Endor Labs Raises $93M to Expand AI Code Protection Platform

A 2023 finalist in RSA Conference’s prestigious Innovation Sandbox contest raised $93 million to expand from application security into AI governance and code security.

See Also: OnDemand | AI in the Spotlight: Exploring the Future of AppSec Evolution

Endor Labs will use the Series B proceeds to monitor and secure code written by AI assistants, tapping into the Silicon Valley-based company’s foundational infrastructure built over years of securing open-source code, according to co-founder and CEO Varun Badhwar. He said Endor’s approach integrates AI security checks right into developer tools such as Cursor to address unique risks related to AI-generated code.

“The pedigree of us founders, having been repeat entrepreneurs, having created significant success in the cloud security market before we entered the application security market, just allowed us to have a lot of choices,” Badhwar told Information Security Media Group. “And eventually, this became a game of chicken, because we had over-subscribed interest from lots of different investors.”

Endor Labs, founded in 2021, employs 145 people and has been led since its inception by Badhwar, who scaled Palo Alto Networks’ Prisma Cloud business to $300 million in annual recurring revenue in three years. Badhwar previously started and led RedLock, which was purchased by Palo Alto Networks in 2018. The funding comes 20 months after Endor closed a $70 million Series A round led by Lightspeed and Coatue (see: Endor Labs Raises $70M to Push From Code to Pipeline Defense).

From Vulnerability Prioritization to AI Governance

The latest funding round was led by DFJ Growth, which Badhwar praised for its experience backing firms such as OpenAI and xAI as well as its relationship with longtime operators including Ramin Sayar, who led Sumo Logic through IPO and acquisition and will join Endor’s board. The Series B money will ensure Endor can scale aggressively while the rest of the world remains cautious because of macroeconomic uncertainty.

“We are fortunate that we have hired some of the best people on the planet in program analysis, application security and AI,” Badhwar said. “In fact, a third of our engineering team that writes code here are PhDs in these spaces. So, we want to keep the caliber of our talent pool extremely high.”

With LLMs now writing a substantial portion of enterprise code, the security risks multiply since these models are often trained predominantly on open-source software, which is often laced with vulnerabilities, Badhwar said. The proprietary databases Endor has spent years developing around open-source flaws enable Endor to act as an intelligent layer between AI-generated code and production deployment.

“It turned out 80 to 90% of code in a modern enterprise’s open source,” Badhwar said. “We have the most depth and knowledge that we had been building for three-and-a-half years in that space. We also built the most unique and intimate way to understand our customer software development. We built this graph of a code base for a customer that had very precise insights into how they’re writing their code.”

Endor’s shift from vulnerability detection and prioritization to AI governance was fueled by the firm’s unique open-source vulnerability graph and its internal call graph analysis of customer code, Badhwar said. The company’s foundation abstracts access to their core datasets and functionality, allowing teams to launch new security agents quickly that address items from vulnerability scanning to code review.

“We didn’t need to go rebuild from scratch because we already had all of this training data on open-source software,” Badhwar said. “We knew all the vulnerabilities in open-source software. We have a proprietary database there. We have billions of indicators of data points of risk and security and quality issues on that data set. We had a way to scan the customer’s code very fast and early in the process.”

What Sets Endor Labs Apart From Competitors

While Endor does compete with vendors like Snyk and Checkmarx, Badhwar said the company differentiates by being more deeply integrated into the developer workflow, more comprehensive and far more future-facing as AI reshapes how software is built. Endor is focused on securing the code that AI writes, which Badhwar said is a crucial but still under-addressed problem in enterprise software.

“We are not just trying to solve one small sliver of problems,” Badhwar said. “We’re solving the human-generated code, the AI-generated code, the vulnerabilities, the malicious code, the remediation and so we’re really becoming the platform for secure software development.”

Endor serves customers in the software, financial services and insurance industries, Badhwar said, with customers ranging from 200-person firms to global giants with more than 200,000 employees. Initially adopted by application security teams, Endor is gaining traction among platform engineering teams and CTO organizations since it increases developer productivity by automating vulnerability management.

“We are seeing more and more excitement, engagement and interest from platform engineering teams and CTO organizations,” Badhwar said. “The cohesive nature of our platform, which brings together security use cases and developer productivity; harnessing the power of that is allowing us to expand from application security teams to platform engineering teams.”

Badhwar said annual recurring revenue reflects Endor’s ability to bring in new business, while net recurring reflects its ability to retain and grow existing accounts – something he is particularly proud of, citing a 166% NRR. He also tracks everything from top-of-funnel performance to sales conversion, customer acquisition cost and gross margins in hopes of building a business that can scale to IPO.

“We want to build an IPO-able business, which means having the right efficiency and the right customer acquisition cost metrics are important to us as our gross margins,” Badhwar said. “So, those are things that I care about internally to make sure we’re building a sustainable and financially efficient business.”