Endor Labs
Reachability-based software composition analysis that filters open-source dependency risk down to what code paths are actually exploitable.
Visit Website ↗Overview
Endor Labs was founded in 2021 and is headquartered in Palo Alto, California. Its core product is software composition analysis (SCA) built around call-graph reachability analysis: rather than flagging every known vulnerability in every declared or transitive dependency, it determines whether an application’s own code paths actually call the vulnerable function.
The platform has expanded from reachability-based SCA into AI-assisted SAST (including C/C++ support), container and SBOM/VEX management, and native build-system integrations such as Bazel for monorepos.
Endor Labs has raised $208M total: a $70M Series A in August 2023 led by Lightspeed Venture Partners, and a $93M Series B in April 2025 led by DFJ Growth — the largest and most recent funding among comparable companies. It was a finalist in the RSA Conference 2023 Innovation Sandbox contest.
Innovation Matrix Assessment
Expanded from its reachability-SCA core into AI SAST, container scanning, SBOM/VEX, and native Bazel monorepo support within a few years of founding.
Multiple named customers report 92-99% reductions in SCA finding volume by filtering to reachable/exploitable vulnerabilities, the most consistent, quantified noise-reduction evidence found.
$208M total raised, with the most recent round ($93M Series B, April 2025) led by top-tier growth investors DFJ Growth and Lightspeed.
True call-graph reachability analysis is a structurally different approach from manifest/declared-dependency SCA used by most incumbents.
Names a strong, credible customer list (Atlassian, Citi, Rubrik, VMware, Dropbox, Robinhood) with specific attributed outcomes.
Reachability-based prioritization directly addresses the alert-fatigue problem in open-source dependency risk and is highly relevant as AI-generated code increases dependency volume.
Why CISOs Should Care
Cuts through SCA alert fatigue by telling teams which open-source vulnerabilities are actually reachable from their own code.
What Makes It Different
Uses call-graph-level reachability analysis instead of manifest/declared-dependency matching — a meaningfully deeper technical bar than most SCA tools clear.
The Matrix Verdict
83/100 — MEANINGFUL INNOVATOR
Strong Innovator (83/100), the highest-scoring company in this ASPM/SCA comparison set: the strongest combination of funding momentum, technical differentiation, and quantified customer-reported efficacy.
Editorial Note: Claims vs. Verified Findings
Funding totals and round dates are corroborated across multiple sources. Specific noise-reduction percentages and named customer outcomes are stated in Endor's own case studies and were not independently re-verified with the named customers directly.
Sources
Alternatives to Endor Labs
JFrog
Public software supply chain security platform (Xray plus Advanced Security) that scans binaries and artifacts end-to-end from the…
Snyk
Developer-first application security platform combining SAST, SCA, container, IaC, and API/DAST scanning inside the developer workflow.
Apiiro
Builds a continuous 'code risk graph' that maps code, developers, and cloud deployment to prioritize AppSec findings by…
Sonar
Code quality and security platform built around SonarQube's static analysis engine, widely adopted via a free Community Edition…
ArmorCode
Tool-agnostic ASPM layer that correlates findings from 300+ existing security tools into one prioritized backlog, without running its…
Contrast Security
Instruments applications from within using IAST and RASP to find and block vulnerabilities as code actually executes, rather…