Endor Labs Named a Leader in Forrester Wave for Agentic Development Security

What Endor Labs announced

Endor Labs announced on Nov. 4, 2026 that it is a Leader in the Forrester evaluation of agentic development security tools. The company said it received the highest possible score in seven criteria, which it believes reflects its approach to securing the agentic development lifecycle (ADLC).

The company framed the recognition against a shift in how software is built. As organizations rely more on AI coding agents to write, modify and deploy software, application security is changing, according to Endor Labs. It said coding agents can now independently select dependencies, execute commands and modify application code, which introduces security decisions and risks that go beyond traditional application security testing.

In the company's view, this calls for an approach that governs agent behavior, evaluates the software agents produce and provides actionable remediation guidance throughout development.

How the platform works

Endor Labs says its platform combines agent governance, application security testing, dependency protection and AI-powered remediation inside developers' existing workflows. Through integrations with Model Context Protocol (MCP), skills, command-line interfaces (CLI) and APIs, it aims to bring security into the environments where coding agents operate.

The company listed four capabilities:

• Agent governance: applies security policies to supported coding agent actions through native hooks, helping organizations control agent behavior and reduce risks within development environments.
• AI-powered application security: continuously analyzes application code and dependencies to identify and prioritize vulnerabilities using deep application context.
• Software supply chain protection: evaluates open source packages at installation time through Endor Labs Package Firewall, helping prevent risky dependencies from entering the development environment.
• Agent-native security workflows: integrates with major AI coding agents, including Claude Code, Codex, Cursor and Devin, to deliver security guidance and remediation within existing development processes.

Company comments and the Forrester disclaimer

Varun Badhwar, CEO and co-founder of Endor Labs, said: "AI agents are fundamentally changing how software gets built, and security needs to evolve just as quickly." He added that the company believes its recognition as a Leader "reflects the importance of securing the entire agentic development lifecycle, from the actions agents take to the code they produce."

Badhwar also said Endor Labs is advancing AI security through deeper code context, connecting application code, dependencies and data flows to help organizations understand, prioritize and address security risks. According to him, combining this context with consistent security controls and actionable guidance within existing workflows will become increasingly important as enterprises scale agentic development.

The release includes Forrester's standard disclaimer: Forrester does not endorse any company, product, brand or service in its research publications and does not advise anyone to select products or services based on the ratings in those publications.

What it means for security teams

The announcement reflects a broader point the company makes about enterprise software: when AI agents choose packages and run commands on their own, security checks aimed only at finished code may leave gaps. Endor Labs argues that controls need to operate at the moment agents act, for example when a package is installed.

Teams using coding agents such as Claude Code, Codex, Cursor or Devin can see from the release which tools the company says it integrates with. The evaluation results themselves are Forrester's, and the claims about the platform's strengths come from Endor Labs. The company directs readers to its website for more detail on its approach and the recognition.