Varun Badhwar and the trouble with 68,000 answers

A security scanner had given Varun Badhwar 68,000 answers. He needed a useful question. Around 450 engineers were working in the organization he led at Palo Alto Networks, and the tool had produced a vast inventory of vulnerabilities. Which ones deserved their attention first? In his account, nobody had a satisfactory way to decide. The number looked precise. The work it implied was anything but.

Badhwar had already helped build companies devoted to making unfamiliar technology safer. He knew the reassuring language of security products, the demonstrations, the promises of visibility. Now the difficulty sat inside his own business. SolarWinds and Codecov had brought software supply chain attacks uncomfortably close. He began asking engineering teams and industry friends how they knew the software they shipped could be trusted.

The conversations kept returning to overloaded teams and tools their developers had stopped believing. A warning that never results in action has an awkward claim to usefulness. For Badhwar, the distance between discovering a problem and getting it fixed became a reason to leave a substantial job and start again. Endor Labs, founded in 2021, would be his third company.

An education on the customer’s side of the desk

His route into that position began with a computer science degree at the University of Southern California. Badhwar describes his early career with a disarming lack of reverence for his own programming ability. He found himself drawn to the business side of technology and then to cybersecurity consulting. One client, Salesforce, eventually hired him. The customer became the workplace.

At Salesforce, he worked on security for the Force.com ecosystem. His responsibilities included a platform populated by more than 1,500 partner applications. That put him close to an emerging practical problem: other businesses wanted the convenience of cloud software while retaining confidence in what happened to their data. Security had to accommodate a new way of buying and using technology.

He spent roughly four years there, watching Salesforce grow. The experience gave him an inside view of cloud adoption while many enterprises were still deciding how much to trust it. His subsequent companies would follow those changes in trust. First came applications delivered as services. Then came infrastructure rented from cloud providers. Later, the components inside software itself demanded a closer look.

Before the budget had a name

Badhwar co-founded CipherCloud in 2010, working on product strategy and field engineering. The company addressed enterprises’ concerns about adopting cloud applications. In 2015, he co-founded RedLock with Gaurav Kumar, turning to the security of cloud infrastructure. Each venture required potential customers to think about risks that did not yet fit comfortably into their purchasing habits.

Selling RedLock involved education as much as persuasion. Badhwar has described asking customers for access to their cloud environments so his team could show them actual problems. The demonstration made an abstract concern local and immediate. It also created another task: helping the prospective buyer explain an unplanned expense to a finance executive. A convincing technical result still needed a business case.

There is something revealing about his preferred sales lesson. He wants the pitch, demonstration and discussion to fit the buyer’s available time. In his telling, a half-hour meeting should leave at least ten minutes for questions. The constraint forces choices. A company may have a long list of features; the person across the table has another meeting.

“People don’t want to hear the 10 things you do”

Varun Badhwar · on explaining a company

The exit came with more work

In October 2018, Palo Alto Networks announced an agreement to acquire RedLock for approximately $173 million in cash. Badhwar and Kumar would join the buyer. The announced plan brought RedLock’s technology together with Evident.io’s capabilities, combining cloud security analytics and compliance work. An acquisition headline compressed several engineering and organizational problems into one tidy number.

Badhwar stayed for three years, helping build Prisma Cloud as a senior vice president and general manager. His experience crossed an unusual boundary: he had sold a young company and then helped turn its technology into part of a much larger business. At that scale, the founder’s concerns acquired new company. Integration, people and a broader product portfolio all needed attention.

His advice to other founders reflects that experience. Build a company intended to endure, he argues; acquisition timing lies partly outside a founder’s control. He also emphasizes choosing the individual investor with whom one can sustain a working relationship. The logo on a term sheet cannot attend a difficult conversation on somebody else’s behalf.

A company built around the next question

At Endor Labs, Badhwar joined forces with Dimitri Stiliadis, another founder whose previous business had been acquired by Palo Alto Networks. Both had seen software supply chain problems from inside a large security organization. Endor emerged publicly in October 2022 with $25 million in seed financing. Its starting point was the sprawl of open source dependencies.

