Endor Labs
Reachability-based application security for code written by people and agents
Overview
Endor Labs is an application security platform that uses reachability analysis to show which dependency vulnerabilities an application can actually trigger, alongside AI SAST, secrets detection, container scanning, SBOMs and a package firewall. Its AURI layer brings the same analysis to AI coding agents through MCP, a CLI and editor plugins. It was formed by former Prisma Cloud leaders from Palo Alto Networks.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 14 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- AURI scans and fixes vulnerabilities and exposed secrets as you work
- Local scanning with read-only vulnerability data
- No UI, policies or scan history
- Reachability and prioritisation
- Policies for developers and agents
- Advanced detection, triage and fixing across every application layer
Use cases
What you can produce with Endor Labs
- Dependency vulnerability findings filtered to those the application can actually reach
- AI SAST and secrets detection on first-party code and pull requests
- Container image scanning with reachability from code to image
- Malicious packages blocked at install through a package firewall
- SBOM and VEX documents for compliance requests
- AURI security checks and fixes inside AI coding agents via MCP, CLI or editor plugins
- Inventory and policy governance for AI coding agents, MCP servers and skills
Endor Labs is built around one useful idea, reachability: it checks whether the vulnerable function in a dependency is ever called, so a security team works a short list of exploitable findings instead of every CVE. It has grown into AI SAST, secrets, containers, SBOMs and a package firewall, and AURI puts the same analysis inside AI coding agents, free for individual developers.
Team pricing is quoted per contributing developer, which suits organisations with an AppSec budget rather than small startups, and noise-reduction figures are the vendor's own. A strong option for engineering groups buried in dependency alerts.
What we found
Endor Labs is an application security company from Palo Alto, operated by Endor Labs Inc. Varun Badhwar and Dimitri Stiliadis, who had led Prisma Cloud at Palo Alto Networks, formed it in 2021 and brought it out of stealth in 2022; an earlier version of this page credited an ex-Prevoty and Imperva team, which the company's own about page does not support. Its founding idea was reachability for software composition analysis: tracing call paths through an application to work out whether a vulnerable function in a dependency is ever invoked, so teams fix exploitable flaws rather than every CVE in the tree.
That has widened into a platform. Endor Code covers first-party code with AI SAST and secrets detection; Endor Open Source covers dependencies and container images with reachability, malicious-package detection and SBOM and VEX output. A package firewall, patched drop-in builds of vulnerable libraries, an SBOM hub and governance for AI coding agents, MCP servers and skills sit alongside. Since March 2026 the AI side has a name, AURI: security intelligence that coding agents reach through an MCP server, a CLI or editor plugins, plus an AI Security Review in which agents read pull requests for design flaws such as an endpoint shipped without authentication. Endor says this removes up to 95% of false positives; that figure is the vendor's own.
The funding is traceable in coverage of each round: a $70 million Series A in 2023, then a $93 million Series B in April 2025 led by DFJ Growth, with Salesforce Ventures, Lightspeed, Coatue and Dell Technologies Capital. A revenue estimate and a G2 rating quoted here before could not be traced or read today and have been removed.
The free Developer tier gives individuals AURI scanning inside an AI editor with no account, running locally against read-only vulnerability data. Core and Pro are quoted, priced per developer who committed in the last 90 days, and sold through the AWS, Azure and Google Cloud marketplaces.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
About this listing
This entry was compiled from publicly available data including Endor Labs's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Endor Labs unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Endor Labs directly →
Spotted something out of date? Suggest an update →
Alternatives to Endor Labs
More in Security & Safety
