Mend.io AppSec Platform

The major client use case for Mend.io is for SCA, Software Composition Analysis, and their capabilities in terms of the repositories are very nice. Real-time updation in the repositories is a good feature, and recently they have added some AI-related things as well, so that is making customers happy.

Mend.io does help with strategic decisions and with resource allocation.

Their licensing model is simple, and one more advantage is that their implementation cycle is very less compared to other tools, making their implementation smooth.

Mend.io helps with the security part because it can be directly integrated with CI/CD, ensuring integration is very well and taking care of the entire security aspects.

Dependency analysis is important for the development process because it can be directly integrated with your development IDEs, making it definitely useful for the developers.

Mend.io helps to maintain a secure code base over time as the repositories are updated time to time, ensuring continuous scanning happens on the back end. Whenever new vulnerabilities or new things are coming in the market, within a few hours, it is updated in the main repository, helping end users stay updated.

Many of the leaders in the market are having static analysis plus SCA together. Mend.io has also started static analysis plus SCA together, but their static analysis is not much stable currently. Customers generally prefer both things together from the same company, which is static analysis plus Software Composition Analysis.

The problem is that the vulnerability analysis is not at that par compared to other solutions, because static analysis depends on how many critical vulnerabilities you are finding in your source code, and if we compare with other tools, it is not finding that much.

From the last four years, I started selling Mend.io.

It is easy to scale. From a broader perspective where users are in hundreds and thousands, Mend.io works very well.

It is good, but there is always room for improvement. For support only, I would give it eight points.

The first thing is that Mend.io's pricing model is simple, as it is a user-based pricing approach. The second thing is that the implementation process is smooth and not bulky. I have seen other products that take months to get stabilized, but Mend.io can be stabilized within days. These two things are probably the main considerations, and from a technical point of view, their capability in terms of repositories is very well.

In the majority, clients deploy Mend.io in a hybrid environment.

Clients are working with native Mend cloud or with some cloud providers like AWS, GCP, and all that. Mend also has their own cloud.

The ROI in terms of Mend.io can start from the minimum user size, as many tools do not have a minimum. For example, if any company has ten to fifteen users, they typically do not provide those licenses, but Mend is flexible enough in that term to start with ten to fifteen licenses, and this can go up to thousands of licenses. Additionally, enterprise-level licensing is also available, which gives a significant ROI because the entire organization is using the tool.

Black Duck is the main competitor of Mend.io. Apart from that, Checkmarx is one competition, and SonarQube has also started including SCA. Besides that, HCL AppScan is also there, who has started SCA.

For Mend.io SCA, I will definitely give eight point five as the final rating it deserves.

Hybrid Cloud

Amazon Web Services (AWS)

What do you like best about the product?

Mend.io is easy to use, helps me find security issues quickly, and makes it simpler to fix vulnerabilities. My favorite features are the automated fixes and the clear, easy-to-understand reports..

What do you dislike about the product?

The main things I dislike about Mend.io are that it can sometimes generate too many alerts, it takes time to learn, and some of the more advanced features can be expensive.

What problems is the product solving and how is that benefiting you?

Mend.io helps identify security vulnerabilities and outdated software dependencies before they become bigger problems. It saves me time by prioritizing issues and making it easier to fix them quickly.

What do you like best about the product?

What stands out most about Mend.io is how seamlessly it integrates into the development pipeline without disrupting existing workflows. The fast feedback loop enables developers to respond rapidly to any vulnerability or license issues ,catching problems early rather than at the end of the release cycle. The open-source dependency management with CVE detection, detailed vulnerability and license reports, and fix suggestions make it genuinely useful day-to-day, not just a compliance checkbox. The automated remediation saves hours of manual triage.

What do you dislike about the product?

The initial setup and configuration can be overwhelming, especially for teams new to SCA tooling. The sheer volume of vulnerability alerts early on can lead to alert fatigue ,without proper policy tuning, developers tend to ignore notifications rather than act on them. The dashboard, while feature-rich, has a steep learning curve and could benefit from a more intuitive onboarding experience. Pricing is also a concern, as SaaS and on-prem software costs continue to rise, the per-developer pricing model can become expensive at scale , making it harder to justify for smaller teams or budget-conscious organizations.

What problems is the product solving and how is that benefiting you?

One of the core problems Mend.io solves is the lack of visibility into open-source dependencies and the security risks they introduce. Before using a tool like Mend.io, identifying vulnerable libraries across multiple applications was a largely manual, time-consuming process. Mend.io identifies, prioritises, and remediates security and license risks in open-source components automatically which means our team spends less time hunting for vulnerabilities and more time building. The CI/CD integration ensures that security checks happen continuously rather than as a last-minute gate before release, shifting security left in the development lifecycle. This has directly reduced the time it takes to detect and respond to newly disclosed CVEs, which previously could go unnoticed for weeks.

What do you like best about the product?

I like Mend.io mainly because it can scan for vulnerabilities. I used it mostly as a test case: I created a test project, ran a vulnerability scan, and then used the dashboard, which listed everything across multiple repositories. That view makes it easier to prioritize what to fix first.

I also like the support it gives developers by providing visibility into threats when it comes to open source. Onboarding and integrating it with third-party applications is also quite easy. In one of my test cases, when I was working as a developer, it initially took me a lot of time to identify vulnerabilities, but after using Mend.io it became less time-consuming.

Also, when it comes to compliance, it helps there too by license compliance and prevents manual work.

What do you dislike about the product?

Let’s first talk about the UI. The initial setup for the policy takes some time, and it would be easier with an onboarding guide to improve the user experience.

On performance, the dashboard has a lot of information, which may feel overwhelming for an engineer.

The pricing also seemed a bit high to me, and it may be challenging for a smaller startup.

When it comes to reporting, it could be customized further to be more useful.

What problems is the product solving and how is that benefiting you?

Now the world is changing for the better with AI. With Mend.io, I think the process becomes more efficient and reduces manual work. As I mentioned, I created a test environment and it was able to identify vulnerabilities that might otherwise take a lot of time to find.

In a production scenario, when it comes to vulnerabilities, it can take a long time to detect them and then mitigate them. With Mend.io, there is a comprehensive report that is useful for maintaining compliance as well, and it reduces a lot of manual work while being less time-consuming overall.

This is helping improve the security posture of the organisation.

What do you like best about the product?

Easy setup: It integrates quickly with GitHub and fits smoothly into CI/CD workflows. Effective scanning: It rapidly tracks open-source dependencies and helps with license compliance. Helpful automation: The Renovate feature supports automated dependency updates. Good support: Customer service is often described as fast and helpful.

What do you dislike about the product?

Interface: Parts of the UI clunky or a bit outdated. False Positives: It can generate noise, which then requires extra manual triage. Pricing: It’s sometimes considered a little high for smaller teams or mid-market buyers. Integrations: Third-party tool connections, like Jira, can occasionally bug out.

What problems is the product solving and how is that benefiting you?

Used to resolve issues with SCA