open source software vulnerabilities with reachability-based SCA and more.

In this free guide, experts answer key questions like "what is it?", "why is it important?", "and how do I secure it?" so you can make informed decisions and thoughtfully design your organization's SSCS program.

Source code repository misconfigurations can expose your organization to supply chain attacks. Repository Security Posture Management (RSPM) can offer a reliable system to enforce best practices.

Control which images get deployed in Kubernetes by configuring an admission controller to admit only those which have been signed by Endor Labs.

What happens when an AppSec professional attends a Java conference? Great conversations on productivity, tool pain, AI/ML, and vulnerability management.

Watch this 30-minute on-demand webinar to learn using strong cryptographic artifact signatures to enable strong admission control, provenance, and traceability that support effective security, quality, and compliance programs.

While it’s improbable to prevent all exposure to supply chain risks, organizations can absolutely focus on a strategy to reduce the probability of successful attacks and reduce the time it takes them to respond to such threats.

The xz backdoor shines a light on everything we're doing wrong in software supply chain security. Get an overview of the incident, what we can learn from it, and what we can do about it.

Learn ways to comply with SSDF requirements for secure environments, trusted source code supply chains, code and artifact provenance, and vulnerabilities.

Learn how to establish automated CI/CD controls to reveal what’s running in your pipelines and which configs don’t align with risk and compliance requirements.

Learn about the pros and cons of maintaining current dependencies, backed by a TU Delft study on 262 Java projects on Github

Watch this 30-minute on-demand webinar to learn how reachability analysis works.

Code Signing and other Artifact Signing enable application provenance to enhance admission control, incident response, and other essential capabilities.

Learn about emerging malicious code trends, including typosquatting and dependency confusion attacks, and two techniques for detecting malware in your applications.

Tom Gleason is a security enthusiast with a knack for building and leading technically-focused customer teams. Formerly at Snyk, Akamai, and Palo Alto Networks, Tom joins Endor Labs to lead Customer Solutions.

Endor Labs CI/CD helps organizations secure their pipelines through pipeline discovery, repository security posture management, and build integrity verification (artifact signing).

In this short video we demonstrate how to use Endor Labs and GitHub Advanced Security to manage and prioritize open source risk.

In this short video we demonstrate how to ingest 1st and 3rd party software bills of material, manage them centrally, and detect new vulnerabilities in a timely manner.

Learn how the VMWare compliance team built a a scalable process to collect and attest to SBOMs using Endor Labs.

Testing and installing new security tools is painful. Using generative AI, DroidGPT by Endor Labs makes it easy to troubleshoot and even prevent compatibility errors when installing the platform.

In this short video we demonstrate how to use Endor Labs to produce SBOM and VEX documents.

In this short video we demonstrate how to use DroidGPT to research open source packages in a conversational manner.

Endor Labs’ reachability-based SCA now supports Bazel so you can get fully accurate results without any of the messy workarounds usually required for monorepos.

Explore the five key categories of reachability and their practical applications in AppSec and development. Learn the differences between SCA and container scanning, and understand how various tools like Function-Level Reachability, Package Baselining, and Internet Reachability play crucial roles in identifying and prioritizing security risks.

Learn best practices for a proper software identification ecosystem that supports asset inventory, version control, vulnerability management, incident response, and more.

Discover the critical details of CVE-2023-50164, a severe vulnerability in Apache Struts.

Endor Labs’ JavaScript SCA capabilities cut down noise with a program analysis approach that outperforms manifest scanning SCA tools like Snyk, Veracode, and BlackDuck.

Lean MileIQ, the #1 mileage tracking app, selected Endor Labs to help their security and engineering teams focus on the software supply chain risks that actually matter.

Explore the challenges of modern vulnerability management and the efficiency of the Vulnerability Exploitability eXchange (VEX) in our latest blog post. Learn how VEX helps identify and communicate the true exploitability of vulnerabilities, streamlining cybersecurity efforts in the face of overwhelming scanner findings.

In this short video we demonstrate how to use Endor Labs to discover if your organization has leaked valid secrets and provide developers with instructions for resolving the leak.

Learn about the 2023 FDA rule for medical devices, including requirements for SBOMs, a mitigation plan, and secure software development practices.

A breakdown of the "Guidelines for Secure AI System Development document from CISA and NCSC.

Organizations need to evolve their approach to using open source securely. Find four fundamental considerations to consider when it comes to securely using OSS.

CRN®, a brand of The Channel Company, has named Endor Labs to its 2023 Stellar Startups list in the Security category. Learn more about the list and us here.

In this short video we demonstrate how to use Endor Labs for reachability-based SCA and noise reduction.

Gain visibility into your hidden Python dependencies and prioritize reachable, exploitable risks.

An overview of 3 requirements for a secret detection program, and how to do it with Endor Labs.

One scanner says this is a CVE, and the other says it's not. Which is right?

If you’ve been watching the software supply chain security space evolve, you likely know that a lot of the momentum and effort is coming out of the U.S. Federal government. This may seem surprising at first, but it shouldn’t be, when you account for the fact that the Federal government is one of the single largest procurers of technology and software in the world. 

Third-party open source dependencies offer convenience but also pose a significant security risk. Learn how tools like Endor Labs can detect & address vulnerabilities here.

Phantom dependencies are dependencies used by your code that are not declared in the manifest. If you miss them, they can sneak reachable risks into your application, lead to false positives, or inaccurate SBOMs. All very spooky. This article breaks down how phantom dependencies happen, and how to catch them.