January 2024 Summaries

Endor Labs offers a tutorial on using its SBOM Hub to manage Software Bills of Materials (SBOMs) effectively, focusing on the ingestion of both first and third-party SBOMs and detecting vulnerabilities. The platform allows for the manual or automated import of SBOMs in CycloneDX or SPDX formats and centralizes their management to ensure compliance and risk assessment across code and pipelines. By integrating with continuous integration (CI) systems, users can maintain updated SBOMs and generate Vulnerability Exploitability Exchange (VEX) documents to annotate vulnerabilities, enhancing the reliability of software composition analysis (SCA). This process not only meets stakeholder and compliance requirements but also provides a comprehensive view of potential risks, with the ability to automate SBOM creation across multiple versions and languages without additional tools. The broader context includes the increasing requirement for software vendors to provide SBOMs and highlights recent security issues, such as a path traversal vulnerability in OpenClaw and a supply chain attack on the n8n ecosystem.

VMware successfully achieved SBOM compliance for over 100 services by collaborating with Endor Labs to develop a scalable and efficient process that manages and verifies Software Bill of Materials (SBOMs) across their vast software ecosystem. Following the release of Executive Order 14028, VMware's Global InfoSec Compliance team faced the challenge of establishing a centralized system for collecting and attesting SBOMs from both internal business units and external vendors. Endor Labs was chosen for its ability to generate and annotate Vulnerability and Exploitability eXchange (VEX) documents, which provide critical insights into vulnerabilities associated with SBOMs, enabling VMware to prioritize and address risks effectively. The integration of Endor Labs into VMware's development workflow ensures continuous monitoring and validation of SBOMs, enhancing their security posture and offering the necessary transparency and assurance for stakeholders and executives. This partnership not only facilitates risk assessment and compliance but also improves efficiency by allowing the team to quickly identify and remediate potential security gaps.

Implementing new security tools like Endor Labs can be complex and error-prone, often requiring intricate setup configurations and resulting in frustrating experiences for security and platform engineering teams. To address these challenges, Endor Labs has introduced DroidGPT, a generative AI-based feature designed to simplify the installation process by providing real-time feedback, AI-driven actionable advice, and reducing dependency on human intervention. The tool identifies and resolves compatibility issues by first checking host machine compatibility and then resolving source code dependencies, offering precise instructions for fixing errors without needing developer assistance. DroidGPT operates on a private Azure AI instance, ensuring data privacy and security while enhancing user experience through carefully engineered prompts. This feature is aimed at streamlining the integration of Endor Labs in CI/CD pipelines, offering an opt-in solution for current customers to improve open-source software security workflows.

Endor Labs provides a tutorial demonstrating how to use its open-source tools to generate Software Bills of Material (SBOMs) and Vulnerability Exploitability Exchange (VEX) documents, which are essential for both stakeholder compliance and risk assessment across software code and pipelines. By leveraging the same tool for Software Composition Analysis (SCA), users can automate the creation of SBOMs across different software versions and languages without requiring additional plugins. VEX documents augment SBOMs by annotating vulnerabilities, thereby enhancing their value. This approach not only satisfies compliance and stakeholder requirements but also offers a comprehensive view of software risks. The tutorial is part of a broader discussion on security, open-source practices, and compliance associated with software development and management.

Endor Labs' tutorial on using AI for open source selection introduces DroidGPT, a feature that leverages ChatGPT alongside proprietary risk data to facilitate conversational research of open-source software packages. This tool allows users to inquire about the best packages for specific needs, such as logging for Java, while providing instant answers accompanied by risk scores that assess each package's quality, popularity, trustworthiness, and security. DroidGPT is part of Endor Labs' broader effort to enhance software security and compliance, offering tools and insights that help organizations manage open-source software effectively in an AI-driven era. The tutorial, published in January 2024 and updated in August 2025, is part of a range of resources including guides on software security programs and open-source tool rankings, all designed to assist with the challenges and opportunities presented by AI and open-source technologies.

Endor Labs has announced support for Bazel, a widely-used build system for projects in monorepos and across multiple programming languages, which allows for the analysis of security and operational risks in software built with Bazel, including native rules for Java, Python, and Golang. Bazel helps improve development productivity by speeding up build processes with parallel builds and caching, and ensuring reproducible builds that prevent unintentional changes. Despite its advantages, Bazel presents challenges for software composition analysis (SCA) tools, as many do not fully support Bazel or the multiple languages it can manage, leading teams to create inefficient workarounds. Endor Labs addresses these issues by enabling selective and efficient scanning of Bazel targets, aligning with Bazel's philosophy to only scan what is necessary, thereby saving time and resources. This approach allows monorepo teams to conduct more accurate and efficient analysis, maintaining productivity without sacrificing security or compliance.

The text delves into the concept of "reachability analysis," a term with varied definitions across vendors, as it relates to software security and risk management. It distinguishes between Software Composition Analysis (SCA) and container scanning, emphasizing that while both tools are used to identify vulnerabilities, they do so in distinct ways. The author categorizes reachability into five types: function-level, package baselining, internet, dependency-level, and package used in image, each serving different prioritization and remediation purposes. Function-level reachability is highlighted for its precision in identifying true vulnerabilities, while package baselining is seen as promising for runtime protection. Internet reachability and package used in image are critiqued as potentially more marketing-driven than practically effective. The text concludes with a call to critically assess vendors' claims about reachability analysis to effectively address vulnerabilities without being misled by buzzwords.