All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Endor Labs sells AURI, an application security platform, to security teams in technology, finance and manufacturing. AURI determines which flagged vulnerabilities a customer's code can reach, so teams can prioritize those. It checks AI coding agents' actions against the customer's policy before they run. Founded in 2021, Endor Labs has raised more than $208 million, VentureBeat reported in March 2026, including a Series B led by DFJ Growth. Its named customers include Citi, OpenAI and Atlassian, and it told TechCrunch of 30x annual recurring revenue growth since its 2023 Series A. Anthropic announced a code security product inside Claude, an assistant AURI connects to, and an AI model provider bundling security review into its agents could reduce demand for a separate product.
| Description | Endor Labs is an application security company whose AURI platform guides AI coding agents toward secure code and enforces policy on the actions those agents take. | [f1] |
|---|---|---|
| Founded | 2021 | [f2] |
| HQ | Palo Alto, California, USA | [f3] |
| Funding | $208M total | [f4] |
| Latest funding | Series B ($93M, April 2025, led by DFJ Growth) | [f3] |
| Product | What it does |
|---|---|
| AURI Application Security Platform | Reachability-based AppSec platform built on a code context graph over code, dependencies, containers, and services, with SCA, AI SAST, secrets, and agentic remediation for evidence-backed findings. |
| Endor Labs AI Model Discovery | Discovers open source AI models from Hugging Face and scores them across security, activity, popularity, and operational integrity so teams can make informed model-usage decisions. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Endor Labs AI Model Discovery discovers open source AI models from Hugging Face and scores them across security, activity, popularity, and operational integrity to surface model risk. This capability is mapped to the AI Defense Matrix. [f5]
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
The AURI platform builds a code context graph over code, dependencies, container images, and services, and applies reachability analysis, SCA, AI SAST, and agentic remediation to conventional applications and pipelines. This application-security work is mapped to the Cyber Defense Matrix. [f6]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 4/5 | Endor Labs names security teams that cannot yet answer for the code and dependencies AI coding agents ship, and outside sources quantify that pain. VentureBeat reports academic research finding only 10% of leading models' output both functional and secure. FedRAMP's 2026 rules state that most vulnerabilities scanners find are not likely to be exploitable, and an arXiv preprint reports hidden vulnerable dependencies in nearly 50% of 1,808 popular Java projects. [s1, s14, s16, s17, s21] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | Endor Labs' platform and pricing pages document reachability across code, dependencies and container images, policy checks on coding agents, and a package firewall, and Microsoft's Defender for Cloud documentation describes ingesting its reachability findings. That page documents an integration, VentureBeat relays the company's own account of flaws AURI found in OpenClaw, and an arXiv preprint groups Endor Labs SCA with metadata-based scanners. The cited record carries no outside technical evaluation of the analysis depth Endor describes. [s2, s4, s14, s19, s21] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | Two independent sources describe different kinds of recent buyer demand. One is an analyst category note, Forrester analyst Janet Worthington's April 2026 post saying buyers increasingly expect security tools to identify which vulnerabilities are actually exploitable. The other is a regulatory driver, FedRAMP's 2026 rules, launched in June 2026 for its 20x path and required from December 2026, which direct cloud providers to evaluate whether vulnerabilities are likely exploitable. The enabler is AI coding assistants, which VentureBeat reported in March 2026 that 90% of development teams use. [s14, s16, s17] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 | Varun Badhwar previously sold RedLock to Palo Alto Networks for $173 million, as SecurityWeek reported in 2022. Endor Labs' about page says both founders led Prisma Cloud through its hypergrowth phase at Palo Alto Networks. Those in-domain builds, one of them an exit reported by independent press, rest on more than the company's own account. [s3, s14, s15] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | Endor Labs publishes named customer testimony from security leaders at Citi, Atlassian, Glean, Robinhood and Egnyte, and it sells through the AWS, Azure and Google Cloud marketplaces. TechCrunch relays customer names including OpenAI, Snowflake and Dropbox, along with growth and scale figures that are the company's own measurements rather than independent reporting. [s1, s4, s5, s10, s13, s14] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | TechCrunch reported that the $93 million Series B DFJ Growth led in April 2025 brought Endor Labs' total capital raised to $163 million. VentureBeat described the company in March 2026 as backed by more than $208 million. Endor acquired Autonomous Plane in February 2026 and launched AURI in March 2026, and it discloses no revenue level or margin, so efficiency is unconfirmed beyond its own growth figures. [s10, s12, s13, s14] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | Outside analysts and researchers place Endor Labs without its own framing. Omdia's May 2024 report describes it as a developer of software supply chain security technology, and two arXiv preprints list Endor Labs SCA among commercial software composition analysis tools. Endor Labs reports its Visionary placement in Gartner's 2026 Magic Quadrant for software supply chain security. It also reports its inclusion in Forrester's agentic development security landscape. [s8, s9, s18, s20, s21] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | A platform vendor absorbing Endor Labs' reachability analysis would have to rebuild the analysis across code, dependencies and container images and the integrations with repositories and coding agents. Forrester writes that DevOps platforms embed security features and that AI labs such as Anthropic and OpenAI experiment with code security, and VentureBeat reports Anthropic announced a code security product built into Claude. The cited record shows no cross-customer data flywheel or procurement position that bundling could not reach. [s1, s2, s14, s16] |
Endor Labs addresses the security of the code and dependencies that AI coding agents write and install. Its homepage says coding agents already write code, install dependencies and ship changes across organizations, and that most security teams cannot yet answer for that work.
