Mend

We have chosen to give a 4-star rating to Mend as it has become a foundational component of our AppSec Governance program. The platform is highly effective at "shifting left," allowing our multifarious teams to identify and remediate vulnerabilities in both open-source dependencies (SCA) and custom code (SAST) within the development lifecycle. We particularly value the reachability analysis, which helps us prioritize exploitable vulnerabilities and reduce developer fatigue. The primary reason for a 4-star rather than a 5-star rating is that we have encountered some scalability challenges owing to the sheer volume of projects and the complex nature of the environment of a global enterprise that grows through M&A. At our scale, we found that certain UI and reporting features required additional tuning to maintain performance. However, it is important to note that in every instance where we have faced such hurdles, the Mend team has been exceptionally quick to respond and remediate the issues. Their technical support and engineering teams have acted as true partners, working closely with us to optimize the platform for our specific needs. While we must emphasize that our use case is niche, the quality of their partnership and the effectiveness of their core security engine make them a top-tier choice for any serious AppSec initiative. We are confident that had we been completing this in 12-24 months time, 5-stars would be given.