We have chosen to give a 4-star rating to Mend as it has become a foundational component of our AppSec Governance program. The platform is highly effective at "shifting left," allowing our multifarious teams to identify and remediate vulnerabilities in both open-source dependencies (SCA) and custom code (SAST) within the development lifecycle. We particularly value the reachability analysis, which helps us prioritize exploitable vulnerabilities and reduce developer fatigue. The primary reason for a 4-star rather than a 5-star rating is that we have encountered some scalability challenges owing to the sheer volume of projects and the complex nature of the environment of a global enterprise that grows through M&A. At our scale, we found that certain UI and reporting features required additional tuning to maintain performance. However, it is important to note that in every instance where we have faced such hurdles, the Mend team has been exceptionally quick to respond and remediate the issues. Their technical support and engineering teams have acted as true partners, working closely with us to optimize the platform for our specific needs. While we must emphasize that our use case is niche, the quality of their partnership and the effectiveness of their core security engine make them a top-tier choice for any serious AppSec initiative. We are confident that had we been completing this in 12-24 months time, 5-stars would be given.

The product is good - it generates no more false positives than other SCA tools, and is (relatively easy to work with). Our native integration with Azure DevOps is straightforward to manage. However, there are oversights including inability to exclude entire projects - only being able to exclude on a per-repo basis, lack of visibility of current scan queues and unhelpful logfiles which mean I regularly have to ask my developers (2500+) to raise support tickets as I don't have the empirical knowledge of each technology in use in our estate to troubleshoot effectively - the logs don't help in this regard.