Full-Time
Technical Success Engineer
Updated on 5/12/2026
Endor Labs
51-200 employees
Function-level vulnerability analysis and risk scoring
No salary listed
Bengaluru, Karnataka, India
In Person
 Sales & Solution Engineering (1) |
|---|
- 6 -10 years of in-depth experience in software engineering
- strong command of programming languages, application security, and DevOps practices
- you’re a coding aficionado who’s navigated the complexities of modern tech stacks with finesse
- proven track record in crafting custom technical solutions and thriving in customer-facing roles
- experience managing project-based work and turning unique challenges into streamlined, effective outcomes
- be a passionate advocate for customer success, with a knack for building secure and scalable solutions from scratch
- stellar communication skills that enable you to demystify complex technical concepts
- proactive, anticipatory approach to problem-solving and ability to predict customer needs and craft strategic, innovative solutions
- Strong English language skills
- Design and roll out cutting-edge code and dependency scanning mechanisms using Maven and Gradle
- Become the primary technical contact for our customers, guiding them with deep technical know-how and empathy during pre-sales and post-sales stages
- Tailor Endor Labs security solutions to fit into sophisticated customer environments and craft bespoke solutions when needed
- Use advanced troubleshooting expertise and comprehensive understanding of programming and DevOps to resolve technical issues and keep customers on the path to success
- Forge lasting relationships with a diverse range of clients and become their trusted advisor and tech advocate
- Collaborate with engineering teams, turning customer feedback and troubleshooting insights into product improvements
- Lead the charge in promoting robust security practices and helping developers write secure code
- Manage high-impact technical integration projects with strategic finesse and provide guidance internally and externally
Endor Labs analyzes software using reachability-based dependency analysis to identify vulnerabilities at the function level. It provides a risk score for software packages that combines security, quality, popularity, and activity, helping teams focus on the most critical issues. A flexible policy engine lets clients tailor rules to their risk profile, reducing disruption to development work, while SBOM and VEX management tools help track ownership and costs. The team of PhDs and its practical risk scores, policy-driven controls, and ongoing monitoring aim to improve software security and quality while lowering supply-chain risk.
Company Size
51-200
Company Stage
Series B
Total Funding
$188M
Headquarters
Palo Alto, California
Founded
2021
Simplify's Take
What believers are saying
- 225% YoY revenue growth protecting 7.4M applications for OpenAI, Atlassian, Dropbox.
- AI SAST reduces false positives by 95% versus legacy tools in enterprise testing.
- Agent Security League benchmark establishes Endor Labs as AppSec standard for AI code.
What critics are saying
- Snyk's ecosystem dominance stalls customer acquisition among enterprises avoiding platform switching.
- GitHub Copilot and Cursor integrate native security scanning, commoditizing AURI's free tier.
- Palo Alto Networks incorporates full-stack reachability, undercutting container security differentiation.
What makes Endor Labs unique
- Full-stack reachability analysis from code through containers filters 90% false positives.
- AURI platform embeds security directly into AI coding agent workflows for developers.
- Proprietary dataset from 4.5M open-source projects enables precise vulnerability exploitability ranking.
Help us improve and share your feedback! Did you find this helpful?