Outside sources describe the same pressure. VentureBeat reported in March 2026 that 90% of development teams use AI coding assistants and cited academic research finding that just 10% of leading models' output is both functional and secure. Forrester analyst Janet Worthington wrote in April 2026 that buyers increasingly expect security tools to identify which vulnerabilities are actually exploitable.
Cloud providers selling to federal agencies face the same question under FedRAMP. Its Consolidated Rules for 2026, which cover the FedRAMP 20x path with optional adoption from July 2026 and required dates from December 2026, direct providers to evaluate whether detected vulnerabilities are likely exploitable. The rules state that most vulnerabilities scanners find are not likely to be exploitable. Egnyte's customer story says its product security team adopted Endor Labs for reachability evidence while pursuing FedRAMP authorization. [s1, s11, s14, s16, s17]
Endor Labs sells AURI, a platform that combines agentic AI reasoning with deterministic program analysis to find and fix vulnerabilities in first-party code, open source dependencies and container images. AURI traces whether a vulnerability can actually be reached, and the vendor says only reachable vulnerabilities enter a team's backlog.
The newer products extend that work to AI coding agents. AURI connects to agents through hooks, skills, an MCP server or a command-line tool, and it checks each agent action against policy before the action runs. A Package Firewall blocks malicious packages at install, and AI Model Governance, part of the Endor Open Source product, scores Hugging Face models across more than 50 signals.
Endor Labs extended reachability to container images through its February 2026 acquisition of Autonomous Plane, whose founder Kyle Quest created DockerSlim. The acquisition announcement says full-stack reachability pairs static dependency graph analysis with runtime profiling. Microsoft's Defender for Cloud documentation describes ingesting Endor's function-level and dependency-level reachability findings into its cloud security posture tools. [s1, s2, s4, s6, s12, s19]
Endor Labs competes in a crowded application security market. VentureBeat names Snyk and GitHub Advanced Security among the vendors competing for developer attention, and Forrester's Janet Worthington writes that DevOps platforms embed security features. She also writes that detection is becoming commoditized and that correlating findings with exploitability and reachability context separates leaders from laggards.
AI model providers are moving onto the same ground. Forrester notes that Anthropic and OpenAI experiment with new approaches to code security, and VentureBeat reports that Anthropic announced a code security product built into Claude. VentureBeat also reports that AURI integrates with Claude, so Anthropic's product and AURI can run in the same coding assistant.
Independent research places Endor Labs SCA in a defined peer group. Two arXiv preprints list it with Snyk, Mend and Black Duck among commercial dependency scanners. The 2026 preprint calls that group metadata-based and reports that nearly 50% of 1,808 popular Java projects carry hidden vulnerable dependencies that metadata-based scanners miss. Endor's own pages describe deterministic program analysis, so the two characterizations differ. [s14, s16, s2, s20, s21]
Endor Labs publishes named customer testimony from technology and financial companies. Its pages quote security leaders at Citi, Atlassian, Glean, Robinhood and Egnyte, and TechCrunch relays OpenAI, Snowflake and Dropbox among its customers.
Its growth figures are the company's own. Endor told TechCrunch in April 2025 of 30x annual recurring revenue growth since its 2023 Series A. In September 2025 it announced 225% year-over-year revenue growth and said its platform protects 7.4 million applications.
Endor Labs sells seat-based Core and Pro editions and separately priced products, with bundling through its sales team and purchase through the AWS, Microsoft Azure and Google Cloud marketplaces. A free developer tier sits below those editions. Egnyte's customer story says its product security team adopted Endor Labs while pursuing FedRAMP authorization.