A developer may deliberately choose one software package and inherit many more packages on which it depends. An inventory can establish that a component is present. Understanding whether an application can actually call a vulnerable part of it requires more context. Endor’s early proposition centered on that distinction: examine how the code connects, then help teams decide which problems warrant action.

Badhwar put the underlying change plainly in an interview: “we don’t write software, we assemble software.” The observation makes the supply chain less abstract. A modern application carries decisions made by people its own developers may never meet. Reuse makes development practical. It also makes the question of what has been reused, and how, a permanent part of the job.

Fifteen engineers, deliberately unfamiliar

The founding team could have filled the first engineering seats by calling former colleagues. Badhwar and Stiliadis chose a restriction instead. Among the first fifteen engineers, no more than two would come from the same company. Badhwar said establishing that initial team took about six months, longer than simply gathering people who had already worked for them.

They wanted different experiences of building and releasing software inside the room. A tool intended for engineers would be shaped by engineers, and a group drawn from one familiar workplace might quietly treat its own habits as universal. Recruiting across organizations made that assumption harder to sustain. The hiring rule gave a practical form to a broad ambition: understand more than one version of the customer.

A photograph from Endor’s first offsite in spring 2022 shows a smaller company enjoying a moment together outdoors. Several people point skyward. Badhwar later described the gathering as a time for charting the company’s direction. The picture supplies a useful companion to the hiring story: before the product became a platform, people had to learn how to work with one another.

Three trips to the same proving ground

CipherCloud, RedLock and Endor Labs each reached the finals of the RSA Conference Innovation Sandbox, in 2011, 2017 and 2023 respectively. The repetition is a concrete thread through Badhwar’s career. Different technologies and different teams returned him to a setting where an enterprise security idea had to become a comprehensible proposition in front of judges.

Endor did not win the 2023 competition. HiddenLayer did. Badhwar’s account of building companies nevertheless keeps returning to the same commercial test: can the customer recognize a problem that exists today? He has argued that customers need to grasp the one problem a company solves well. For a founder working amid technical complexity, narrowing the explanation becomes part of the work.

His ambitions for Endor extend beyond another acquisition. He has spoken about eventually taking it public. That remains an aspiration, with the ordinary uncertainty of any private company’s future. It also gives the third venture a different horizon. Having experienced an exit and the work that followed it, he is talking about building an organization for a longer independent life.

AI arrives with more code to read

Endor announced a $93 million Series B in April 2025, led by DFJ Growth with participation from Salesforce Ventures. In his announcement, Badhwar described the company’s investment in vulnerability data and maps of how open source functions connect. He presented that accumulated context as a foundation for securing software increasingly produced with AI assistance.

The shift expanded his original concern. If software arrives faster, the capacity to review it becomes more consequential. In an August 2025 essay, he focused on code review as a constraint on the promised productivity of AI coding tools. Producing a change is only one stage of delivering it. Somebody, or some reliable process, still has to understand what the change does.

His public work has also included a discussion of Opengrep, the open source static analysis project Endor helped launch with other security companies. In June 2026, he announced Endor Zero-Day Patches and participation as a founding member of the Linux Foundation’s Project Akrites. Across these efforts, his attention keeps moving toward the practical work after discovery: assessment, review and repair.

The other calendar

There is another version of prioritization in Badhwar’s life. He began Endor when his twin sons were very young. In a public reflection on his plans for 2026, he described wanting to be home for bedtime, handle school drop-off when possible and keep Saturdays free of distraction. His family, he wrote, deserved deliberate attention. A founder’s calendar can fill without ever asking permission.

That personal commitment sits comfortably beside the problem that started Endor. Both involve deciding what deserves limited time. The comparison has limits: a household cannot be run like a vulnerability queue, and small children are unlikely to respect a severity score. But his willingness to name ordinary commitments gives the business story a human scale. Another funding announcement can wait for its paragraph; bedtime has an hour.

Badhwar’s career has followed successive changes in how software reaches people: cloud applications, cloud infrastructure, borrowed components and AI-generated code. His recurring interest is the moment adoption outruns understanding. The 68,000 findings remain a useful starting point because they expose the job that a large number can disguise. Once a system has told you everything it can see, someone still has to decide what to do on Monday morning.