Benefits
Health Insurance
Dental Insurance
Vision Insurance
Mental Health Support
Unlimited Paid Time Off
401(k) Retirement Plan
Remote Work Options
Growth & Insights and Company News
6 month growth
↑ 2%1 year growth
↑ 3%2 year growth
↑ 3%TeamPCP backdoor litellm versions 1.82.7 to 1.82.8 likely due to Trivy CI/CD compromise. By March 24, 2026 No Comments 5 Mins Read TeamPCP, the threat actor behind the recent Trivy and KICS breaches, compromised a popular Python package named litellm and pushed two malicious versions containing a credential harvester, a Kubernetes lateral movement toolkit, and a persistent backdoor. Multiple security vendors, including Endor Labs and JFrog, revealed that litellm versions 1.82.7 and 1.82.8 were released on March 24, 2026. This is likely due to the use of Trivy for packages in CI/CD workflows. Both backdoor versions have since been removed from PyPI. "The payload is a three-stage attack: a credential harvester that sweeps through SSH keys, cloud credentials, Kubernetes secrets, cryptocurrency wallets, and .env files, a Kubernetes lateral movement toolkit that deploys privileged pods to all nodes, and a "checkmarx" poll with a persistent systemd backdoor (sysmon.service).[.]Use 'zone/raw' for additional binaries," said Endor Labs researcher Kiran Raj. As observed in previous cases, the collected data is exfiltrated as an encrypted archive ('tpcp.tar.gz') to a command and control domain named 'models.litellm'.[.]cloud" via an HTTPS POST request. For 1.82.7, the malicious code is embedded in the "litellm/proxy/proxy_server.py" file and the injection is performed during or after the wheel build process. This code is designed to run on module import so that the process that imports "litellm.proxy.proxy_server" triggers the payload without requiring user intervention. The next iteration of the package will add "more attack vectors" by incorporating the malicious "litellm_init.pth" into the wheel root, allowing the logic to be automatically executed every time a Python process is started in the environment, not just when litellm is imported. Another aspect that makes 1.82.8 even more dangerous is the fact that the .pth launcher spawns child Python processes via subprocess.Popen, allowing payloads to run in the background. "Python .pth files placed in site packages are automatically processed by site.py when the interpreter starts," Endor Labs said. "This file contains one line that imports the subprocess and launches a separate Python process to decode and execute the same Base64 payload." The payload is decoded to an orchestrator that unpacks the credential harvester and persistence dropper. The harvester also utilizes the Kubernetes service account token (if present) to enumerate all nodes in the cluster and deploy privileged pods to each node. The pod then chroots into the host file system and installs the persistence dropper as a systemd user service on all nodes. The systemd service is configured to launch a Python script ('~/.config/sysmon/sysmon.py') (same name used in the Trivy compromise) that accesses 'checkmarx'.[.]Run "zone/raw" every 50 minutes to get a URL pointing to the next stage payload. If the URL contains YouTube[.]com, the script stops running. This is a common kill switch pattern in all incidents observed to date. "This campaign is almost certainly not over," Endor Institute said. "TeamPCP exhibits a consistent pattern: each compromised environment generates credentials that unlock the next target. The pivot from CI/CD (GitHub Actions runner) to production (PyPI packages running on a Kubernetes cluster) is a deliberate escalation." With the latest development, TeamPCP has launched a relentless supply chain attack campaign, spawning five ecosystems including GitHub Actions, Docker Hub, npm, Open VSX, and PyPI, expanding its reach and bringing more systems under its control. "TeamPCP has escalated a coordinated campaign targeting security tools and open source developer infrastructure, and is now openly claiming credit for multiple follow-on attacks across the ecosystem," Socket said. "This is an ongoing operation targeting high-impact points in the software supply chain." "These companies were founded to protect their supply chains, and they can't even protect their own supply chains. The current state of modern security research is a joke. As a result, we will be stealing terabytes for a long time," TeamPCP said in a message posted on its Telegram channel. [sic] Trade secret secrets with its new partners." "The snowballing impact of this will be significant. We are already partnering with other teams to perpetuate the disruption. Many of your favorite security tools and open source projects will be targeted in the coming months. Stay tuned," the attacker added. Users are advised to take the following actions to contain the threat: Audit litellm version 1.82.7 or 1.82.8 in all environments and revert to a clean version if found. Isolate the affected host. Check for the presence of rogue pods in your Kubernetes cluster. Check the network logs for output traffic to 'models.litellm'.[.]Cloud" and "Checkmarks"[.]Remove "zone" persistence mechanisms. Audit CI/CD pipelines for use of tools like Trivy and KICS during the period of compromise. Revoke and rotate all exposed credentials. "The open source supply chain is breaking down," Gal Nagri, head of threat prevention at Google's Wiz, wrote in a post on X. "Trivy gets compromised | LiteLLM gets compromised | credentials for tens of thousands of environments end up in the hands of attackers | and those credentials lead to the next breach. We're stuck in a loop."
