Very easy to set up and make it work. Also very easy to modify the set up and add or remove new repos. I really like the fact that after each merge Mend automatically creates issues associated with each problematic dependency, and those are automatically closed if the issue is resolved. Review collected by and hosted on G2.com.

So far there hasn't been any areas that I disliked. I haven't dig deep into the documentation yet, but it was not immediately clear if Mend will automatically assess PRs before merging and add any comments to them. Review collected by and hosted on G2.com.

Quick and accurate scanning, multiple plug-ins for various different build and ci/cd platforms. Prioritize, Whitesource for developers Review collected by and hosted on G2.com.

hard to get some features working like

eua, and integration this Jira was challenging Review collected by and hosted on G2.com.

The information about vulnerabilities is generally up to date. Review collected by and hosted on G2.com.

The UI is very clunky. Doesn't integrate well into development workflow. as we need to come to this tool to audit the findings. Would be nice to have it as a github plugin from where we can directly audit the findings. Review collected by and hosted on G2.com.

Mend's integration with source control systems and IDEs is simply outstanding. Review collected by and hosted on G2.com.

Nothing I dislike as of now. But I wish mend had a chat feature or something for quick resolution of small issues without needing to open support cases. Review collected by and hosted on G2.com.

Overall I feel that Mend is a good platform and what I love most is that they are always working on continued improvements.

Moreover features like prioritize etc make it the best Review collected by and hosted on G2.com.

frankly it's a good tool. Still, if i have to list the cons,i would say .so , .a file types support should be added. Also, prioritize should include support for more and more package maangers . Review collected by and hosted on G2.com.

Scanning for the vulnerabilities is always updated and the research team is doing an amazing job keeping everything up-to-date and not missing any vulnerability. Review collected by and hosted on G2.com.

I feel that the dashboard's UI can look nicer and more readable. eg better views, more modern design, easier access to products and related projects with a tree view. Review collected by and hosted on G2.com.

IntelliJ Plugin - The analysis is really quick Review collected by and hosted on G2.com.

Viewing the report. I feel overwhelmed when I log in to Mend. The landing page should just contain the project I'm interested in and the related reports. Similar to tools like Fortify and Sonar. Review collected by and hosted on G2.com.

Mend has timely support through their portal and sales rep which has been very helpful. Their newest documentation is overhauled which is a huge plus compared to their previous WhiteSource documentation. Their vulnerability management has timely alerts, a wealth of information on findings and integrations. Review collected by and hosted on G2.com.

Implementation was challenging even with technical support. We were unable to effectively get the unified agent configuration working even though we had this 5 months prior in a POC. We opted to go for Azure integration which worked easily out of the box (a plus) but is a bit limited in scope for how we handled effective vulnerabilities.

Reporting is lacking especially when using the tool as a compliance/inventory management process. Risk acceptance lasts indefinitely rather than a threshold e.g. 90 days / 360 days. Review collected by and hosted on G2.com.

The simplicity of scanning

The simplicity of the GUI and able to drill down into where exactly a particular library is fetched from

Ability to download reports and more meaningful reports as compared to other products (Snyk, CodeClimate) Review collected by and hosted on G2.com.

The complexity in scanning different technologies and educating developers how to scan their code and read their dashboards

Sometimes, downstream dependencies are displayed (false positives) , it is extremely hard for engineers to figure out the tree maps and fix the problematic lines of code

The "Requires Review" section is very wide and demands the review and sign off from different departments like developer+devops+Management. But the GUI does not support this in a user friendly way.

When we mark a library "in-house" or try to "whitelist it" it becomes permanently marked as such instead of allowing us to revisit it. Review collected by and hosted on G2.com.

Mend is a very intuitive tool that has integrations with many typical pipelines and repos. We have found it to be very good at identifying vulnerable components with a low false positive rate. It provides good recommendations for the best fix version of a library. Review collected by and hosted on G2.com.

Mend is starting to build out full support for exporting results in standard SBOM formats, but generating these outputs currently requires running separate Python scripts. Review collected by and hosted on G2.com.