Endor Labs

Market position

Endor Labs positions itself as a consolidation play against disconnected point scanners, triage queues and manual remediation handoffs, competing with traditional SAST and SCA vendors on noise reduction through reachability. The company describes itself as the fastest growing AppSec company and cites 30x ARR growth since its 2023 Series A, 166% net revenue retention, more than 5 million applications protected and over a million scans per week as of April 2025. Its investors have separately backed peers such as Wiz and Snyk.

The company differentiates on reachability-based prioritization backed by transparent evidence (data flow and call paths) rather than signature-based alerting, on combining deterministic program analysis with agentic reasoning in one engine to catch business logic and architectural flaws, and on the breadth of its underlying security dataset covering open source packages, AI models, vulnerabilities and code relationships. Other stated differentiators include auditable, reproducible findings for compliance regimes such as FedRAMP, PCI and CRA, a native Bazel integration, C/C++ support in the absence of a standard package manager, and a research-heavy team in which roughly a third of code committers hold PhDs in program analysis and AI.

Technology

The platform blends deterministic program analysis with agentic AI reasoning. Core techniques include multi-file, multi-function dataflow and source-to-sink taint analysis, full-stack reachability tracing from code through direct and transitive dependencies to container images, and Endor scores computed from metadata on open source packages and AI models. Purpose-built security agents and sub-agents detect risks, evaluate exploitability, triage findings and generate merge-ready fixes with traceable evidence. Supporting data assets include a proprietary vulnerability database, call graphs for millions of open source packages, and embeddings for tracing the provenance of AI-generated code; support spans 40+ languages and frameworks, with C support added for AI SAST. Deployment options include agentless cloud scanning (source code cloned briefly and destroyed, not stored), in-pipeline CI/CD scanning where code stays in the customer's runner, and Endor Outpost for scheduled monitoring scans.

Go-to-market

The company combines a free, no-account developer tier distributed through AI coding editors and MCP/CLI installation as a top-of-funnel motion with an enterprise sales motion ("book a demo", contact sales) for Core and Pro editions. Distribution is supplemented by cloud marketplace listings on AWS, Azure and Google Cloud, integrations with source platforms such as GitHub, GitLab, Bitbucket and Azure DevOps, technology partnerships including Microsoft Defender for Cloud, channel partnerships such as Zinfinity, and content marketing via customer case studies, a blog and a prompt library.

Enterprise and high-growth technology companies' application security, product security and DevSecOps teams, plus the developers and AI coding agents they support. Publicly referenced users include OpenAI, Rubrik, Peloton, Snowflake, Egnyte, Dropbox, Atlassian, Glean, Cursor (Anysphere), Astronomer, Jellyfish, Five9, Netskope, Starburst, People.ai, Observe.ai, Grip Security and Mysten Labs.

Geography

Headquartered in Palo Alto, California, with additional offices in Delft, Netherlands and Bengaluru/Bangalore, India. The India site is led by a Managing Director and R&D Head. The company has stated it is expanding its global go-to-market.

History

Founded in Palo Alto in 2021, Endor Labs came out of stealth in October 2022 with a service focused on securing open source package dependencies and developer pipeline governance. It announced a $70 million Series A in 2023, expanded in 2024 from reachability-based SCA to a broader application security platform and launched a tool to discover and assess AI models and services embedded in customer codebases. In April 2025 it announced a $93 million Series B led by DFJ Growth, bringing total capital raised to $163 million, and during 2025 launched an agentic AI AppSec platform for AI-generated code. Its board includes partners from Lightspeed, DFJ Growth, Coatue, Dell Technologies Capital and Salesforce Ventures.

Risks & controversies

Performance figures such as 30x ARR growth, 166% net revenue retention, up to 95-97% noise reduction and 2.6x more true positives than frontier AI models are company-supplied and not independently verified in the available material. The company operates in a crowded application security market alongside vendors such as Snyk, and its 2025 repositioning toward AI-generated code and agentic security represents a change of course from its original open source dependency focus. Scanning architecture requires briefly cloning customer source code into Endor Labs' cloud in the default agentless deployment, though the company states source code is not stored.