Endor's blog reports two 2026 analyst placements. Gartner named it a Visionary in its Magic Quadrant for software supply chain security, and Forrester included it among 35 vendors in its agentic development security landscape. Omdia profiled the company in a May 2024 report by Rik Turner. [s1, s4, s5, s8, s9, s10, s11, s13, s14, s18]
Varun Badhwar and Dimitri Stiliadis founded Endor Labs in Palo Alto in 2021. Endor's about page says both led Prisma Cloud through its hypergrowth phase at Palo Alto Networks. SecurityWeek reported in 2022 that Badhwar previously sold RedLock to Palo Alto Networks for $173 million.
Endor Labs has staffed its research around program analysis. VentureBeat reports the company hired 13 PhDs specializing in program analysis, many of whom built similar technology at Meta, GitHub and Microsoft.
Investors reported by TechCrunch include DFJ Growth, which led the April 2025 Series B, with participation from Salesforce Ventures, Lightspeed Venture Partners, Coatue, Dell Technologies Capital, Section 32 and Citi Ventures. [s3, s13, s14, s15]
Endor Labs reports a clean SOC 2 Type II audit opinion with no noted exceptions, issued by SSF. The attestation matters for a vendor whose cloud scanning briefly clones customer source code, which the pricing page says Endor destroys after each scan.
Customers with strict requirements can keep code in their own environment. The pricing page says CI pipeline scans keep code within the customer's runner and send only results to Endor, and Endor Outpost runs scheduled scans outside those pipelines. [s7, s4]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Apiiro | competes with | Competes with Endor Labs for application security budgets that cover code and open source dependency risk. | |
| Cycode | competes with | Competes with Endor Labs for application security programs that consolidate code, dependency and pipeline scanning. | |
| Legit Security | competes with | Competes with Endor Labs for application security programs covering code, secrets and software supply chain risk. | |
| Snyk | competes with | VentureBeat names Snyk among the application security vendors competing for developer attention, and two arXiv preprints list Snyk and Endor Labs among commercial dependency scanners. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
Add analyzed competitors to compare them side by side with Endor Labs.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Endor Labs sells software that customers connect to their repositories, build pipelines and AI coding agents. Leaving it means reconnecting those integrations and moving the policies a team has set in the product. The company describes a security knowledge base built from open source packages, AI models and vulnerabilities. According to VentureBeat, it has indexed billions of functions across millions of open source packages to trace copied code. Endor Labs holds that index itself, and it is built from open source code rather than from any one customer's data. Endor Labs reports a clean SOC 2 Type II audit opinion.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Endor Labs sells software that customers' security and engineering teams operate, from a free developer tier to paid Core and Pro editions. Those teams own the remediation outcomes. Its Patches product delivers patched open source libraries for customers to apply. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Customers connect Endor Labs to repositories, CI pipelines and AI coding agents and write policies in it, so leaving means reconnecting those integrations and migrating or revalidating that policy. Those policies run on the Open Policy Agent engine, and the cited record documents no mechanism beyond that integration and policy work and does not size the migration. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | Endor Labs reports a clean SOC 2 Type II audit opinion with no noted exceptions. A funded competitor can obtain that attestation through ordinary enterprise preparation, so it does not block replacement. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Endor Labs builds call graphs and dataflow analysis to trace reachability across code, dependencies and container images, with support for 40+ languages and frameworks. VentureBeat reports it hired 13 PhDs specializing in program analysis for that work. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Endor Labs' named customers include regulated enterprises. Citi's engineering head describes using it to pinpoint supply chain risks, and Egnyte adopted it while pursuing FedRAMP authorization. A free developer tier runs alongside those enterprise sales. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Endor Labs works across the development toolchain, in repositories, CI pipelines and coding agents, and its Package Firewall blocks malicious packages at install. Its container analysis needs nothing installed in the customer's cluster, so removing it costs development-time coverage and policy enforcement rather than breaking deployed software. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | Endor Labs describes a security knowledge base of open source packages, AI models, vulnerabilities and code relationships. VentureBeat reports it has indexed billions of functions across millions of open source packages . That index accumulates from open source code, is Endor's own, and is not shown to be published, so it is a retained asset a rival could rebuild with time and effort. |
Endor Labs sells to security and engineering teams. Its customers page lists technology, AI and blockchain, banking and fintech, security and compliance, data management, and devices and manufacturing as the segments it serves.