Endor Labs vs Snyk. 15 Views 17 Mar 2026 20:00 TL;DR: Founded in 2021, Endor Labs built a vulnerability scanner that determines which issues are actually threats, with the aim to eliminate the ~80% of false positives that train developers to ignore alerts. As agentic coding accelerates the output of both code & vulnerabilities, Endor Labs is betting that scanning is the wedge into building a big business in application security. Sacra estimates Endor Labs hit $15M in annual recurring revenue (ARR) at the end of 2025, up ~131% YoY from $6.5M in 2024. For more, check out its full report and dataset on Endor Labs... What is covered in the Full Insight: * Introduction to Endor Labs * Comparison with Snyk and Market Position * Growth Trajectory and Financial Insights * AI's Role in Application Security * Future Outlook and Industry Trends Begin exploring Smartkarma's AI-augmented investing intelligence platform with a complimentary Preview Pass to: * Unlock research summaries * Follow top, independent analysts * Receive personalised alerts * Access Analytics, Events and more Join 55,000+ investors, including top global asset managers overseeing $13+ trillion. Upgrade later to its paid plans for full-access. Full Insight Related Insights
Endor Labs releases AURI platform to integrate security into ai-driven code workflows. March 3, 2026 at 4:03 PM - by MLQ Agent Key points. * Endor Labs released AURI, a free security intelligence platform for agentic software development that integrates analysis into AI coding agents. * AURI combines deterministic static analysis with AI reasoning for reachability across code, dependencies, and containers, providing automated fixes. * 90% of development teams use AI assistants, but only 10% produce secure code, highlighting a gap AURI addresses. * The platform supports integrations with tools like GitHub Copilot and Cursor to scan AI-generated code before pull requests. * Endor Labs reported 225% year-over-year revenue growth amid rising demand for AI-native security solutions.2 Endor Labs announced the launch of AURI, a free security intelligence platform designed to embed security analysis into AI-driven code generation workflows. The platform aims to help development teams produce secure code without slowing productivity, addressing the gap where 90% of teams use AI assistants but only 10% generate secure code. Platform features and capabilities. AURI integrates deterministic static analysis with AI reasoning to provide full-stack reachability, deep code insights, and automated fixes for code, dependencies, and containers. It powers features like AI Security Code Review, which uses AI agents to examine pull requests for architectural changes affecting security posture. The Endor Labs MCP Server detects and fixes vulnerabilities in AI-generated code directly within integrated development environments (IDEs) via tools such as GitHub Copilot and Cursor, enabling scans before pull requests are created. 1 Company growth and customer adoption. Endor Labs has seen 225% year-over-year revenue growth, protecting 7.4 million applications for clients including Atlassian, OpenAI, Robinhood, Rubrik, and Dropbox. The platform scans 1.6 million pull requests monthly and reduces noise by an average of 92%, offering evidence-based remediation. Mark Turner, Head of Product Security at Atlassian, stated, 'As AI transforms the pace and complexity of software development, the need for proactive, developer-friendly security solutions has never been greater.' 2 Broader platform context. AURI builds on Endor Labs' AI-native application security platform, which unifies software composition analysis (SCA), static application security testing (SAST), software bill of materials (SBOM) generation, secrets scanning, and container scanning. The company raised $93 million in Series B funding to expand capabilities for AI-generated code risks. Customers report substantial reductions in false positives and efficient prioritization of exploitable vulnerabilities. 48 AI Code Security gaps. AURI represents Endor Labs' effort to address the security challenges of agentic AI in software development, where rapid code generation outpaces traditional scanning methods. By embedding AI agents that reason like developers and security experts, the platform shifts security left in the development lifecycle, potentially reducing remediation efforts through precise, context-aware fixes. This approach leverages Endor Labs' proprietary dataset from analyzing over 4.5 million open source projects, enabling better prioritization of real risks over noise, as evidenced by the 92% noise reduction reported by customers. 24 The platform's free model lowers barriers for adoption, particularly for teams already using AI coding assistants, but its success hinges on seamless integrations and minimal developer friction. Compared to legacy SAST and SCA tools, AURI's multi-agent architecture provides reachability analysis that traditional rules-based systems lack, making it suited for monorepo environments and complex CI/CD pipelines. Endor Labs' customer base, including high-profile AI users like OpenAI, validates its relevance in securing autonomous code workflows. 13 Agentic security roadmap. Endor Labs plans to roll out AI Code Security Review to customers in May, with additional capabilities like enhanced plugins for Cursor and other code generation tools in the coming months. These updates will focus on automating remediations before code reaches production, aligning with the growing autonomy of AI-generated software. The company's roadmap emphasizes persistent memory and deeper vulnerability intelligence to support evolving AI-native SDLC practices. 1 As AI adoption accelerates, AURI could set a standard for proactive security, especially if it maintains its developer-first experience amid competition from established cybersecurity firms. Regulatory pressures in regulated industries and the rising volume of AI code - projected to dominate development - will likely drive demand, with Endor Labs' 225% growth trajectory suggesting strong market positioning. Partnerships with tools like GitHub Copilot may expand its reach, influencing broader industry shifts toward integrated security. 24 Further sources. Written with AI assistance, verified and edited by its team. Questions? Contact MLQ.ai.
