Mend.io Reviews & Product Details

I like Mend.io mainly because it can scan for vulnerabilities. I used it mostly as a test case: I created a test project, ran a vulnerability scan, and then used the dashboard, which listed everything across multiple repositories. That view makes it easier to prioritize what to fix first.

I also like the support it gives developers by providing visibility into threats when it comes to open source. Onboarding and integrating it with third-party applications is also quite easy. In one of my test cases, when I was working as a developer, it initially took me a lot of time to identify vulnerabilities, but after using Mend.io it became less time-consuming.

Also, when it comes to compliance, it helps there too by license compliance and prevents manual work. Review collected by and hosted on G2.com.

Let’s first talk about the UI. The initial setup for the policy takes some time, and it would be easier with an onboarding guide to improve the user experience.

On performance, the dashboard has a lot of information, which may feel overwhelming for an engineer.

The pricing also seemed a bit high to me, and it may be challenging for a smaller startup.

When it comes to reporting, it could be customized further to be more useful. Review collected by and hosted on G2.com.

Mend eases the process of keeping track of all the used 3rd party dependencies within a product. It not only scans for the pure occurrence (also transitively) but takes also care of license and vulnerabilities. The new platform approach is much more user friendly than the old UI. Review collected by and hosted on G2.com.

Integration into jira is somehow buggy, so that security issues still show up in jira security, although the scan shows that they are remediated. For the beginning it is still a steep learning curve, but it is worth the effort to setup all the workflows - although it is intransparent how to add exceptions. Review collected by and hosted on G2.com.

What stands out most about Mend.io is how seamlessly it integrates into the development pipeline without disrupting existing workflows. The fast feedback loop enables developers to respond rapidly to any vulnerability or license issues ,catching problems early rather than at the end of the release cycle. The open-source dependency management with CVE detection, detailed vulnerability and license reports, and fix suggestions make it genuinely useful day-to-day, not just a compliance checkbox. The automated remediation saves hours of manual triage. Review collected by and hosted on G2.com.

The initial setup and configuration can be overwhelming, especially for teams new to SCA tooling. The sheer volume of vulnerability alerts early on can lead to alert fatigue ,without proper policy tuning, developers tend to ignore notifications rather than act on them. The dashboard, while feature-rich, has a steep learning curve and could benefit from a more intuitive onboarding experience. Pricing is also a concern, as SaaS and on-prem software costs continue to rise, the per-developer pricing model can become expensive at scale , making it harder to justify for smaller teams or budget-conscious organizations. Review collected by and hosted on G2.com.

I find Mend.io very easy to integrate because it already has capabilities to scan multiple, different codes. The agent is pretty lightweight, just a CLI agent that can run all the scans and is easily downloadable. Also, the cost is under budget and comparable to industry standards. Review collected by and hosted on G2.com.

Guess the AI scanning is something which is we have not taken that particular aspect. We are only seeing it on the dashboard. But I guess the AI agent is something which can be worked on. More insights. Also, if Mend can also work on Runtime analysis, that's a new unexplored category. Review collected by and hosted on G2.com.

Ease of use. Because it reviews open-source libraries at the source code management platform level (like GitHub), we’re able to identify and mitigate issues more effectively. The “Renovate” feature is also a handy tool when it comes to resolution. Review collected by and hosted on G2.com.

As of now, I do not have much to dislike. Review collected by and hosted on G2.com.

Offer real time security analysis inside modern code editors like cursor and support for governing AI components. Review collected by and hosted on G2.com.

Configurating policies for large enterprise codebases requires significant initial overhead Review collected by and hosted on G2.com.

The GitHub to Mend integration is very helpful. It pushes the scans earlier into the process saving time and effort later later on. The agent scan performance is always good.

The differing scan features such as SCA and SAST are easily available from the new CLI interface removing the need to have multiple agent version.

Product support is always fast and helpful, Mend are quite open to reviewing new feature requests and accommodating use cases. Review collected by and hosted on G2.com.

The Mend to GitHub integration can be a little fiddly to initially setup and upgrade. Review collected by and hosted on G2.com.

Mend.io is easy to use, helps me find security issues quickly, and makes it simpler to fix vulnerabilities. My favorite features are the automated fixes and the clear, easy-to-understand reports.. Review collected by and hosted on G2.com.

The main things I dislike about Mend.io are that it can sometimes generate too many alerts, it takes time to learn, and some of the more advanced features can be expensive. Review collected by and hosted on G2.com.

Easy setup: It integrates quickly with GitHub and fits smoothly into CI/CD workflows. Effective scanning: It rapidly tracks open-source dependencies and helps with license compliance. Helpful automation: The Renovate feature supports automated dependency updates. Good support: Customer service is often described as fast and helpful. Review collected by and hosted on G2.com.

Interface: Parts of the UI clunky or a bit outdated. False Positives: It can generate noise, which then requires extra manual triage. Pricing: It’s sometimes considered a little high for smaller teams or mid-market buyers. Integrations: Third-party tool connections, like Jira, can occasionally bug out. Review collected by and hosted on G2.com.

Its accurate prioritization and ability to cut through security noise are really impressive. The user interface is intuitive, even for a new user. It also provides options to integrate Mend Renovate, which is a great option. Finally the support is phenomenal. Review collected by and hosted on G2.com.

Performance-wise, it could be better, with less lag during processes. Another issue is the lack of online documentation, which causes users to spend a lot of time resolving an issue or to reach out to support for small queries. Review collected by and hosted on G2.com.