G2

Wes H.

Director of Security

Small-Business (50 or fewer emp.)

10/14/2026

"Reachability-Based Prioritization That Keeps Our Remediation Queue Honest"

5/5

What do you like best about Endor Labs?

Endor is our single SAST and SCA scanner across a polyglot monorepo with a wide mix of languages. What I value most is that it prioritizes findings by reachability (what we should do) rather than CVSS (what we used to do). A lot of transitive-dependency CVEs that look High on paper drop out of the queue once Endor shows the vulnerable function is never called, so my team spends time on the findings that actually matter.

The AI triage tags on SAST findings, along with the policy engine, help in the same way for noisy rule classes. As a result, the saved filter my engineers work from stays a short, honest remediation list. Everything is scriptable through the endorctl CLI, so we run our entire triage and snooze workflow against the API while keeping Endor as the source of truth, and our GitLab CI jobs emit artifacts we retain as forensic evidence.

An unexpected win has been supply-chain response: when Shai-Hulud 2.0 compromised 348 npm package versions, a single query against Endor's dependency inventory confirmed across every project that we weren’t exposed—in minutes, instead of a day spent grepping lockfiles. Review collected by and hosted on G2.com.

What do you dislike about Endor Labs?

The SAST side still needs some improvement. Rules fire without deployment context, so intentional unsafe blocks in Rust FFI code and anything in mocks, sandboxes, and example apps all surface at the same severity as real bugs. The code snippet in the finding is too small to judge from without opening the file.

Reachability sometimes comes back unknown rather than reachable or not, and unknown is not unreachable, so those still cost a human. The API is powerful but not ergonomic: updating a finding means sending the whole object plus a field mask, listing findings on a large monorepo needs long timeouts, and bulk snoozing with a written rationale. Review collected by and hosted on G2.com.

What problems is Endor Labs solving and how is that benefiting you?

Endor gives me one SAST and SCA scanner across a multitude of languages on a monorepo, which let us retire other tools and consolidate pipeline jobs. Reachability analysis turns a CVSS backlog into a short list of findings that are actually exploitable in our environment, so a small team spends its time on real risk instead of transitive-dependency noise. The scan artifacts feed our FedRAMP evidence trail directly from GitLab CI. And when a supply-chain attack hits npm, one query against Endor's dependency inventory tells me in minutes whether we are exposed across every project, which used to take up to a day. Review collected by and hosted on G2.com.