Automating the AppSec with AI. Ask any AppSec team how their backlog is looking, and you will hear a variation of the same exhausted truth: Detection has never been faster, and human remediation has never been slower. Frontier AI models, advanced researchers, and modern scanners are surfacing vulnerabilities at a staggering rate. At Endor Labs, we have observed new CVEs moving from public disclosure to active exploitation in under 10 hours often before a security engineer has even had the chance to assign a Jira ticket. The structural gap is obvious. We are using machine speed to find vulnerabilities, but we are still relying on human speed to fix them. Developers are already trying to solve this by pointing general-purpose AI coding agents (like Claude or Cursor) at security findings. The instinct is right, but the execution fails because general-purpose agents operate blind; they lack the contextual security data needed to formulate a safe, non-breaking fix. This changes today. Defenders now have the tools to push remediation to machine speed. Here is how you can use AI to automate your AppSec workflows using the newly released AURI Agents and the open-source Endor Labs Agent Kit. What to remember. * The AppSec Gap: AI has accelerated vulnerability detection and exploitation; remediation must adopt AI agents to keep pace. * AURI Agents: Pre-configured, expert AI agents by Endor Labs that plug directly into tools developers already use (Claude Code, Cursor IDE, Codex, Gemini). * Context is King: General-purpose AI fails at security patching. AURI Agents succeed because they are wired directly into Endor Labs' reachability analysis and policy graphs. * Local Execution: The agents run on your infrastructure using your LLM keys. Your code and secrets never cross into a vendor's backend. * Open Source: The Endor Labs Agent Kit is fully open-source, allowing you to build, customize, and deploy your own security agents via simple Markdown and YAML recipes. The power of context: why General AI fails at security. If you paste a CVE alert into an LLM and ask it to write a patch, it will hallucinate. It doesn't know if the vulnerable function is actually reachable in your specific codebase. It doesn't know if upgrading that package will break three other transitive dependencies. General AI lacks context. To bridge this gap, Endor Labs introduced AURI Agents. Instead of exposing raw data through a clunky API and hoping an LLM figures it out, Endor Labs packaged their deep contextual data reachability analysis, upgrade impact, and finding graphs directly into pre-built AI agents. According to a recent study, using these expert agents allows teams to perform security tasks 2.8 times faster while consuming 92% fewer tokens compared to unaugmented AI agents. Meet the AURI agent catalog. The catalog launches with specialized agents designed to tackle the heaviest, most requested AppSec workflows. Here are the standouts: 1. SCA Remediation agent (endor-sca-remediation-agent). * The Problem: You have 50 open dependency vulnerabilities. Which ones actually matter, and what is the safest upgrade path? * The Agent: This agent takes an open dependency vulnerability, uses reachability analysis to verify if your code actually calls the vulnerable function, calculates the safest upgrade path, and automatically opens a Pull Request (PR) with the justifying evidence attached to the PR body. 2. AI SAST triage agent (endor-ai-sast-triage-agent). * The Problem: SAST scanners are notoriously noisy, producing hundreds of false positives. * The Agent: It reviews SAST findings, confirms true positives against the exact commit SHA, generates patches for confirmed flaws, and routes false positives with logical explanations. It even handles exceptions directly from PR comments, allowing AppSec reviewers to approve them straight into policy without filing a ticket. 3. Probe Droid (endor-probe-droid-agent). * The Problem: "Are we actually scanning everything?" * The Agent: Probe Droid audits your scan coverage across GitHub. It finds the blind spots and prescribes exactly what configurations, toolchains, or package integrations need to change to ensure complete repository coverage. 