Skip to content

Back to the catalog

How Endor Labs AI SAST Learns What Matters to Your Organization | Blog | Endor Labs
endorlabs.comarticle

How Endor Labs AI SAST Learns What Matters to Your Organization | Blog | Endor Labs

Endor Labs explains how its AI SAST product incorporates context beyond source code — automatically-ingested Infrastructure as Code (Dockerfiles, Terraform, CloudFormation, Kubernetes/Helm) and repository files (AGENTS.md, CLAUDE.md, skills files), plus optional analyst feedback and natural-language threat-model/architecture context — to build a deployment-aware model of an application and cut false positives. It cites a benchmark of 192 verified vulnerabilities across 8 projects, claiming 2.6x more true positives than the next tool (Claude Opus 4.7) and 63 findings no other tool caught, and walks through customer examples where external-auth annotations and WAF-mitigated XSS severity were tuned via this context.

TL;DR Endor Labs details how its AI SAST ingests IaC, AGENTS.md/CLAUDE.md, and analyst feedback to reduce SAST false positives and prioritize deployment-reachable findings.
Open original ↗

Technologies named here

Techniques named here

  • Program analysis / code context graph construction
  • Semantic indexing
  • IaC analysis for deployment modeling
  • Repository context extraction
  • User feedback loop on findings
  • Custom architecture/threat model context ingestion
  • Missing authorization check detection
  • Reflected XSS severity tuning based on external mitigations

Related in AppSec