FOSSA vs Mend.io comparison

FOSSA and Mend.io are both solutions in the Software Composition Analysis (SCA) category. FOSSA is ranked #10 with an average rating of 8.0, while Mend.io is ranked #7 with an average rating of 9.0. FOSSA holds a 3.7% mindshare in SCA, compared to Mend.io’s 8.7% mindshare. Additionally, 92% of FOSSA users are willing to recommend the solution, compared to 96% of Mend.io users who would recommend it.

FOSSA

Read 15 FOSSA reviews

2,420 Views
1,585 Comparison Views

92% willing to recommend

Mend.io

Read 29 Mend.io reviews

5,953 Views
3,567 Comparison Views

96% willing to recommend

FOSSA

Mend.io

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Nov 5, 2024

Mend.io and FOSSA compete in the open-source dependency management category, focusing on security and compliance solutions. Mend.io appears to have the upper hand due to its advanced automation features like Smart Fix and Prioritize, which enhance vulnerability management and compliance.

Features: Mend.io offers automated processes for handling vulnerabilities, effective dashboards for risk management, and robust CI/CD integrations. It is especially noted for its Smart Fix and Prioritize features that automate compliance with open-source licenses. FOSSA excels in precise dependency tracking during builds, with a straightforward policy engine offering actionable insights for licensing. It is valued for its automated legal and security guidance, focusing on licensing issues.

Room for Improvement: Mend.io could improve its notifications for dependency issues and expand its role-based access model. Dashboard usability enhancements and broader language support for features like Prioritize are needed. FOSSA could enhance snippet matching, provide more comprehensive security scans, and improve project categorization. More reliable reports and clearer error instructions would also be beneficial, alongside advanced documentation and UI navigation improvements.

Ease of Deployment and Customer Service: Mend.io supports diverse deployment options across public, private, and hybrid clouds, praised for its flexible approach. Its customer service and technical support are noted for their responsiveness and technical expertise. FOSSA is available on public and on-premises environments, receiving high ratings for customer support, although there's room for streamlining the support process compared to Mend.io.

Pricing and ROI: Mend.io's pricing, while perceived as high, offers predictability with fixed costs across projects and languages, which is considered fair for the value provided. The ROI is evident in reduced manual processing and faster project delivery. FOSSA's pricing, based on a per-engineer model, is competitive but sometimes viewed as expensive, potentially limiting its appeal. Both platforms enhance compliance and security, with Mend.io facing potential competition from more affordable solutions like GitHub Advanced Security.

To learn more, read our detailed FOSSA vs. Mend.io Report (Updated: October 2024).

Buyer's Guide

FOSSA vs. Mend.io

October 2024

Download the complete report

Helped 814,649 peers since 2012

Categories and Ranking

FOSSA

Ranking in Software Composition Analysis (SCA)

10th

Average Rating

8.6

Number of Reviews

Ranking in other categories

No ranking in other categories

Mend.io

Ranking in Software Composition Analysis (SCA)

7th

Average Rating

8.4

Number of Reviews

Ranking in other categories

Application Security Tools (17th), Static Code Analysis (4th), Software Supply Chain Security (1st)

Mindshare comparison

As of November 2024, in the Software Composition Analysis (SCA) category, the mindshare of FOSSA is 3.7%, down from 4.5% compared to the previous year. The mindshare of Mend.io is 8.7%, down from 11.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Software Composition Analysis (SCA)

Featured Reviews

Hanumanth Ramsetty

Software Engineer at Tech Mahindra Limited

Oct 24, 2024

Proactively mitigate deployment vulnerabilities with seamless dependency tracking

In our current project, we are using FOSSA as part of our CI/CD pipeline. It is used to scan our projects to ensure that our dependencies are up to date and do not introduce vulnerabilities to our code Before using FOSSA, we could only identify issues after deployment in the Cloud Run. Now, with…

