No more typing reviews! Try our Samantha, our new voice AI agent.

Mend.io pros and cons

Vendor: Mend.io

4.2 out of 5

35 reviews
97% willing to recommend

Pros & Cons summary

Mend.io offers seamless integration with CI/CD processes, excels in NodeJS and Maven projects, and enhances security through automation and vulnerability management. Comprehensive analytics and reports support compliance and disclosure needs. However, it faces challenges in pricing, reporting speed, and access control. Improvements are needed in container scanning, role definitions, and report generation. Expanding package manager support and integration capabilities will further benefit larger organizations.

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.

Prominent pros & cons

PROS

Mend.io saves a significant amount of time and offers accurate results, providing extensive reports on vulnerabilities and efficient open-source dependency management.

The integration capability is seamless with various systems including CI/CD processes, showcasing robust performance and effectiveness in dealing with NodeJS and Maven projects.

The comprehensive scanning and managing of third-party libraries along with license automation and classification help maintain compliance with software policies and reduce vulnerabilities.

Fix suggestions and effective vulnerability policy automation empower teams to address open-source vulnerabilities swiftly, enhancing the security framework and offering a roadmap for remediation.

Mend.io offers extensive analytics and comprehensive reports that aggregate necessary data, assisting in satisfying various license requirements and disclosure needs in software development.

CONS

Initial setup of Mend.io could be simplified with preconfigured policies that align with Azure DevOps, as configuring them manually is tedious and time-consuming.

Reporting improvements are needed as generating reports for large organizations can be slow, and additional compliance packs for frameworks like CIS and NIST are desired.

The pricing of Mend.io is considered high, making it an expensive affair for both SaaS and on-prem deployments, necessitating a reduction in costs.

Mend.io needs better role definitions and an improved access control model to support larger organizations effectively, as well as enhancements in scanning containers and images for errors.

Integration with ID and Shift Left is crucial, allowing developers to see scan results without build failures, and a need exists for more supported package managers for quicker adaptation to organizational needs.

Mend.io Pros review quotes

CEO at a computer software company with 10,001+ employees

Dec 17, 2025

Once we onboarded to Mend.io, we saw a drastic improvement in the way Mend.io reported the SCA findings.

Read full review

reviewer2196063

Project Associate at a tech vendor with 10,001+ employees

Jul 27, 2026

In my opinion, it is the best because with respect to the scan coverage, it is giving basically all the components we are looking for and all the requirements we require, and compared to other tools, especially in terms of identifying and integrating into our DevSecOps and CI/CD, Mend.io is compatible, with good integration coverage across all the technologies it supports and a relatively low noise ratio with accurate issues and useful customization options.

Read full review

SM

Product Security Architect at a computer software company with 10,001+ employees

Jun 11, 2026

The home dashboard itself gives a very good analysis for Mend.io; this is not just for SCA, it is for SAST and container as well, and it gives entire analytics of how many vulnerabilities were found, how much was updated, and how much was fixed over the last three, six, and nine months.

Read full review

Free Report: Mend.io Reviews and More

Learn what your peers think about Mend.io. Get advice and tips from experienced pros sharing their opinions. Updated: July 2026.

908,800 professionals have used our research since 2012.

reviewer1252050

VP at a tech vendor with 5,001-10,000 employees

Oct 27, 2025

The features I find most valuable in Mend.io are the ease of use; it is very easy to access and integrate.

Read full review

CEO at a computer software company with 10,001+ employees

Nov 28, 2024

Mend.io is very robust in terms of managing third-party dependencies.

Read full review

SR

SrikanthRaghavan

Principal Architect at a consultancy with 11-50 employees

May 19, 2025

Mend.io is a security tool that provides security feedback for all tests.

Read full review

SM

Product Security Architect at a computer software company with 10,001+ employees

Sep 26, 2023

The best feature is that the Mend R&D team does their due diligence for all the vulnerabilities. In case they observe any important or critical vulnerabilities, such as the Log4j-related vulnerability, we usually get a dedicated email from our R&D team saying that this particular vulnerability has been exploited in the world, and we should definitely check our project for this and take corrective actions.

