I like how everything is organized in a clean, professional way. Endor Labs’ UI stands out because it’s easy to use and navigate. I also really appreciate the Endor Labs support team, they’re often available when I need them, and they can walk me through the product or help me understand how to integrate Endor Labs into the work I’m assigned.

Endor is our single SAST and SCA scanner across a polyglot monorepo with a wide mix of languages. What I value most is that it prioritizes findings by reachability (what we should do) rather than CVSS (what we used to do). A lot of transitive-dependency CVEs that look High on paper drop out of the queue once Endor shows the vulnerable function is never called, so my team spends time on the findings that actually matter. The AI triage tags on SAST findings, along with the policy engine, help in the same way for noisy rule classes. As a result, the saved filter my engineers work from stays a short, honest remediation list. Everything is scriptable through the endorctl CLI, so we run our entire triage and snooze workflow against the API while keeping Endor as the source of truth, and our GitLab CI jobs emit artifacts we retain as forensic evidence. An unexpected win has been supply-chain response: when Shai-Hulud 2.0 compromised 348 npm package versions, a single query against Endor's dependency inventory confirmed across every project that we weren’t exposed—in minutes, instead of a day spent grepping lockfiles.

Reachability analysis feature, detailed and useful recommendations, higher accuracy, flexibility of integration and usage, user friendly UI.