Endor Labs
Endor Labs: A broad SCA platform for teams that need reachability and risk-based prioritization. Ranked #5 of 65 in Software Composition Analysis Software by our editors (8.8/10); pricing: Free plan · pricing on request; best for teams prioritizing reachability and risk.
At a glance
- Editor score8.8 / 10
- PricingFree plan · pricing on request
- Best forTeams prioritizing reachability and risk
- Free planYes
- SBOM generationYes
- Founded2021 · Palo Alto, California, United States
- Facts checked22 Sep 2026
Where it wins
- Reachability analysis helps identify vulnerable code that can be executed
- SBOM, VEX, upgrade impact, and container scanning support supply-chain work
- Integrates with major SCM, CI/CD, ticketing, and collaboration tools
Where it doesn't
- Advanced triage and remediation capabilities are limited to the Pro tier
- Developer is focused on individual feedback rather than team policy workflows
- The platform is not open source
Our verdict on Endor Labs
Endor Labs is an application security platform for engineering and security teams managing open-source dependencies, first-party code, containers, secrets, and software supply-chain risk. Its software composition analysis identifies vulnerable dependencies and applies reachability analysis to determine whether vulnerable functions can be executed in an application. The platform supports Maven, Gradle, npm, Yarn, pnpm, Rush, PyPI, Go, NuGet, and Bazel, with web, API, and self-hosted access. It is a strong fit for teams that want SCA to extend beyond vulnerability lists into prioritization and application context.
The product’s standout depth is its risk-management workflow. Endor Labs provides dependency risk scoring, upgrade impact analysis, policy enforcement, merge gating, pull-request and merge-request scanning, malicious-package detection, and container image scanning. It also generates SBOMs in CycloneDX and SPDX formats and supports VEX generation. The Developer plan provides AURI security feedback for individual developers, local scanning, and no-account access. Core adds reachability, prioritization, and policies, while Pro adds advanced vulnerability detection, triage workflows, and remediation capabilities.
Platform fit is another strength. Integrations cover GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Slack, email, Vanta, Microsoft Defender for Cloud, webhooks, and CI/CD pipelines. A 30-day free trial is available, and the product follows a freemium model with a free Developer plan. Teams seeking reachability-based prioritization, broad ecosystem coverage, and controls that connect development with security operations should consider Endor Labs. Smaller teams seeking only lightweight dependency scanning, or organizations wanting an open-source product, may prefer a narrower alternative.
Your product? Our editors can test Endor Labs in depth and publish a review, labelled as paid · from $149/mo →
Endor Labs pricing
All 3 Endor Labs plans and prices →
Endor Labs fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Not verified |
| Supported ecosystems | C/C++, Go, Java, JavaScript, Kotlin, .NET (C#), PHP, Python, Ruby, Rust, Scala, Swift, TypeScript, Bazel |
| SBOM generation | Yes |
| Reachability analysis | Yes |
| Pull request scanning | Yes |
| Monitored projects | Not verified |
| Deployment options | Hybrid |
| Deployment | Cloud, Self-hosted |
| Platforms | Web, Linux, macOS |
| Compliance & security | SOC 2, PCI DSS, SSO/SAML |
| Support | Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 16 integrations: GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, CircleCI … See all → |
| Pricing | Free plan · pricing on request (source) |
| Website | endorlabs.com |
| Facts checked | 22 Sep 2026 |
Endor Labs integrations
Endor Labs lists 16 integrations on its own site.
- GitHub
- GitLab
- Bitbucket
- Azure DevOps
- Jenkins
- CircleCI
- Buildkite
- Bazel
- Jira
- Slack
- Vanta
- Microsoft Defender for Cloud
- GitHub Copilot
- Cursor
- Claude
- Google Cloud Marketplace
See all Endor Labs integrations →
Alternatives to Endor Labs
- Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
- FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
- Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1
See all Endor Labs alternatives →
Endor Labs vs the competition
- Endor Labs vs Snyk Open Source
- Endor Labs vs FOSSA
- Endor Labs vs Safeguard SCA
- Endor Labs vs Black Duck SCA
- Endor Labs vs Semgrep Supply Chain
- Endor Labs vs Socket
Compare Endor Labs with any tool side by side →
Also Ranked In
Endor Labs is ranked in 8 of our directories; the 6 strongest besides Software Composition Analysis Software.
Used Endor Labs? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Endor Labs for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Endor Labs is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/endor-labs/"><img src="https://www.itechguides.com/best/badge/endor-labs.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update