Problem

Xeol addressed the end-of-life and outdated-software attack vector in enterprise software supply chains. Unsupported operating systems, databases, frameworks, and open-source dependencies become a “black box” of vulnerabilities when maintainers stop providing security patches, while the decentralized nature of open-source ecosystems makes those risks difficult to discover. The pain is simultaneously security, compliance, and economic: unmanaged EOL software can increase breach exposure, complicate vulnerability management, and affect cyber-insurance and regulatory posture.

The main use case was giving an enterprise a fleet-wide view of where unsupported software existed and which instances mattered most. In its first reported Fortune 500 deployment, Xeol identified more than 2,000 EOL components and reduced the customer’s exposure by 60%, illustrating the value of finding hidden dependencies that conventional vulnerability programs may miss.

Product / Service

Xeol combined an agentless scanner with a contextual graph of the software supply chain. It scanned artifacts at build and runtime, connected repositories, packages, containers, and deployed software, and let AppSec teams answer questions such as where a package was used, which components were EOL, and whether artifacts had appropriate attestations. Teams could then enforce policies, such as blocking EOL software from container images or requiring approved build provenance and software-quality scores.

Its core EOL scanner was open source and free under the Apache 2.0 license, while the commercial dashboard added coverage for open-source EOL data, prioritization, remediation guidance, policy enforcement, and CISO reporting for a custom fee. Remediation options included upgrading, replacing an unsupported component, or applying compensating controls. Following Xeol’s acquisition, HeroDevs combined this detection capability with its paid “never-ending support” for deprecated open-source software, creating a detect-and-remediate workflow.

Market

Xeol operated in software supply-chain security and application-security infrastructure, with a narrower focus on EOL and unsupported-software intelligence. Its offering was adjacent to software-composition-analysis, SBOM, container-security, and supply-chain-policy platforms rather than identical to them: HeroDevs describes EOL detection as a complementary layer to SCA. The adjacent competitive set includes broader tools and platforms such as Mend, Snyk, Anchore, Veracode, and Black Duck, although the available research does not establish that each was a direct Xeol replacement.

Xeol raised $3.2 million in a December 2023 seed round led by Shield Capital, with Y Combinator and 468 Capital participating, and had already signed a Fortune 500 customer shortly after launch. It was acquired by HeroDevs in February 2025; HeroDevs said Xeol’s database tracked EOL data for more than 100,000 open-source packages and made the data publicly available to developers. Revenue figures are not disclosed in the available materials, so the company is better characterized as an acquired, commercially validated startup than as an independently operating pre-revenue company.