4. Vulnerability explainer (endor-vulnerability-explainer-agent). * The Problem: A developer encounters a complex GHSA or CVE ID and doesn't know where to start. * The Agent: It turns a cryptic CVE ID into a plain-language explanation, specifically detailing what it means for your specific repository and outlining the exact next steps. How to install and deploy (running locally). Security leaders rightfully panic when they hear "AI agent looking at our codebase." AURI Agents alleviate this by running exactly where your developers already live. There is no new runtime to adopt. The agents install directly into tools like Claude Code, Cursor IDE, Codex, or Gemini CLI. Most importantly, they run on your infrastructure. Your code, your secrets, and your LLM token spend stay on your side of the fence. Quick start: Cursor IDE. If your team uses Cursor, installation is seamless. * Open the Cursor Agent chat. * Install the plugin: /add-plugin endorlabs * Run the setup skill to check your readiness (it will not run unauthorized scans). Quick start: Claude Code. To drop the agent into your local Claude Code environment, use the CLI: /plugin marketplace add endorlabs/ai-plugins /plugin install endor-labs-agent-kit@endorlabs /reload-plugins /agents Once installed, point it at your repository: Prompt: @agent-sca-remediation check this repository for P0 SCA findings I can start remediating. Python SDK for CI/CD Automation. If you want to run these agents headlessly in your CI/CD pipelines or backend orchestration, you can use the Cursor SDK lane: python3 -m pip install -r cursor-sdk/requirements.txt export CURSOR_API_KEY="crsr_..." python cursor-sdk/run_cursor_agent.py endor-sca-remediation-agent \ -mode cloud \ -repo-url https://github.com/your-org/your-repo \ -ref main \ "Prepare a remediation plan only. Do not edit files or open a PR." Security by design: guardrails and Trust. Endor Labs built these agents like security software. * Read-Only by Default: By default, the majority of the agents are read-only. They can assess CI/CD posture, summarize package risks, and preview remediation plans, but they cannot edit files, push branches, or open PRs. * Approval-Gated Workflows: For agents that do mutate state (like the SCA Remediation agent), they operate under strict approval-gated workflows. File edits, branch pushes, and policy writes are split into separate execution gates, ensuring a human remains in the loop for critical actions. Furthermore, agents act with scoped credentials allowing you to audit exactly what actions were taken by a developer versus what actions were executed by their agent. The Endor Labs Agent Kit: build your own. Every security team has highly specific, bespoke workflows. If the pre-built AURI Agents don't fit your exact needs, you don't have to start from scratch. The Endor Labs Agent Kit is completely open-source. Every agent is defined as a "Source Recipe" a readable YAML file combined with plain-markdown instructions. Don't want to write YAML? You don't have to. The kit includes a "Create Endor Labs Agent" skill. You simply describe the workflow you want in plain English to your coding agent, and it walks you through authoring the recipe, the prompt, and the evaluation cases. It then validates your new agent against the exact same strict guardrails Endor Labs uses for its official catalog. Conclusion. The era of drowning in the AppSec backlog is ending. Attackers are using AI to scale their operations; defenders must do the same. By bringing rich, contextual security data directly into the AI environments where developers already work, AURI Agents allow teams to fix vulnerabilities as fast as scanners find them. Stop compromising between development speed and security. Grab the code from the Endor Labs Agent Kit on GitHub, install the plugins, and let the agents do the heavy lifting. To further enhance your cloud security and implement Zero Trust, contact me on LinkedIn Profile or [email protected].