Read full review

reviewer1928817

Sr. Manager at a financial services firm with 10,001+ employees

Jul 31, 2022

Mend has reduced our open-source software vulnerabilities and helped us remediate issues quickly. My company's policy is to ensure that vulnerabilities are fixed before it gets to production.

Read full review

reviewer2165991

Release Manager at a tech vendor with 501-1,000 employees

Apr 23, 2023

What is very nice is that the product is very easy to set up. When you want to implement Mend.io, it just takes a few minutes to create your organization, create your products, and scan them. It's really convenient to have Mend scanning your products in less than one hour.

Read full review

KW

Principal Security Engineer at Texthelp Ltd.

Jan 10, 2023

There are multiple different integrations there. We use Mend for CI/CD that goes through Azure as well. It works seamlessly. We never have any issues with it.

Read full review

Show 10 more reviews (out of 34)

Mend.io Cons review quotes

CEO at a computer software company with 10,001+ employees

Dec 17, 2025

We wanted to have certain reports based on our kind of scenario, but the tool did not allow us to create custom reports.

Read full review

reviewer2196063

Project Associate at a tech vendor with 10,001+ employees

Jul 27, 2026

With respect to improvements with Mend.io, as I mentioned, today it is not supporting the threat intelligence.

Read full review

SM

Product Security Architect at a computer software company with 10,001+ employees

Jun 11, 2026

For monitoring capabilities in Mend.io, I did not understand the maintenance part.

Read full review

Free Report: Mend.io Reviews and More

Learn what your peers think about Mend.io. Get advice and tips from experienced pros sharing their opinions. Updated: July 2026.

908,800 professionals have used our research since 2012.

reviewer1252050

VP at a tech vendor with 5,001-10,000 employees

Oct 27, 2025

The tools need to bring down the pricing because software in SaaS or on-prem is becoming a more expensive affair.

Read full review

CEO at a computer software company with 10,001+ employees

Nov 28, 2024

AI integration in code security tools like Mend.io is still in its early stages and relatively immature.

Read full review

SR

SrikanthRaghavan

Principal Architect at a consultancy with 11-50 employees

May 19, 2025

The main consideration is the cost. The products always have their maturity.

Read full review

SM

Product Security Architect at a computer software company with 10,001+ employees

Sep 26, 2023

I would like to have an additional compliance pack. Currently, it does not have anything for the CIS framework or the NIST framework. If we directly run a scan, and it is under the CIS framework, we can directly tell the auditor that this product is now CIS compliant.

Read full review

reviewer1928817

Sr. Manager at a financial services firm with 10,001+ employees

Jul 31, 2022

Mend supports most of the common package managers, but it doesn't support some that we use. I would appreciate it if they can quickly make these changes to add new package managers when necessary.

Read full review

reviewer2165991

Release Manager at a tech vendor with 501-1,000 employees

Apr 23, 2023

On the reporting side, they could make some improvements. They are making the reports better and better, but sometimes it takes a lot of time to generate a report for our entire organization.

Read full review

KW

Principal Security Engineer at Texthelp Ltd.

Jan 10, 2023

Mend lets you create custom policies. They're not too complicated to set up, but it would be helpful if they had some preconfigured policies to match what we have in Azure DevOps. That would save us a lot of time. It's tedious to configure the policies manually, and I lack the capacity to do it right now. Other products have preconfigured packs and templates, and Mend doesn't.

Read full review

Show 10 more reviews (out of 34)

Related questions

53

How does Camunda Platform compare with Apache Airflow?

71

How does WhiteSource compare with SonarQube?

123

How does WhiteSource compare with Black Duck?

162

What tools do you rely on for building a DevSecOps pipeline?

132

What alternatives are there for Fortify WebInspect and Fortify SCA?

82

What is the best way to track open-source license compatibility?

160

How long does SCA scanning take?

356

Why is Software Composition Analysis (SCA) important for companies?

140

Differences between Black Duck & Veracode

148

What SCA solution do you recommend?