Mend.io - Open Source Security & SBOM Management at Enterprise Scale
Mend.io (formerly WhiteSource) provides Software Composition Analysis: continuous open-source vulnerability management, licence compliance and SBOM generation in SPDX and CycloneDX - the formats named in CERT-In's SBOM guidelines.
Built for Security Teams That Demand Results
SecOpsTool partners directly with Mend.io to provide licences, professional onboarding, integration support, and ongoing expert guidance - ensuring you get the maximum return from your security investment.
Request 14-Day Free Trial →Use Cases
- SEBI CSCRF compliance
- CERT-In compliance
- Financial software supply chain
- Enterprise open-source governance
- Regulatory SBOM requirements
- DevSecOps automation
Compliance & Standards
Everything You Need from Mend.io
Comprehensive features designed to accelerate your security programme and reduce risk across the entire development lifecycle.
Real-Time Vulnerability Detection
Continuously monitors open-source components for newly disclosed vulnerabilities and prioritises them using CVSS 4.0 severity and EPSS exploit probability.
Automated SBOM Generation
Produces SBOMs in SPDX and CycloneDX, the formats named in CERT-In's SBOM guidelines, with VEX data embedded in CycloneDX reports.
Licence Compliance Engine
Detects every licence attached to direct and transitive dependencies, including copyleft (GPL, AGPL, LGPL), permissive (MIT, Apache 2.0) and dual-licensed packages.
Reachability Analysis
Determines whether your application actually invokes the vulnerable function, so teams can start with the vulnerabilities that are reachable.
Auto-Fix Pull Requests
Mend Renovate automatically generates pull requests to update outdated dependencies, inside your normal code review flow.
Container & Registry Scanning
Scans Docker images and container registries for vulnerable packages before they reach production environments.
Is Mend.io Right for Your Team?
Mend.io describes Mend SCA as a tool that identifies, prioritises and remediates security and licence risks in open-source components. It is part of the Mend AppSec platform, which also covers SAST and container scanning.
Who uses Mend.io: Mend.io names WTW, Vonage, Siemens Schweiz AG, Yahoo, Microsoft, Ping Identity, Seagate and Kärcher among its customers on its own website.
Mend.io Is a Good Fit For
- Teams that depend heavily on open-source packages and need continuous vulnerability and licence monitoring
- Organisations that must produce SBOMs in SPDX or CycloneDX, the two formats named in CERT-In's SBOM guidelines
- SEBI regulated entities that have to obtain and maintain SBOMs for critical systems under the CSCRF
- Regulated or air-gapped environments: Mend states that Mend AppSec supports SaaS, hybrid and on-premises deployments
Why Teams Choose Mend.io
- Reachability analysis shows whether your application actually invokes the vulnerable function
- Prioritisation combines CVSS 4.0 severity with EPSS, the probability that a CVE is exploited in the wild
- Licence detection covers direct and transitive dependencies
- Mend Renovate opens pull requests that update outdated dependencies automatically
What You Gain with Mend.io
Focus on what is reachable
Mend SCA traces the call graph from your code through direct and transitive dependencies to determine whether the vulnerable function is actually invoked.
Risk based prioritisation
CVSS 4.0 severity scoring is combined with EPSS data, which estimates how likely a CVE is to be exploited, so the most urgent fixes come first.
SBOMs with VEX
SBOM reports are available in SPDX 2.2 and 2.3 and CycloneDX 1.4, 1.5 and 1.6. CycloneDX reports embed VEX data. Mend can also ingest third-party SBOMs.
Licence compliance
Mend SCA detects every licence attached to direct and transitive dependencies, including copyleft (GPL, AGPL, LGPL), permissive (MIT, Apache 2.0) and dual-licensed packages.
Automated dependency updates
Mend Renovate automatically generates pull requests to update outdated dependencies, which keeps remediation inside the normal code review flow.
Deployment choice
Mend states that Mend AppSec supports SaaS, hybrid and on-premises deployments, and describes it as suitable for regulated industries and air-gapped environments.
Mend.io: Supported Languages and Integrations
Languages and Package Managers
Mend states that Mend SCA supports more than 200 programming languages and frameworks. The ecosystems above are the ones named on its product page and in the Mend CLI support matrix, which also lists the supported versions.
Integrations
Repositories
IDEs
CI/CD
Containers
Lists follow the vendor's published documentation as checked in September 2026. Support varies by version and edition, so ask us to confirm your exact stack.
Mend.io Price, Licence Cost and Free Trial in India
Mend.io prices its platform per developer, per year. Your actual cost depends on the number of developers and the products you choose, so SecOpsTool prepares a quotation for your team.
How Mend.io Licensing Works
- Mend lists pricing per developer, per year, for Mend AppSec, Mend AI and Mend Renovate Enterprise
- Mend Renovate also has free CLI and Community editions
- SaaS, hybrid and on-premises deployments are supported
- Mend's own trial page leads to a personalised demo, so trials are arranged rather than self-service
Get a Mend.io Quotation or Trial
- Written price quotation for your team size, usually within 24 hours
- 14-day Mend.io evaluation arranged for your team
- Help with download, installation and your first scan
- Licences, renewals and support from one partner in India
Mend.io: Pricing, Trial and Product Questions
Mend.io prices its products per developer, per year, and publishes list prices on its pricing page. What you pay depends on your number of developers and the products you need. Send us those details and SecOpsTool provides a written quotation, usually within 24 hours.
Use the form on this page and choose Price quotation. Tell us your team size and the modules or licence type you need, and SecOpsTool sends a written Mend.io quotation, usually within 24 hours.
Mend's own free-trial page leads to a personalised demo rather than an instant download. SecOpsTool arranges a 14-day evaluation for teams in India and helps you connect your repositories and generate a first SBOM.
Yes. WhiteSource renamed itself Mend in 2022. The products continued under the new name, and the documentation moved to docs.mend.io.
Mend's documentation lists SPDX 2.2 and 2.3 (JSON, XML, YAML, Excel and tag-value) and CycloneDX 1.4, 1.5 and 1.6 (JSON and XML). VEX data is embedded in the CycloneDX reports.
Through reachability analysis. Mend SCA follows the call graph from your code into direct and transitive dependencies and shows whether the vulnerable function is actually invoked, so teams can start with vulnerabilities that are reachable.
Mend states that Mend AppSec supports SaaS, hybrid and on-premises deployments and describes it as suitable for regulated industries and air-gapped environments. We help you choose the model that fits your data policies.
Get a Mend.io Price Quote or 14-Day Free Trial
Evaluate Mend.io on your own code for 14 days, with our engineers on hand. Our security engineers will onboard you and ensure you get maximum value from day one.
- 14-day trial licence arranged for your team
- Dedicated onboarding by certified security experts
- Integration support for your existing CI/CD pipeline
- Post-trial assessment report included
Request a Quote or Free Trial
Tell us what you need. We reply within 24 hours with your quotation or trial licence.