Every Build Under Your Control_
New: Major version 1.0 officially released
New: Major version 1.0 officially released
New: Major version 1.0 officially released
New: Major version 1.0 officially released
New: Major version 1.0 officially released
Scanners list what your build declares.
Provenance attests to where it came from.
Endura controls what it does.
$ systemctl enable endura-sensor
✔ Starting Runtime Sensor...
Ready to accept connections
$ endura job start --mode enforce --workspace ./your_cicd_job
> Monitoring job at ~/workspaces/your_cicd_job...
> Fetching policy from Team Server
> Enforcing policy security-baseline
$ endura sensor logs -f
✔ Starting Runtime Sensor...
$ endura sensor logs -f
ready to accept connections at
/run/endura/sensor.sock
Provenance and verification prove where code came from. It says nothing about what that code does once your pipeline runs it.
It Keeps Happening
monthly downloads of packages hijacked in a single August 2026 attack.
malicious package versions published in a single day, August 4, 2026
of 2026's three largest npm supply chain attacks carried valid provenance.
on average to identify and contain a supply chain compromise.
Executed Before Anyone Could Object
Compromised packages execute the moment they're pulled in, before tests, before scans, before review.
The Pipeline Holds Every Key You Own
Cloud credentials, publishing tokens, signing identity, production access. Nothing watches them at runtime.
Your pipeline executes code nobody read, on every build. Endura sets the limits of what that code can reach and enforces them in the kernel, rejecting anything outside the boundary before it completes.
Every Pipeline, Monitored
See every CI/CD pipeline and build in one place.
Every Behavior, Captured
Understand what every build actually needs.
Every Action, Governed
Apply mandatory access controls while builds run.
Every Violation, Actionable
Stop malicious behavior before it causes damage.
Every Pipeline, Monitored
See every CI/CD pipeline and build in one place.
Every Behavior, Captured
Understand what every build actually needs.
Every Action, Governed
Apply mandatory access controls while builds run.
Every Violation, Actionable
Stop malicious behavior before it causes damage.
Endura runs as an eBPF sensor below the build and everything it invokes. Every file, credential, and network request passes through the kernel to happen at all. That's where your policy is enforced.
Under the Hood
How the eBPF Sensor WorksStopping the Threat
Recent Supply Chain IncidentsGet Started
Add Endura to a pipeline in a few lines. The same policy governs every build afterward, whether it runs on a hosted runner or your own hardware.
Setup Guide
Protect Your First PipelinePolicy Reference
Write Your First Rulejobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: Start Runtime Sensor and Job
run: |
curl -sSf https://repo.endurasecurity.com/install/endura-sensor/stable.sh | sudo -E sh
sudo -E endura sensor start -d
echo "started endura sensor: $(sudo -E endura sensor status)"
env:
ENDURA_LICENSE_KEY: ${{ secrets.ENDURA_LICENSE_KEY }}
ENDURA_SENSOR_TOKEN: ${{ secrets.ENDURA_SENSOR_TOKEN }}stages:
- build
build:
stage: build
tags:
- ubuntu
script:
- curl -sSf https://repo.endurasecurity.com/install/endura-sensor/stable.sh | sudo -E sh
- sudo -E endura sensor start -d
- echo "started endura sensor: $(sudo -E endura sensor status)"
Pipeline threats are attacks that act inside your build: stealing credentials, opening connections, poisoning caches, tampering with artifacts. They don't announce themselves in a scan because they haven't done anything yet. Endura catches them at the moment they do.
This isn't a signature list. Endura stops behavior that falls outside your policy, including techniques that don't have names yet.
Prevent attempts to read, modify, or execute unauthorized files, blocking code injection and data exfiltration attacks.
File Access
Prevent memory patching and fileless execution techniques used by advanced persistent threats and rootkits.
Memory Attacks
Prevent unauthorized container execution and socket access that could compromise containerized pipeline environments.
Container Breakouts
Prevent attackers from hijacking trusted processes through library preloading, debugger attachment, and runtime tampering.