Endor Labs offers individual developers a free tier without an account, and it sells team editions priced per contributing developer. Regulated buyers appear among its named customers. Citi's head of engineering and architecture for the CISO describes using Endor to pinpoint supply chain risks, and Egnyte adopted it while pursuing FedRAMP authorization.
Endor Labs' AURI combines agentic AI reasoning with deterministic program analysis to detect, triage and remediate vulnerabilities across code, dependencies and container images. The vendor says its agents trace dataflow across every repository and pull request to catch logic flaws that rule-based scanners have no signature for.
Endor describes a security knowledge base of open source packages, AI models, vulnerabilities and code relationships behind that analysis. VentureBeat reports the company has indexed billions of functions across millions of open source packages to trace copied code.
For AI assets, AI Model Governance discovers the Hugging Face models developers pull into application code and scores each across more than 50 signals. Teams enforce model policy with the Open Policy Agent engine the rest of the platform uses.
Endor Labs sells to enterprise security and engineering teams and publishes testimony from security leaders at Citi, Atlassian, Glean, Robinhood and Egnyte. TechCrunch relays OpenAI, Snowflake and Dropbox among its customers.
The company's growth claims are its own. It told TechCrunch of 30x annual recurring revenue growth since its 2023 Series A, and in September 2025 it announced 225% year-over-year revenue growth.
Endor Labs pairs a free developer tier with paid team editions, bundles products through its sales team, and sells through the AWS, Microsoft Azure and Google Cloud marketplaces.
Endor Labs publishes its editions and pricing metric without a price. A free Developer tier helps agents scan and fix code with no account, and the paid Core and Pro editions add reachability, policies and advanced triage and fixing.
The separately sold products are Code, Open Source, AI Coding Agent Governance, Package Firewall, Patches and SBOM Hub, and each is listed with a Get pricing prompt. Endor points buyers who want the full platform to a sales conversation about bundling.
Pricing is seat-based. For Code and Open Source, a seat is a developer who committed to a monitored repository in the last 90 days, and volume discounts apply as that count grows. Customers can also buy through the AWS, Azure and Google Cloud marketplaces.
Endor Labs runs as a cloud service with several deployment options. The pricing page says most customers connect cloud apps for GitHub, GitLab, Bitbucket or Azure DevOps, which briefly clone code into Endor's cloud and destroy it after scanning.
Customers can instead scan inside their CI pipelines, where code stays in their runner, or deploy Endor Outpost for scheduled scans. The remediation workflows run on customer infrastructure, read-only by default, with every change requiring approval. The customer's security and engineering teams operate the product and act on its findings.
Endor Labs reports a clean SOC 2 Type II audit opinion with no noted exceptions, issued by SSF. The attestation matters for a vendor whose cloud scanning briefly clones customer source code, which the pricing page says Endor destroys after each scan.
Customers with strict requirements can keep code in their own environment. The pricing page says CI pipeline scans keep code within the customer's runner and send only results to Endor, and Endor Outpost runs scheduled scans outside those pipelines.
Endor Labs connects to the tools where code is written and reviewed, including AI coding agents through hooks, skills, an MCP server or a command-line tool. Microsoft's Defender for Cloud documentation describes ingesting Endor's reachability findings into Cloud Security Explorer and Attack Path analysis.
Forrester's Janet Worthington writes that DevOps platforms embed their own security features, so customers of Endor's integrations can also get some security scanning from the platforms they already use.
Varun Badhwar and Dimitri Stiliadis founded Endor Labs in Palo Alto in 2021. Endor's about page says both led Prisma Cloud through its hypergrowth phase at Palo Alto Networks. SecurityWeek reported in 2022 that Badhwar previously sold RedLock to Palo Alto Networks for $173 million.
Endor Labs has staffed its research around program analysis. VentureBeat reports the company hired 13 PhDs specializing in program analysis, many of whom built similar technology at Meta, GitHub and Microsoft.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Endor Labs: homepage | official | 2026-09-15 |
| f2 | Endor Labs: Our Story, founded in Palo Alto | official | 2026-09-15 |
| f3 | Endor Labs Series B: Palo Alto dateline | press | 2026-09-15 |
| f4 | VentureBeat: Endor Labs AURI launch article | press | 2026-09-15 |
| f5 | AI Defense Matrix Catalog mapping (Endor Labs AI Model Discovery) | other | 2026-09-15 |
| f6 | Endor Labs AURI platform: reachability and code context graph | official | 2026-09-15 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.