Varun Badhwar, founder of Endor Labs, warns nation-state actors from North Korea, China and Russia are dominating malicious code injection through open source, where one compromised account can reach hundreds of millions of downloads.
Badhwar says remediation windows have shrunk from six to 12 months to about 10 hours before working exploits appear, so human review can no longer keep pace with AI-generated code.
Badhwar estimates security should take about 10 percent of IT budgets, arguing a 9,000 dollar tool is a clear buy when it saves a 300,000 dollar engineer 90,000 dollars of time.
AI Writes Code Faster Than Anyone Can Secure It
AI coding tools are producing software far faster than security can keep up, and the models learned from public code that already contained flaws. Attackers move within hours, so security has to run automatically across the whole agent-driven development pipeline. Badhwar built Endor Labs on that thesis, drawing on his RedLock exit to Palo Alto Networks.
Takeaways
AI writes code faster than anyone can secure it. Models learn from decades of public code, security flaws included. Code is now generated about 10 times faster with more security problems, human review cannot keep up, and the bottleneck in software is now security and quality.
Open source is a nation-state attack route. Badhwar says North Korea, China and Russia dominate pushing malicious code through open source. Anyone can take over one account and push malware reaching 500m downloads. Endor's package firewall blocks developers and agents from pulling malicious packages, models or skills.
Remediation windows shrank from months to hours. Fixing a vulnerability once allowed six to 12 months. Working exploits now appear within 10 hours. About 10 times more vulnerabilities are found in open-source code, and the gap between found and fixed widened more last year than in the prior decade.
Security tooling pays for itself. Companies spend 6 to 8% of IT budget on security, and Badhwar says it should be about 10%. A $300,000 Bay Area engineer loses $90,000 of time to security issues, so a $9,000 tool is an easy purchase.
Endor Labs targets the agentic development lifecycle. Badhwar started Endor in 2021 as development shifted toward assembling open-source and AI-written code, with about 18% of code not written by developers. It covers tools like Claude Code and Cursor, then pull requests and CI/CD.
Enterprise buyers decide before the first sales call. Badhwar says 80% of a buyer's vendor decision happens before any call. A startup with three reps misses 98% of conversations a 300-rep rival joins, so Endor relies on independent research and university-built benchmarks, not booths.
RedLock thrived inside Palo Alto Networks. Nikesh Arora backed RedLock as a separate unit. It grew from five to 10m ARR to 100m and served 65,000 Palo Alto customers after an exit near $250m. Palo Alto scales acquired founders first and reorganises later.
Founder lessons from Badhwar
Hire the first salespeople in pairs.
Build the company to be the best at its problem, not to be acquired.
Early hiring of young, early-career talent left CipherCloud with a lot of technical debt.
Tap a name to go there · tap a line to see why they are linked
On this episode 2
Show 1
He cannot forecast Endor's two-to-three-year roadmap with confidence, and six months would be a win.