Endor Labs, the application security platform for the AI era, has announced a significant $93 million Series B funding round led by DFJ Growth, with participation from Salesforce Ventures and existing investors.
In this VMblog interview, Amod Gupta, VP Product at Endor Labs, reveals how the company is expanding its AppSec platform to address the unique security challenges posed by AI coding assistants. With 75% of developers now using AI coding tools and nearly 30% of AI-generated code snippets containing security weaknesses, Endor Labs is introducing new capabilities like AI Security Code Review and the MCP Server to help organizations secure not just their own code, but the millions of lines they didn’t write – from open source dependencies to AI-generated snippets. The company has seen remarkable growth, with 30x Annual Recurring Revenue increase and protection for over 5 million applications since its Series A funding just 18 months ago.
++
VMblog: Before we begin discussing the exciting announcements of this week, can you provide our readers a brief summary of Endor Labs and what problem they solve for security teams?
Amod Gupta: Endor Labs is the application security platform for the AI era. Our mission is to secure code and everything it depends on-from open source packages, to containers, to AI-generated code-so developers can move fast without compromising on security.
Modern software is built with layers of dependencies, open source packages, and now AI-generated code. That means security teams aren’t just securing their own code anymore-they’re securing millions of lines they didn’t write and don’t fully control. Traditional AppSec tools weren’t designed for that level of scale or complexity.
Endor Labs solves this by going deeper than simple detection. We use program analysis to surface only the risks that actually matter to your applications. Then we help teams fix them faster-whether that’s upgrading with zero-breaking-change insights or applying a security patch without touching the rest of the codebase. And we’re now expanding that approach with AI agents that operate inside the dev workflow, helping teams shift security left in a meaningful, scalable way.
The result? Less noise, faster remediation, and security that actually keeps pace with modern development.
VMblog: AI coding assistants are changing how developers write code. But security tools haven’t kept up. What new capabilities is Endor Labs launching as part of its AppSec platform expansion, particularly regarding AI-generated code?
Gupta: AI coding assistants are fundamentally reshaping how software gets written. We’re seeing a massive shift: code isn’t just written by developers anymore, it’s being generated by models trained on billions of lines of open source code. But while development has accelerated, security tools have lagged behind. Most traditional AppSec tools weren’t built to handle the scale, speed, or opacity of AI-generated code.
That’s exactly what we’ve focused on solving in this next evolution of the Endor Labs AppSec platform.
We’re introducing two major capabilities:
- AI Security Code Review – This uses multiple specialized AI agents that act like a developer, architect, and security engineer. Together, they analyze pull requests to detect high-risk architectural changes-things like new authentication flows or cryptographic logic that static scanners often miss. It brings human-level reasoning to PRs, so security teams can stay ahead, even as the pace of code changes accelerates.
- The MCP Server – This is our secure bridge between AI coding assistants (like Cursor) and the Endor Labs platform. It brings real-time security analysis into the AI-native development workflow. That means developers get prioritized, context-aware security feedback as they code, using our massive dataset of vulnerabilities, call graphs, and embeddings trained on millions of open source packages.
Together, these capabilities shift AppSec from a reactive checkbox to a proactive partner in the software development lifecycle-one that understands the nuance of AI-generated code and helps secure it from the start.
VMblog: To provide some additional context on the importance of Endor Labs’ AppSec platform, what percentage of developers currently rely on AI coding assistants? What percentage of AI-generated code snippets have security weaknesses?
Gupta: AI coding assistants are being adopted at an incredible pace-and the numbers speak for themselves.
According to Google’s 2024 DORA Report, 75% of developers now use AI coding assistants in some capacity. That’s a dramatic shift in how software gets written. And while it boosts productivity, it also introduces new risk.
Recent research shows that nearly 30% of AI-generated code snippets contain security weaknesses, and 62% of suggested solutions are either incorrect or vulnerable. That’s a serious issue, especially as organizations start to rely more heavily on AI to accelerate development.
This is why Endor Labs is focused on securing not just the code you write-but all the code your tools generate. Our platform is designed to understand the unique characteristics of AI-generated code, trace its provenance, and provide the context security teams need to mitigate real risk-without slowing developers down.
VMblog: What dataset has Endor Labs built that powers its AI agents, and what does it include? What types of proprietary data has Endor Labs built that gives them unique market insights into open source code?
Gupta: At the core of Endor Labs’ AI capabilities is the most comprehensive security dataset in the industry-purpose-built to understand the software supply chain and AI-generated code at scale.
Over the past three years, we’ve built a dataset that includes:
- 1 billion+ annotated risk factors across open source packages and AI models, including CVEs, maintainer activity, EOL status, and 150+ health and security checks per component.
- Detailed call graphs for over 4.5 million open source projects, allowing us to map exactly how code behaves, function by function, across language boundaries and dependency chains.
- 500 million+ vector embeddings, enabling us to detect the provenance of AI-generated or copy-pasted code-even when it’s been structurally or syntactically modified.
This dataset allows our platform-and our AI agents-to make decisions with precision. For example, we can determine whether a vulnerability is actually reachable in your application, what impact an upgrade would have before you make it, or whether a newly introduced snippet was lifted from a vulnerable open source package.
It’s this depth of context that lets us cut through the noise, reduce false positives by up to 92%, and automate remediation with confidence. It’s not just about detecting risks-it’s about understanding and resolving them at scale.
VMblog: These days it seems like everyone is building AI agents and LLM wrappers. What makes yours different?
Gupta: It’s true-AI agents are everywhere right now. But most of what’s out there are lightweight wrappers on top of public LLMs. They generate summaries or surface generic suggestions-but they don’t actually understand your codebase, your risks, or your environment.
What makes Endor Labs’ AI agents different is the deep, contextual foundation they’re built on.
Our agents aren’t guessing. They’re operating on the richest security dataset in the market-backed by function-level reachability, proprietary vulnerability annotations, and deep call graphs of millions of open source projects. That context means our AI agents don’t just detect issues-they prioritize real risk, trace code provenance, and propose actionable fixes, tailored to your actual application.
They also don’t work in isolation. We’ve designed our agents to operate as part of your software development lifecycle-from reviewing pull requests with architectural awareness to catching risks directly inside AI-assisted IDEs. And they integrate with your policies, workflows, and developer tools out of the box.
The result is simple: while others are layering AI on top of shallow data, we’ve built an intelligent AppSec engine that actually understands your code-and has the context you need to secure it.
VMblog: How much funding did Endor Labs raise in its Series B round, and who led the investment? What are the key metrics of Endor Labs’ growth since its Series A funding? What will the investment be used for?
Gupta: Endor Labs raised $93 million in its Series B funding round, led by DFJ Growth, with participation from Salesforce Ventures and existing investors including Lightspeed Venture Partners, Coatue, Dell Technologies Capital, Section 32, and Citi Ventures. Since its Series A funding just 18 months ago, Endor Labs has achieved impressive growth metrics:
- 30x Annual Recurring Revenue (ARR) growth
- 166% Net Revenue Retention (NRR)
- Protection of more than 5 million applications
- Over 1 million scans conducted weekly for customers
The company’s customer base now includes notable organizations like OpenAI, Rubrik, People.ai, Observe.ai, Mysten Labs, and several global financial institutions.
The investment will support the expansion of Endor Labs’ AppSec platform, which is specifically built for securing AI-generated code and “vibe coding” through agentic AI and their rich security dataset.
##