Process Injection
Block unauthorized reads of secrets, tokens, and SSH keys, preventing pipeline credentials from being stolen.
Credential Theft
Block unauthorized network connections that could be used for command-and-control communications or data exfiltration.
Network Exploitation
Stop attempts to escalate privileges using kernel capabilities, preventing attackers from gaining administrative access.
Privilege Escalation
Block attempts to load malicious kernel modules or eBPF programs that could compromise the entire system.
Kernel Exploitation
Detect interactive shells backed by network sockets, along with raw packet capture and promiscuous sniffing.
Reverse Shells
Stop attackers from installing backdoors in startup files, scheduled tasks, and service definitions to survive across builds and reboots.
Malicious Persistence
Prevent attempts to read, modify, or execute unauthorized files, blocking code injection and data exfiltration attacks.
File Access
Prevent memory patching and fileless execution techniques used by advanced persistent threats and rootkits.
Memory Attacks
Prevent unauthorized container execution and socket access that could compromise containerized pipeline environments.
Container Breakouts
Prevent attackers from hijacking trusted processes through library preloading, debugger attachment, and runtime tampering.
Process Injection
Block unauthorized reads of secrets, tokens, and SSH keys, preventing pipeline credentials from being stolen.
Credential Theft
Block unauthorized network connections that could be used for command-and-control communications or data exfiltration.
Network Exploitation
Stop attempts to escalate privileges using kernel capabilities, preventing attackers from gaining administrative access.
Privilege Escalation
Block attempts to load malicious kernel modules or eBPF programs that could compromise the entire system.
Kernel Exploitation
Detect interactive shells backed by network sockets, along with raw packet capture and promiscuous sniffing.
Reverse Shells
Stop attackers from installing backdoors in startup files, scheduled tasks, and service definitions to survive across builds and reboots.
Malicious Persistence
Prevent attempts to read, modify, or execute unauthorized files, blocking code injection and data exfiltration attacks.
File Access
Prevent memory patching and fileless execution techniques used by advanced persistent threats and rootkits.
Memory Attacks
Prevent unauthorized container execution and socket access that could compromise containerized pipeline environments.
Container Breakouts
Prevent attackers from hijacking trusted processes through library preloading, debugger attachment, and runtime tampering.
Process Injection
Block unauthorized reads of secrets, tokens, and SSH keys, preventing pipeline credentials from being stolen.
Credential Theft
Block unauthorized network connections that could be used for command-and-control communications or data exfiltration.
Network Exploitation
Stop attempts to escalate privileges using kernel capabilities, preventing attackers from gaining administrative access.
Privilege Escalation
Block attempts to load malicious kernel modules or eBPF programs that could compromise the entire system.
Kernel Exploitation
Detect interactive shells backed by network sockets, along with raw packet capture and promiscuous sniffing.
Reverse Shells
Stop attackers from installing backdoors in startup files, scheduled tasks, and service definitions to survive across builds and reboots.
Malicious Persistence
Block unauthorized network connections that could be used for command-and-control communications or data exfiltration.
Network Exploitation
Stop attempts to escalate privileges using kernel capabilities, preventing attackers from gaining administrative access.
Privilege Escalation
Block attempts to load malicious kernel modules or eBPF programs that could compromise the entire system.
Kernel Exploitation
Detect interactive shells backed by network sockets, along with raw packet capture and promiscuous sniffing.
Reverse Shells
Stop attackers from installing backdoors in startup files, scheduled tasks, and service definitions to survive across builds and reboots.
Malicious Persistence
Prevent attempts to read, modify, or execute unauthorized files, blocking code injection and data exfiltration attacks.
File Access
Prevent memory patching and fileless execution techniques used by advanced persistent threats and rootkits.
Memory Attacks
Prevent unauthorized container execution and socket access that could compromise containerized pipeline environments.
Container Breakouts
Prevent attackers from hijacking trusted processes through library preloading, debugger attachment, and runtime tampering.
Process Injection
Block unauthorized reads of secrets, tokens, and SSH keys, preventing pipeline credentials from being stolen.