Endor Labs introduces AURI, security intelligence for agentic software development. PR Newswire New platform is free for developers and embeds security intelligence into AI coding workflows, helping organizations move fast without compromising safety PALO ALTO, Calif., March 3, 2026 /PRNewswire/ - Endor Labs, the leader in AI-native application security, today announced the launch of AURI by Endor Labs, a unified security intelligence platform designed to close the gap between speed and safety in agentic software development. Software development is rapidly shifting toward AI agents that generate, review, and deploy code autonomously, but security has struggled to keep pace. AURI introduces a new intelligence layer for this emerging development model, combining agentic reasoning with deterministic static analysis to generate, review, and remediate code within a unified environment. "Every AI coding agent faces the same blind spot: it can generate code, but it can't see your full application context - how your code, dependencies, containers, and services actually connect," said Varun Badhwar, CEO and co-founder of Endor Labs. "With AURI, we're seizing a once-in-a-generation opportunity to shift security down into the SDLC, not as gates or alerts, but as intelligence at every step. The best engineering and security teams shouldn't have to compromise between speed and safety, and now they don't have to." Today, 90% of teams now use AI coding assistants, but only 61% of code is functionally correct, and just 10% is both functionally correct and secure. AURI addresses this challenge by embedding security intelligence directly into agentic coding workflows, providing an independent but integrated layer to verify the security and integrity of code produced by different AI coding agents. "The application security market is undergoing a structural shift in how controls are implemented, embedding them directly into code generation, review, and maintenance workflows rather than relying primarily on post-development scanning," said Katie Norton, research manager for DevSecOps and Software Supply Chain Security at IDC. "Endor Labs' agentic approach with AURI aligns with this evolution, integrating security as an independent, verifiable, and reproducible layer within the AI-driven software development lifecycle." "AI is driving a structural shift in software development, and it requires a fundamentally new security architecture," said Ramin Sayar, Venture Partner at DFJ Growth and Former CEO at Sumo Logic. "As development becomes agent-driven, security must be embedded intelligence, not a downstream gate. With AURI, Endor Labs is defining the security control plane for AI native software, combining deep program analysis with AI reasoning to give developers real-time confidence."
Endor Labs has launched AURI, a free security intelligence platform for AI-driven software development, which combines agentic reasoning with static analysis to embed security into AI coding workflows. The platform addresses a critical gap in agentic development, where 90% of teams use AI coding assistants but only 10% of generated code is both functionally correct and secure. AURI provides full-stack reachability analysis, deep code reasoning across multiple files, continuous ecosystem monitoring of open-source projects and AI models, and automated agent orchestration for detecting and remediating vulnerabilities. The company is offering a free developer tier through its Model Context Protocol server, enabling integration with popular IDEs including Cursor, VS Code and VSCode. Organisations can then extend AURI across CI/CD pipelines for consistent security intelligence throughout the development lifecycle.