Endor Labs Due Diligence

Run due diligence on Endor Labs: check compliance and get alerts when suppliers change.

United States · endorlabs.com · 25 vendors

Endor Labs is an application security platform that helps engineering and security teams identify, prioritize, and fix vulnerabilities in both human-written and AI-generated code across the software development lifecycle. The company focuses on software supply chain security and dependency lifecycle management, aiming to reduce alert noise and provide actionable remediation guidance.

Resilience scores

Technology vendors

Insights

Last updated 2026-04-05 · revision 1

25 direct vendors, 222 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

3 in-scope frameworks identified; showing 3.

GDPR (source) — No public evidence

Evidence: https://www.endorlabs.com/legal/privacy-policy, https://www.endorlabs.com/about

SOC 2 (source) — Evidence found

Evidence: https://www.endorlabs.com/learn/endor-labs-is-soc-2-type-ii-certified

ISO 27001 (source) — No public evidence

Financials

Three-year financials

Financial Resilience Score: 7/10

Endor Labs demonstrates strong financial resilience indicators for a Series B-stage private company, despite the absence of any disclosed absolute revenue, EBIT, or equity figures. The most compelling signal is its 166% Net Revenue Retention (NRR), which is substantially above the ~120% benchmark considered best-in-class for enterprise SaaS. This metric implies the company can grow revenue materially from its existing customer base alone, reducing dependence on costly new customer acquisition and providing a degree of revenue predictability unusual for a company of this age. The company has raised at least $163 million in known venture funding, including a $93 million Series B in April 2025 that was described as significantly oversubscribed and preempted by investors. This fundraise occurred during a period of acknowledged macroeconomic volatility, which the CEO described as 'the most uncertain macroeconomic conditions since the Great Depression,' making the investor enthusiasm particularly notable. With a relatively lean estimated headcount of 100–250 employees, the company likely commands multiple years of operating runway from the April 2025 raise alone. The blue-chip customer base — including OpenAI, Atlassian, Dropbox, Robinhood, Snowflake, Rubrik, and Zapier — provides revenue credibility and suggests the company is winning enterprise-grade procurement processes. The 30x ARR growth over 18 months ending April 2025, while from an undisclosed base, indicates rapid market adoption. Participation by Salesforce Ventures and DFJ Growth (whose portfolio includes OpenAI and xAI) adds strategic and reputational weight to the company's financial profile. Key risks tempering the resilience score include the complete absence of a disclosed path to profitability, near-certain significant operating losses typical of growth-stage SaaS, intense competition from well-funded incumbents such as Snyk and GitHub Advanced Security, and continued dependency on external VC capital markets. The undisclosed post-money valuation for both funding rounds also prevents any assessment of dilution or implied revenue multiples, adding opacity to the financial picture.

Key strengths: 166% Net Revenue Retention (NRR) — well above 120% best-in-class enterprise SaaS benchmark, 30x ARR growth over 18 months ending April 2025, $163M+ total known venture funding raised, $93M Series B (April 2025) was oversubscribed and preempted in volatile macro environment, Blue-chip enterprise customer base including OpenAI, Atlassian, Dropbox, Snowflake, Robinhood, Lean estimated headcount (100–250) implies extended cash runway from recent raise, Participation of Salesforce Ventures and DFJ Growth signals strong investor conviction, SOC 2 Type II certification reduces enterprise sales friction, Proprietary data moat (call graphs for millions of OSS packages) creates defensible competitive position, Research-dense team (~1/3 of code committers hold PhDs) supports premium pricing

Risk factors: No path to profitability disclosed; company almost certainly operating at significant net loss, No burn rate, cash position, or breakeven timeline publicly available, Continued dependency on external VC capital markets for operations, Intense competition from Snyk, Semgrep, Socket, GitHub Advanced Security (Microsoft), Veracode, Checkmarx, Palo Alto Networks, CrowdStrike, and Wiz, Post-money valuation undisclosed for both Series A and Series B — impossible to assess dilution or revenue multiples, Revenue concentration risk: core differentiation still heavily weighted toward reachability-based SCA, Macro sensitivity — enterprise procurement freezes could slow new customer acquisition, Key-person risk concentrated in co-founders Varun Badhwar and Dimitri Stiliadis, No absolute ARR figure disclosed, making independent financial modelling impossible

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report