Varun Badhwar — Founder
“Our latest scan found 39,205 CVEs,” your head of AppSec says. “Where do we even start?” asks your engineering lead. Your anxiety rises as you think about the endless meetings, arguments, and email exchanges that will inevitably follow. But open source security problems aren’t going away any time soon. Did you know only 12% of the open source code your developers import is actually used in your applications? So what you need to do, and badly, is prioritize these findings. Software composition analysis (SCA) tools generate a ton of noise. And they require expertise and time - which are both expensive - to interpret their output. To protect your company without shutting down your business operations, you need a strategy: 1. Find the signal in the noise. At most 10% of vulnerabilities in open source libraries are exploitable in any given app, but security scanners are deafeningly loud. Understanding the interaction between first-party (your proprietary) and third-party (open source) code is key to determining whether an attacker can exploit a bug. 2. Identify the top risks. Incidents like the log4shell disclosure have shown how bad a single vulnerability can be. Even worse, there are huge amounts of malicious code in circulation. Identifying and mitigating the most pressing issues will help you stay out of the headlines and get back to business. 3. Trim your dependency trees, safely. Technical debt is a fact of life and accumulates steadily. Removing old libraries from your code can reduce your attack surface. But it can also crash your application. Having a comprehensive call graph, though, can show you where you can apply the scalpel for maximum effect. You can’t hack code that doesn’t exist, so identifying and cutting the fat is an important step. We launched Endor Labs to help enterprises automate this type of detailed analysis so they can mitigate open source security and operational risks. I launched Endor Labs to help enterprises automate this type of detailed analysis so they can mitigate open source security and operational risks. After building RedLock from scratch, selling it to Palo Alto Networks within 3 years from inception, and then creating the Prisma Cloud product from 0 to a $300M ARR business in 3 years, I know exactly how to tackle these types of problems. Want to learn more about how we can help? Head to https://www.endorlabs.com/
Stackforce AI infers this person is a SaaS and Cloud Security expert with a strong entrepreneurial background.
Location: Palo Alto, California, United States
Experience: 20 yrs 9 mos
Skills
- Application Security
- Cloud Security
- Business Development
- Product Marketing
- Technical Sales
- Security Strategy
- Saas
- Risk Assessment
- Penetration Testing
Career Highlights
- Founded Endor Labs to automate open source security analysis.
- Built Prisma Cloud to $300M ARR in just 3 years.
- Led RedLock from inception to acquisition by Palo Alto Networks.
Work Experience
Forbes Technology Council
Member (3 yrs 2 mos)
Endor Labs
Founder & CEO (4 yrs 6 mos)
Cowbell
Board of Directors (6 yrs 5 mos)
Palo Alto Networks
SVP & GM, Prisma Cloud (2 yrs 11 mos)
RedLock
Founder & CEO (acquired by Palo Alto Networks) (6 yrs 8 mos)
CipherCloud
Cofounder, VP of Products & Field Operations (5 yrs)
Salesforce
Senior Manager, Force.com Security (4 yrs)
KPMG US
Consultant, IT Advisory - Information Protection Services (1 yr)
Information Sciences Institute (ISI)
Researcher (11 mos)
Northrop Grumman Corporation
Project Manager (0 mo)
Education
BS at University of Southern California