Endor Labs is a Visionary in the 2026 gartner(r) Magic quadrant(tm) for Software Supply Chain Security. For the first time, Endor Labs has been recognized in the 2026 Gartner Magic Quadrant for Software Supply Chain Security. Andrew Stiefel Published on June 18, 2026 Updated on June 18, 2026 Summarize with AI We're thrilled to announce Endor Labs has been recognized as a Visionary in the 2026 Gartner Magic Quadrant for Software Supply Chain Security. This is the first Magic Quadrant Gartner has published for the category. For us, the work started well before the category had a name. In early 2024, Endor Labs researchers led the creation of the OWASP Top 10 for Open Source Software Risks, the first community standard for what open source risk actually looks like, two years before this Magic Quadrant existed. A dedicated Magic Quadrant now confirms what we've believed since Endor Labs was founded in 2021: most of the code your developers ship won't be written by them, and securing where that code comes from is its own discipline. We're proud to have helped define the category, and to keep pushing it forward. Gartner places Visionaries based on completeness of vision: a view of where the market is going and a roadmap to match. We built Endor Labs for the world that's arriving, not the one of the last decade. As AI introduces new dependencies into the software supply chain, from coding agents and models to MCP servers and skills, we've built the controls to govern them. And as attackers adopt AI to generate exploits, we're helping defenders stay ahead. Every leap in frontier model capability, Mythos included, raises the same question from boards and security teams: what happens when attackers get this leverage? They already have it. Exploits that took months now take hours, and malware campaigns increasingly target the packages and workflows AI agents depend on. If that makes you nervous, you're paying attention. Our answer is to give defenders the same leverage, grounded in evidence rather than fear. From SCA to security for AI coding. When we launched in 2022, we started with a contrarian bet: software composition analysis was broken not because it found too little, but because it found too much. Legacy SCA flags every CVE in your dependency graph whether or not your application can ever invoke the vulnerable code. The result is backlogs of 10,000+ findings that engineering struggles to act on. Since then we've expanded across the supply chain: a package firewall that evaluates over 150 risk signals and blocks malicious packages at install time, AI model governance covering 50 risk metrics on every Hugging Face model, SCA for C/C++, compliance guidance for PCI DSS 4.0 and the EU Cyber Resilience Act, the first 3PAO-endorsed approach for using function-level reachability to reduce FedRAMP ConMon costs, and Endor Outpost for organizations with strict sovereignty requirements. The same controls apply whether a package is installed by a developer or by an AI coding agent. That last part is no longer a nice-to-have. It's the new front line. Pioneering full-stack reachability. Reachability is the idea we're most associated with, and for good reason. Function-level reachability analysis traces whether your application can actually invoke vulnerable code, across first-party code, open source dependencies, and container images, in more than 40 languages. For our customers, that cuts SCA noise by an average of 92%. As Travis McPeak at Cursor put it: "Over 97% of vulnerabilities flagged by our previous tool weren't reachable in our application. Endor Labs shows the few impactful vulnerabilities, so we can patch quickly, focusing on what matters." Every finding ships with evidence: the call path, the data flow, and the reachability proof. No black-box verdicts. That evidence model is also what makes our findings consumable by AI agents, which need deterministic context to act on security decisions, not a severity score and a shrug. Patching and upgrade impact analysis. Finding real risk is half the problem. The other half is fixing it without breaking production. Upgrade impact analysis shows exactly what will break before you open the PR, turning guess-and-test remediation into an informed decision. And when an upgrade is too risky or impossible, Endor Patches delivers drop-in, security-only patches for hard-to-upgrade libraries and end-of-life software. Gartner specifically recognized Endor Patches as a strength in its assessment, noting that it "helps customers to reduce the risk of introducing breaking changes into an application." Together, these capabilities are why customers see 6x faster CVE remediation. The future of software development. Magic Quadrants evaluate what vendors have already shipped. Our eyes are on what's next. Software development is being rebuilt around semi-autonomous agentic pipelines that write and deploy code with minimal human checkpoints. In that world, the "scan after build" model collapses. Security has to become intelligence embedded where code gets written: helping agents pick safe dependencies, blocking poisoned packages aimed at agentic workflows), and giving agents the deterministic context to fix what matters fast. That's what we're building with AURI, the security harness for agentic development, on top of the same code context graph that powers our function-level reachability and supply chain intelligence. As engineering changes, the supply chain changes with it. So do we. We're honored by the recognition, and more grateful for the customers and community who push us to be better every day. If you want to see what a supply chain security program built for the AI era looks like, book a demo and we'll show you. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and MAGIC QUADRANT is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved. What's next? When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help: