No more typing reviews! Try our Samantha, our new voice AI agent.

Mend.io pros and cons

Vendor: Mend.io

4.2 out of 5

36 reviews
97% willing to recommend

Leave a review Why PeerSpot?

Pros & Cons summary

Mend.io significantly reduces mean time to resolve software vulnerabilities with extensive reports, supporting CI/CD pipelines and Azure DevOps for efficient development. Quick scanning aids in identifying security issues while offering fix suggestions and thorough licensing analysis. Despite comprehensive coverage for open-source dependencies, setup and policy configuration are complex, and reporting lacks flexibility. Limited language support and a high pricing model are notable constraints.

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.

Prominent pros & cons

PROS

Mend.io significantly reduces the mean time to resolve software vulnerabilities and provides extensive reports involving vulnerabilities, helping businesses manage open-source software effectively.

The platform offers seamless integration, notably supporting CI/CD pipelines and Azure DevOps, ensuring a secure and efficient development process.

Its ease of setup and fast scanning capabilities offer convenience to users, allowing for quick identification of security vulnerabilities and license management within minutes.

Mend.io is recognized for providing in-depth security feedback, with valuable features like fix suggestions that help teams quickly identify and resolve vulnerabilities in their code.

It offers comprehensive coverage for scanning and managing third-party dependencies, minimizing exposure to open-source vulnerabilities with thorough licensing analysis and reporting capabilities.

CONS

Initial setup could be simplified and lacks preconfigured policies for quick setup.

Policy configuration is tedious and lacks customization for specific frameworks like CIS and NIST.

Custom reports cannot be created easily according to client scenarios, limiting reporting flexibility.

Mend.io lacks support for multiple package managers and specific languages beyond Java and JavaScript.

Pricing model needs adjustment as costs can be high for SaaS or on-premis implementations.

Mend.io Pros review quotes

CEO at a computer software company with 10,001+ employees

Dec 17, 2025

Once we onboarded to Mend.io, we saw a drastic improvement in the way Mend.io reported the SCA findings.

Read full review

reviewer2196063

Project Associate at a tech vendor with 10,001+ employees

Jul 27, 2026

In my opinion, it is the best because with respect to the scan coverage, it is giving basically all the components we are looking for and all the requirements we require, and compared to other tools, especially in terms of identifying and integrating into our DevSecOps and CI/CD, Mend.io is compatible, with good integration coverage across all the technologies it supports and a relatively low noise ratio with accurate issues and useful customization options.

Read full review

SM

Product Security Architect at a computer software company with 10,001+ employees

Jun 11, 2026

The home dashboard itself gives a very good analysis for Mend.io; this is not just for SCA, it is for SAST and container as well, and it gives entire analytics of how many vulnerabilities were found, how much was updated, and how much was fixed over the last three, six, and nine months.

Read full review

Free Report: Mend.io Reviews and More

Learn what your peers think about Mend.io. Get advice and tips from experienced pros sharing their opinions. Updated: October 2026.

920,769 professionals have used our research since 2012.

Senior Business Manager at Meteonic Innovation Pvt. Ltd.

Oct 26, 2026

Mend.io helps to maintain a secure code base over time as the repositories are updated time to time, ensuring continuous scanning happens on the back end.

Read full review

CEO at a computer software company with 10,001+ employees

Nov 28, 2024

Mend.io is very robust in terms of managing third-party dependencies.

Read full review

reviewer1252050

VP at a tech vendor with 5,001-10,000 employees

Oct 27, 2025

The features I find most valuable in Mend.io are the ease of use; it is very easy to access and integrate.

Read full review

SR

SrikanthRaghavan

Principal Architect at a consultancy with 11-50 employees

May 19, 2025

Mend.io is a security tool that provides security feedback for all tests.

Read full review

reviewer2165991

Release Manager at a tech vendor with 501-1,000 employees

Apr 23, 2023

What is very nice is that the product is very easy to set up. When you want to implement Mend.io, it just takes a few minutes to create your organization, create your products, and scan them. It's really convenient to have Mend scanning your products in less than one hour.

Read full review

KW

Principal Security Engineer at Texthelp Ltd.

Jan 10, 2023

There are multiple different integrations there. We use Mend for CI/CD that goes through Azure as well. It works seamlessly. We never have any issues with it.

Read full review

SM

Product Security Architect at a computer software company with 10,001+ employees

Sep 26, 2023

The best feature is that the Mend R&D team does their due diligence for all the vulnerabilities. In case they observe any important or critical vulnerabilities, such as the Log4j-related vulnerability, we usually get a dedicated email from our R&D team saying that this particular vulnerability has been exploited in the world, and we should definitely check our project for this and take corrective actions.

Read full review

Show 10 more reviews (out of 35)

Mend.io Cons review quotes

CEO at a computer software company with 10,001+ employees

Dec 17, 2025

We wanted to have certain reports based on our kind of scenario, but the tool did not allow us to create custom reports.

Read full review

reviewer2196063

Project Associate at a tech vendor with 10,001+ employees

Jul 27, 2026

With respect to improvements with Mend.io, as I mentioned, today it is not supporting the threat intelligence.

Read full review

SM

Product Security Architect at a computer software company with 10,001+ employees

Jun 11, 2026

For monitoring capabilities in Mend.io, I did not understand the maintenance part.

Read full review

Free Report: Mend.io Reviews and More

Learn what your peers think about Mend.io. Get advice and tips from experienced pros sharing their opinions. Updated: October 2026.

920,769 professionals have used our research since 2012.

Senior Business Manager at Meteonic Innovation Pvt. Ltd.

Oct 26, 2026

The problem is that the vulnerability analysis is not at that par compared to other solutions, because static analysis depends on how many critical vulnerabilities you are finding in your source code, and if we compare with other tools, it is not finding that much.

Read full review

CEO at a computer software company with 10,001+ employees

Nov 28, 2024

AI integration in code security tools like Mend.io is still in its early stages and relatively immature.

Read full review

reviewer1252050

VP at a tech vendor with 5,001-10,000 employees

Oct 27, 2025

The tools need to bring down the pricing because software in SaaS or on-prem is becoming a more expensive affair.

Read full review

SR

SrikanthRaghavan

Principal Architect at a consultancy with 11-50 employees

May 19, 2025

The main consideration is the cost. The products always have their maturity.

Read full review

reviewer2165991

Release Manager at a tech vendor with 501-1,000 employees

Apr 23, 2023

On the reporting side, they could make some improvements. They are making the reports better and better, but sometimes it takes a lot of time to generate a report for our entire organization.

Read full review

KW

Principal Security Engineer at Texthelp Ltd.

Jan 10, 2023

Mend lets you create custom policies. They're not too complicated to set up, but it would be helpful if they had some preconfigured policies to match what we have in Azure DevOps. That would save us a lot of time. It's tedious to configure the policies manually, and I lack the capacity to do it right now. Other products have preconfigured packs and templates, and Mend doesn't.

Read full review

SM

Product Security Architect at a computer software company with 10,001+ employees

Sep 26, 2023

I would like to have an additional compliance pack. Currently, it does not have anything for the CIS framework or the NIST framework. If we directly run a scan, and it is under the CIS framework, we can directly tell the auditor that this product is now CIS compliant.

Read full review

Show 10 more reviews (out of 35)

Related questions

59

How does Camunda Platform compare with Apache Airflow?

78

How does WhiteSource compare with SonarQube?

113

How does WhiteSource compare with Black Duck?

188

What tools do you rely on for building a DevSecOps pipeline?

165

What alternatives are there for Fortify WebInspect and Fortify SCA?

107

What is the best way to track open-source license compatibility?

189

How long does SCA scanning take?

372

Why is Software Composition Analysis (SCA) important for companies?

168

Differences between Black Duck & Veracode

182

What SCA solution do you recommend?