Mend.io Reviews, Ratings & Features 2026 | Gartner Peer Insights

Gartner defines the application security testing (AST) market as consisting of providers of products that enable organizations to assess applications for the presence and management of risk. These products identify risk by evaluating source code, performing runtime tests and inspecting supply chain components. AST products can be integrated throughout development workflows for continuous assessment or be used to perform ad hoc evaluations. They enable organizations to manage application risks by providing an integrated set of capabilities for risk identification, prioritization and triage, policy evaluation and enforcement, and remediation assistance. Market offerings are available in on-premises, SaaS and hybrid delivery models. Organizations leverage AST products to assess applications for the presence of security vulnerabilities and other risks (e.g., legal and operational) throughout their life cycle. These assessments are used to measure and manage the risks within individual applications, application components or groups of applications in the context of their business criticality and other key attributes (e.g., environment, sensitive data handling, etc.). AST products further enable organizations to evaluate software for compliance with internal policies as well as regulatory requirements established by governments or authoritative industry groups.

Active

Find the top Application Security Testing Tools with Gartner. Compare and filter by verified product reviews and choose the software that’s right for your organization.

Application Security Testing

Mend

Mend.io

APPSEC PROGRAMME MANAGER

The product is good - it generates no more false positives than other SCA tools, and is (relatively easy to work with). Our native integration with Azure DevOps is straightforward to manage. However, there are oversights including inability to exclude entire projects - only being able to exclude on a per-repo basis, lack of visibility of current scan queues and unhelpful logfiles which mean I regularly have to ask my developers (2500+) to raise support tickets as I don't have the empirical knowledge of each technology in use in our estate to troubleshoot effectively - the logs don't help in this regard.

50M - 250M USD

1B - 3B USD

500M - 1B USD

3B - 10B USD

10B - 30B USD

30B + USD

250M - 500M USD

<50M USD

Gov't/PS/ED <5,000 Employees

IT Security & Risk Management Associate

We have chosen to give a 4-star rating to Mend as it has become a foundational component of our AppSec Governance program. The platform is highly effective at "shifting left," allowing our multifarious teams to identify and remediate vulnerabilities in both open-source dependencies (SCA) and custom code (SAST) within the development lifecycle. We particularly value the reachability analysis, which helps us prioritize exploitable vulnerabilities and reduce developer fatigue.

The primary reason for a 4-star rather than a 5-star rating is that we have encountered some scalability challenges owing to the sheer volume of projects and the complex nature of the environment of a global enterprise that grows through M&A. At our scale, we found that certain UI and reporting features required additional tuning to maintain performance.

However, it is important to note that in every instance where we have faced such hurdles, the Mend team has been exceptionally quick to respond and remediate the issues. Their technical support and engineering teams have acted as true partners, working closely with us to optimize the platform for our specific needs. While we must emphasize that our use case is niche, the quality of their partnership and the effectiveness of their core security engine make them a top-tier choice for any serious AppSec initiative. We are confident that had we been completing this in 12-24 months time, 5-stars would be given.

Snyk

Checkmarx

Black Duck

Veracode

Sonatype

SonarSource

GitHub

Other...

JFrog

GitLab

Tenable

Invicti

Contrast Security

Rapid7

CAST

Semgrep

Qualys

AdaCore

OpenText (Micro Focus)

Data Theorem

Datadog (Hdiv Security)

CloudDefense

DeepSource

OpenText

Symantec (Appthority)

ImmuniWeb

Appknox

Fluid Attacks

Apiiro

Mend.io, previously known as WhiteSource, focusses on building high-grade Application Security (AppSec) programs which aim to mitigate risk while accelerating development. Leveraging cutting-edge automated technology, the company offers protection against threats associated with supply chains, malicious package attacks, and vulnerabilities found in both open source and custom code. Additionally, Mend.io addresses potential risks linked to open-source licenses. The firm is recognized for its record of satisfying complex, large-scale application security demands and is therefore chosen by numerous demanding development and security teams across the globe. Additionally, Mend.io administrates the automated dependency update project, Renovate.

Mend.io, formerly known as WhiteSource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -‚Äì using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks. With a proven track record of successfully meeting complex and large-scale application security needs, Mend.io is the go-to technology for the world‚Äôs most demanding development and security teams. The company has more than 1,000 customers, including 25 percent of the Fortune 100, and manages Renovate, the open source automated dependency update project. For more information visit Mend.io.

Mend.io, formerly known as WhiteSource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks. With a proven track record of successfully meeting complex and large-scale application security needs, Mend.io is the go-to technology for the world’s most demanding development and security teams. The company has more than 1,000 customers, including 25 percent of the Fortune 100, and manages Renovate, the open source automated dependency update project. For more information visit Mend.io.

Reviews

Ratings Overview

Overall experience with

Favorable Review

A Strong Partner in Application Security

Critical Review

Capable SCA platform, somewhat hampered by poor load visibility and inflexible migration path to later version

Likes and dislikes about

likes

dislikes