Mend.io is an application security and AI security company. Its platform helps development and security teams find and fix risk in the code they write, the open source packages they depend on, and the AI models and agents they build into their applications.
It is built for organisations whose software now comes from three sources at once, their own developers, open source and AI, and who need one view of the risk across all of them.
At A Glance
| Vendor | Mend.io (White Source Ltd.) |
|---|---|
| Category | Application security and AI security |
| Deployment | SaaS, hybrid and on-premises (Mend AppSec) |
| Agentic AI | Discovery of AI agents, their tools and MCPs; AI red teaming and runtime guardrails |
| Customers | Microsoft, Google, Vodafone, Yahoo, Siemens |
| Founded | 2011 |
What Mend.io Does
Modern applications are assembled more than written: most of the code comes from open source packages, a growing share is produced by AI coding assistants, and many applications now call models and agents of their own. Each of those layers brings its own vulnerabilities, and security teams cannot fix everything their scanners report. Mend.io scans all of these layers and then narrows the results to the issues that matter, using reachability analysis, exploit intelligence and the context of the application. Fixes are proposed automatically, as code changes or safer dependency versions, and reviewed by the customer’s own team. Controls are mapped to regulations such as the EU Cyber Resilience Act (CRA), the EU AI Act and NIST.
Products
Mend AppSec
Mend AppSec brings software composition analysis (SCA), static testing (SAST), dependency management and container image scanning into one product, so teams see risk from code and from open source together.
- SCA for open source dependencies and container images, with risk ranked using EPSS and CVSS 4.0 and reachability analysis
- SAST that finds code risks as they are written, including in code from AI coding assistants
- DAST for running applications and API security for exposed endpoints
- End of life (EOL) support with security patches for packages that are no longer maintained
- SBOM generation, sharing and tracking
Mend AI
Mend AI is for teams building applications on large language models and agents. It discovers the AI components in an application, including shadow AI that nobody registered, and records them in an AI bill of materials (AI-BOM) of models, frameworks, datasets and dependencies. It then tests conversational AI with red teaming for prompt injection, context leakage and data exfiltration, hardens system prompts, and applies governance policies across the development lifecycle.
Mend Renovate
Mend Renovate finds outdated packages and opens pull requests to update them, across more than 90 package managers. The Renovate CLI is open source.
How It Works
Mend AppSec can be deployed as SaaS, as a hybrid deployment or on-premises. Scans reach the platform in several ways.
| Component | What it does |
|---|---|
| Mend CLI | The CLI runs SAST, SCA and container scans as a job in any pipeline. Mend SAST can scan sensitive source code locally, so the code never leaves the customer’s environment. |
| Repository integrations | Native integrations scan on every push and pull request in the connected source code platforms. |
| Unified Agent | CI/CD and package manager integrations are configured through the Unified Agent. |
| Renovate | Renovate runs in the cloud or self-hosted, scans repositories at set intervals and opens pull requests and issues in the repository it scanned. |
Agentic AI Capabilities
Agent And MCP Discovery
Mend AI’s discovery extends to the tools and MCP servers each agent connects to, and flags risky agent configurations before they reach production.
Runtime Guardrails
Red teaming has a reported capacity of more than 1,000 concurrent tests. At runtime, guardrails inspect every input before it reaches the model and every output before it reaches the user.
Checks On Coding Agents
When a coding agent writes code or proposes a new dependency, Mend.io can check it for security weaknesses. AI assistants such as Claude Code and Cursor can be connected through MCP, and AI is also used in triage, prioritisation and fix generation.
Integrations
| Area | Integrations |
|---|---|
| Repositories | GitHub, GitHub Enterprise, GitLab, Bitbucket Cloud, Bitbucket Server, Bitbucket Data Center, Azure DevOps |
| CI/CD | Jenkins, Bamboo, TeamCity, CircleCI, Travis CI, AWS CodeBuild, Bitbucket Pipelines, Cloud Build, CodeFresh |
| IDEs | Visual Studio Code, Visual Studio, IntelliJ IDEA, PyCharm, WebStorm |
| Issue tracking | Jira, ServiceNow |
| Registries | GitHub Packages, Docker, JFrog Artifactory, Amazon ECR, Azure Container Registry, Google Container Registry |
| Cloud security | Wiz, Microsoft Defender for Cloud |
| AI assistants | Google Gemini Code Assist, Gemini CLI, Claude Code, Amazon Q Developer, Copilot, Cursor, Windsurf |
Company Background
| Founded | 2011, as WhiteSource; the legal entity is still White Source Ltd. |
|---|---|
| Leadership | Azi Cohen (Co-founder and CEO), Asaf Saar (Chief Product Officer) and Ilan Sidi (Chief Financial Officer) |
| Funding | A reported $122 million raised by December 2023, from investors including 83North, Pitango Growth, M12 Fund and Susquehanna Growth Equity |
| Acquisitions | Atom Security in December 2023 |
Note: This overview is compiled from Mend.io’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.