00:16:03 · Siddhartha Ahluwalia
[00:16:03] S1: So, what was the trigger point for you to start Endor? Because you started during COVID time, a very uncertain time to begin a company. You can you could have continued building Prisma to multi-multi-billion dollars in business.
00:16:18 · Varun Badhwar
[00:16:18] S0: That was my wife's uh argument against me starting a company, yes. Uh look, you know, they say founders have this bug. I mean, why is Travis Kalanick starting another company after Uber, right? Why I I feel like us founders have this crazy gene in us, and that gene doesn't let us sit comfortably or see and be a part of status quo. I feel like the natural instinct is if you see a problem, you want to go fix the problem. And in 2021, while us were building this incredible business, um I saw a problem. And that problem was software development was radically shifting from development to assembly. 18% of our code wasn't even being written by developers, it was open source, it was all of these other things. We had no idea who's written this code and published it on GitHub. Yet we were blindly trusting all of this code and just in the spirit of moving fast, bringing it in and using it. That's one side of the change. The other side is you are analyzing this with incumbent tools and security scanning tools for code, and they would find a bunch of stuff. And you would check a box and compliance reports that says, yes, I scanned my code for vulnerabilities. But the reality was the volume of problems that were being discovered and the fidelity of that volume was really low. So engineers just didn't trust the results. So you're building apps, you're using all this code, you're relying on third-party open source. And at the same time, you have all of these potential security issues, you couldn't figure out what's real, what's not, and how you're going to fix them. And I think ignorance was bliss. But like for me, as a problem solver, I was like, look, this is a bubble waiting to crash. Like it this cannot sustain. And you look forward, two years later, LLMs were starting to write code. And if you look at 2026 today, what is the biggest topic of conversation? The fact that every security vulnerability can easily be discovered faster than ever before by LLMs. Like they're really good at finding bugs. And so now the problems become well, if LLMs can find so many problems, why can't we secure that code and build it correctly from the first onset? And the reality is historically, it's been a friction point. Do you either ship code fast or do you ship it securely? It's never been an end.
00:18:46 · Varun Badhwar, Siddhartha Ahluwalia
And our mission at Endor that I took on is we can help you ship fast and ship securely. If you build the right architecture, the right technology, the right insertion point in the software development lifecycle, you can solve all of those problems. We started that in 2021. And I couldn't be happier because sitting here today, we've had the time to build and scale a platform, prove it out with the world's most amazing customers in technology, finance, insurance, et cetera. And now this is the number one problem that is constraining us from adopting a gentic STLC is code generation is not the problem. It's security, it's quality, it's everything to do with releasing of the software much faster, and we're primed to solve it. [00:19:33] S1: And you operate on the left side completely?
00:19:36 · Varun Badhwar
[00:19:36] S0: The way I describe to be bill where Endor fits in is um if you want to draw a box around the entirety of the agentic SDLC from cloud code cursor, pick your favorite ID, agentic ID, through your pull requests, through your um CI CD pipeline till you have an artifact that is ready to be deployed in the cloud, container or jars, whatever, that is our zip code. From the first intent of writing code to writing the code to checking it into your pull requests and GitHub to CI CD pipelines, securing all of that such that what is ready is the most secure piece of software you could possibly create without compromising on speed is the outcome that Endor uh drives for our customers. And kind of that, unfortunately, in security, that workflow continues post-deployment because now I deployed the product yesterday. Now, today, 10 new things were found in security, like vulnerability discoveries. Now you've got to figure out off that code base, off those 10 vulnerabilities, what actually affects me? And how do I quickly pinpoint what affects me? How do I fix it without breaking my application and redeploy really, really quickly? And that time window to remediate used to be six to 12 months because, yeah, sure, somebody found a vulnerability yesterday, but the the likelihood that somebody's going to build an exploit and target you and come at you was like very low, 1%, 2%. Today that's that's reality. Within 10 hours, people have found and created working exploits for new vulnerabilities. And so this loop of remediate triage and remediation of what affects my code, what do I need to fix? Could literally become a full-time job for every engineering team on the planet. But it's not sustainable. So that's what we're automating for our customers.
00:21:32 · Siddhartha Ahluwalia
[00:21:32] S1: And why is security improving much, much more slowly than the generation of code?
00:21:39 · Varun Badhwar
[00:21:39] S0: That's a great question. One of my favorite topics I spent a lot of time on. Because you know, conventional wisdom would say look, we these agents are getting so smart, models are getting so smart, we keep hearing how they can find every security bug. Well, why can't it write code security? We have to go trace back to the origins of how these models are trained. Model from every lab that is learning coding is learning coding based on open source. They go index the last 20, 30, 40 years of code that exists on the internet. Most of it is on GitHub, maybe Stack Overflow, maybe other places. That code has various forms and vectors of security, quality, reliability, et cetera. The models are learning not just the good behavior, they're learning all of the inherent security problems that these uh the training code has introduced. And it is a very hard technical problem to figure out how to piece away what the model has learned that subsequently was known to have security bugs, and how it was circumvented or fixed later. And so models are producing way more code that is insecure than humans. The other piece is at the same time, traditionally, at least we had some review processes. Human in the loop for every pull request for regulated companies that would review the code base. Today you can't do that. Like the volume of code being generated is so high, human eyes can't pay attention to catch every security bug, logic bug, architecture bug in the code base. And so, yeah, I think the combination of the models themselves generate more insecure code. You have citizen developers that don't even understand what is being built and output, and you don't have enough people to review all of this code diligently. That is causing much more of your code to be vulnerable. That's on your code. As it relates to all of the open source code you've been using and relying on, you're finding 10x more vulnerabilities there because, again, models are easily discovering more and more problems. And if you're in the open source ethos, whose responsibility is it to fix? If I was a hobbyist, I was a college graduate. Over the summer, I created a project that became popular. Now Anthropic is coming to me and saying, you got to fix these 20 vulnerabilities that we found? I'm not interested. I'm back to school, I'm busy. Right? So it's just a very strange world that we live in.