We’re partnering with Endor Labs to help security and engineering teams stop chasing theoretical risk and start fixing what attackers can actually reach and exploit.
The idea is simple. Endor Labs tells you which vulnerabilities are reachable in your code. Bright STAR proves which of those are exploitable in your running application. Put together, mutual customers get one prioritized list backed by two independent forms of proof, instead of two disconnected reports they have to reconcile on their own.
Two sides of the same question
Bright Security is the developer-first application security testing platform behind Bright STAR, which brings together DAST, API security testing, and Agentic Offensive Security with AI-driven runtime validation. Bright STAR tests running applications and APIs the way an attacker would, generating context-aware payloads and confirming exploitability before anything gets reported. The result is a false positive rate under 3%, in a category where legacy DAST tools routinely land above 30%.
Endor Labs is an agentic application security platform built on its code context graph, a continuously updated model of how an application behaves across first-party code, open source dependencies, and containers. Its full-stack reachability analysis traces the path from input to the vulnerable function, which helps customers cut SAST, SCA, and container scanning noise by roughly 95% on average. Endor Labs secures more than 5 million applications for teams at companies like Atlassian, Cursor, Dropbox, Robinhood, Rubrik, and Snowflake.
What teams get
- Dynamic testing focused on what’s reachable. Endor Labs flags which vulnerabilities in first-party code, open source, and container images sit on a call path from untrusted input. Bright STAR then confirms which of those are exploitable, instead of testing everything a static scanner surfaced or leaning on EPSS as a guess.
- Prioritization backed by runtime proof. When Bright confirms a finding is exploitable, it moves to the top automatically. Teams get a list supported by static evidence and a live proof of concept, not a severity score alone.
- Lower token and compute costs for AI remediation. Verified, machine-readable evidence from both platforms lets AI coding and remediation agents spend their reasoning on real problems, not on re-deriving reachability or re-checking unconfirmed findings.
In their words
“Security teams don’t need another disconnected stream of findings. They need evidence they can act on. By pairing Endor Labs’ reachability intelligence with Bright’s AI-driven runtime validation, we help teams focus remediation on vulnerabilities that are both reachable and demonstrably exploitable, so developers and AI agents can fix what matters with confidence.”
Gadi Bashvitz, CEO, Bright Security
“The future of AppSec isn’t more findings; it’s better evidence. Reachability tells you whether a vulnerability can matter in your application, and runtime validation proves whether it can actually be exploited. Together, Endor Labs and Bright give developers and AI agents the context to prioritize real risk and remediate with confidence.”
Varun Badhwar, Co-Founder and CEO, Endor Labs
Someone always pays for the noise
AppSec tooling was built for a world where humans wrote the code and humans triaged the findings. That world is gone. Pull requests are up triple digits year over year, more of them are AI-generated, and the agents reviewing and fixing that code burn tokens on every finding they touch.
So a false positive isn’t just a wasted afternoon anymore. It’s wasted inference, wasted tool calls, and an agent reasoning in circles about a flaw that was never exploitable. Endor Labs’ own benchmarking found that an agent without deterministic security context needed roughly 12x more tokens to answer the same reachability and exploitability questions as one that had verified evidence in hand.
We see the same tax from the runtime side. When an AI fix agent “resolves” a false positive, it has spent real compute on a problem that didn’t exist. When it patches an unvalidated finding the wrong way, it can introduce a regression that costs more to unwind than the original issue.
Static reachability and dynamic validation each cut noise on their own. Together they cut it twice, once on the theoretical side and once on the exploitable side. That’s the difference between a backlog that shrinks by 90% and one that shrinks by closer to 99%.
How the integration works
- Endor Labs narrows the list. Function-level reachability analysis flags which open source vulnerabilities and code flaws sit on a call path from untrusted input, and filters out everything that can’t be reached.
- The findings hand off to Bright. Endor Labs passes that reachable candidate list to Bright as a SARIF file.
- Bright STAR confirms exploitability. STAR tests the running application and validates which reachable findings can actually be exploited.
- One prioritized list. Reachable and confirmed exploitable comes first, reachable but unproven comes next, and the noise neither tool flagged as urgent stays out of the way.
Teams can also run Endor SAST and Bright STAR together as a CI gate. Vulnerable code gets caught and proven exploitable before it ever reaches the production branch, so developers and their AI coding agents only spend time on issues that are real.
Built for the agents doing the fixing
An AI agent is only as good as the evidence it’s given. Ask a coding agent to fix “a SQL injection vulnerability” with no reachability context and no runtime confirmation, and it will do what an under-informed human would do: ignore it, or over-fix it into a regression.
Verified, machine-readable evidence changes that. When a finding arrives with a call path from Endor Labs and a confirmed exploit path from Bright, a remediation agent has enough grounding to write a fix scoped to the actual problem. It also has enough evidence to skip the findings that don’t need touching at all.
The same thinking extends to AI-specific risk. Endor Labs covers the OWASP LLM Top 10 in AI SAST, and Bright dynamically tests LLM-powered applications for issues like prompt injection and insecure output handling. That’s static and dynamic evidence for the new risks in your applications, not only the traditional ones.
Security stops being a report someone reads on a Friday. It becomes intelligence an agent can act on the moment code is written and the moment it runs.
Get started
If you’re figuring out how static reachability and dynamic validation fit into an AI-accelerated SDLC, or you’re the one paying the token bill for an agent second-guessing findings nobody confirmed, we’d love to talk. Contact us to see the Endor Labs and Bright integration in action.
