Skip to main content

​
Prioritization

Both Endor Labs and Semgrep support the prioritization of findings so that AppSec teams focus on the most impactful findings. While both companies offer findings filters based on criteria like reachability and EPSS scores, Semgrep offers support for statuses in addition to the basic reachability statuses of reachable and not reachable, such as always reachable and conditionally reachable. Furthermore, Semgrep Multimodal uses AI to help organization admins receive information on top backlog tasks, allowing them to prioritize findings from all products, including the SAST and SCA products, not just those resulting from dependency vulnerability scans.

​
Reachability for transitive dependencies

Reachability has been a fundamental part of Semgrep Supply Chain from the beginning. Supply Chain offers advanced reachability analysis for direct dependencies in the form of dataflow reachability, offering accuracy beyond that offered by Endor Labs. This coverage is offered for seven languages and counting.

​
Vulnerable functions

Semgrep doesn’t just identify a vulnerability as reachable when a vulnerable function is called — it also takes into account how the vulnerable function is called and what data flows into that function. These functions are achieved through the use of Semgrep’s rule syntax; when a rule is written, all possible permutations of the vulnerability are encapsulated in the rule. This functionality is something that Endor Labs doesn’t have. Semgrep’s security research team doesn’t just focus on analyzing a vulnerable function when writing rules. The team extends the scope of analysis to all the third-party callers of the vulnerable functions, not just the reported third-party function that’s vulnerable. This extends the set of vulnerable functions greatly. The following rule demonstrates this functionality:
The vulnerable function is download, as shown by the fix commit. The function _check_exists_and_download calls download, which you can see in the source code. Thus, both functions are flagged in the rule in the final three lines. Learn more about how the security research team writes rules in A day in the life: Supply Chain Security Researcher

​
Policies and flexibility

Semgrep’s policies management feature provides extensive flexibility, especially with respect to a developer’s workflow. You can configure Semgrep to leave pull request or merge request comments, block pull requests or merge requests, create Jira tickets, send Slack notifications, and more whenever Semgrep identifies findings.

​
Dependency lifecycle management

To help you manage your findings, Semgrep provides information, including EPSS probabilities, severity levels, transitivity information, and multiple levels of dataflow reachability.

​
Accuracy of results

Semgrep has reachability analysis for over 80% of critical CVEs dating back to 2017 and 100% of critical and high severity CVEs dating back to May 2022. Endor Labs’ reachability data, however, dates back to 2018.