Credential Theft
Block unauthorized network connections that could be used for command-and-control communications or data exfiltration.
Network Exploitation
Stop attempts to escalate privileges using kernel capabilities, preventing attackers from gaining administrative access.
Privilege Escalation
Block attempts to load malicious kernel modules or eBPF programs that could compromise the entire system.
Kernel Exploitation
Detect interactive shells backed by network sockets, along with raw packet capture and promiscuous sniffing.
Reverse Shells
Stop attackers from installing backdoors in startup files, scheduled tasks, and service definitions to survive across builds and reboots.
Malicious Persistence
Prevent attempts to read, modify, or execute unauthorized files, blocking code injection and data exfiltration attacks.
File Access
Prevent memory patching and fileless execution techniques used by advanced persistent threats and rootkits.
Memory Attacks
Prevent unauthorized container execution and socket access that could compromise containerized pipeline environments.
Container Breakouts
Prevent attackers from hijacking trusted processes through library preloading, debugger attachment, and runtime tampering.
Process Injection
Block unauthorized reads of secrets, tokens, and SSH keys, preventing pipeline credentials from being stolen.
Credential Theft
Block unauthorized network connections that could be used for command-and-control communications or data exfiltration.
Network Exploitation
Stop attempts to escalate privileges using kernel capabilities, preventing attackers from gaining administrative access.
Privilege Escalation
Block attempts to load malicious kernel modules or eBPF programs that could compromise the entire system.
Kernel Exploitation
Detect interactive shells backed by network sockets, along with raw packet capture and promiscuous sniffing.
Reverse Shells
Stop attackers from installing backdoors in startup files, scheduled tasks, and service definitions to survive across builds and reboots.
Malicious Persistence
Prevent attempts to read, modify, or execute unauthorized files, blocking code injection and data exfiltration attacks.
File Access
Prevent memory patching and fileless execution techniques used by advanced persistent threats and rootkits.
Memory Attacks
Prevent unauthorized container execution and socket access that could compromise containerized pipeline environments.
Container Breakouts
Prevent attackers from hijacking trusted processes through library preloading, debugger attachment, and runtime tampering.
Process Injection
Block unauthorized reads of secrets, tokens, and SSH keys, preventing pipeline credentials from being stolen.
Credential Theft
One rate per protected pipeline, per year. No platform fee, no onboarding fee, and unlimited discovery on every plan.
For validating on a focused set of critical pipelines before expanding deployment.
$500
/Pipeline/Year
Up to 25 protected pipelines
Full runtime enforcement
Automated policy generation
Unlimited pipeline discovery
For growing teams ready to protect production pipelines across their CI/CD environment.
$500
/Pipeline/Year
Up to 300 protected pipelines
Everything in Pilot
Notification integrations
Multi-provider CI/CD coverage
For security teams standardizing runtime policy across a growing pipeline estate.
Volume
Pricing
Up to 2,500 protected pipelines
Everything in Startup
Graduated volume pricing
Analytics and reporting
For organizations standardizing across environments and operating models.
Custom
Pricing
Enterprise-scale coverage
Everything in Business
Managed or Self-Hosted
Multi-business-unit deployments
For validating on a focused set of critical pipelines before expanding deployment.
$500
/Pipeline/Year
Up to 25 protected pipelines
Full runtime enforcement
Automated policy generation
Unlimited pipeline discovery
For growing teams ready to protect production pipelines across their CI/CD environment.
$500
/Pipeline/Year
Up to 300 protected pipelines
Everything in Pilot
Notification integrations
Multi-provider CI/CD coverage
For organizations standardizing across environments and operating models.
Custom
Pricing
Enterprise-scale coverage
Everything in Business
Managed or Self-Hosted
Multi-business-unit deployments
Deploy the sensor on one pipeline and see every file, connection, and process your build touches.
Enforce what your pipeline is allowed to do at the kernel level, blocking unauthorized network connections, file access, and process execution as they happen. Reach out and let us show you what that looks like on a real build.