Read full review

Jeffrey Harker

System Manager of Cloud Engineering at Common Spirit

May 12, 2022

Easy to use, great for finding vulnerabilities, and simple to set up

Finding vulnerabilities is pretty easy. Mend (formerly WhiteSource) does a great job of that and we had quite a few when we first put this in place. Governance up until that time had been manual and when we tried to do manual governance of a large codebase, our chances of success were pretty minimal. Mend (formerly WhiteSource) does a very good job of finding the open-source, checking the versions, and making sure they're secure. They notify us of critical high, medium, and low impacts, and if anything is wrong. We find the product very easy to use and we use it as a core part of our strategy for scanning product code moving toward release. We use Mend (formerly WhiteSource) Smart Fix. I’d say pretty much everything in Mend (formerly WhiteSource) is easy to use. We really don't have too much difficulty using the product at all. I've implemented other scanners and tools and had much more trouble with those products than we've ever had with Mend (formerly WhiteSource). That’s extremely important. It's hard to sell to some of these teams to put any level of overhead on top of their product development efforts and the fact that Mend (formerly WhiteSource) is as easy as it is to use is a critical aspect of adoption here. It scores very highly on that scale. Mend (formerly WhiteSource) Smart Fix helps our developers fix vulnerable transitive dependencies. It's all very helpful to our development community. First of all, we're able to find that there are issues. Second of all, we're able to figure out very quickly what needs to be done to remediate the issues. Mend (formerly WhiteSource) helped reduce our mean time to resolution since adopting it. A lot of it is process improvement and technical aspects that can tell us how to go about remediating the issues. We get that out of Mend (formerly WhiteSource). Making the developers aware that these issues are there and insisting they be corrected and making the effort to do that visibly is very valuable to us. Overall, Mend (formerly WhiteSource) helped dramatically reduce the number of open-source software vulnerabilities running in our production at any given point in time. I won't give metrics, however, it's fair to say that our state before and after Mend (formerly WhiteSource) is dramatically different and moved in a positive direction. Mend's ability to integrate our developer's existing workflows, including their IDE repository and CI is good. Azure DevOps is really important. That's what the pipelines are. That's a very important piece of the entire puzzle. If this was just an external scanner where periodically we'd go through and scan our repos and give them a report, we’d do that with pen testing products, for example, for security testing. The problem is, by the time they get those reports, they've already shipped the code to multiple environments and it's too late to stop the train. With these features being baked into the pipelines like this, they know immediately. As a result, we're able to quickly take action to remediate findings.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Their CLI tool is very efficient. It does not send your source code over to their servers. It just does fingerprinting. It is also very easy to integrate into software development practices."

"I am impressed with the tool’s seamless integration and quick results."

"I found FOSSA's out-of-the-box policy engine to be accurate and that it was tuned appropriately to the settings that we were looking for. The policy engine is pretty straightforward... I find it to be very straightforward to make small modifications to, but it's very rare that we have to make modifications to it. It's easy to use. It's a four-category system that handles most cases pretty well."

"The scalability is excellent."

"FOSSA suggests solutions for dependency mismatches."

"What I really need from FOSSA, and it does a really good job of this, is to flag me when there are particular open source licenses that cause me or our legal department concern. It points out where a particular issue is, where it comes from, and the chain that brought it in, which is the most important part to me."

"The support team has just been amazing, and it helps us to have a great support team from FOSSA. They are there to triage and answer all our questions which come up by using their product."

"Being able to know the licenses of the libraries is most valuable because we sell products, and we need to provide to the customers the licenses that we are using."

More FOSSA pros

"We set the solution up and enabled it and we had everything running pretty quickly."

"I am the organizational deployment administrator for this tool, and I, along with other users in our company, especially the security team, appreciate the solution for several reasons. The UI is excellent, and scanning for security threats fits well into our workflow."

"The most valuable features are the reporting, customizing libraries "In-house, White list, license selection", comparing the products/projects, and License & Copyright resolution."

"What is very nice is that the product is very easy to set up. When you want to implement Mend.io, it just takes a few minutes to create your organization, create your products, and scan them. It's really convenient to have Mend scanning your products in less than one hour."

"WhiteSource is unique in the scanning of open-source licenses. Additionally, the vulnerabilities aspect of the solution is a benefit. We don't use WhiteSource in the whole organization, but we use it for some projects. There we receive a sense of the vulnerabilities of the open-source components, which improves our security work. The reports are automated which is useful."

"There are multiple different integrations there. We use Mend for CI/CD that goes through Azure as well. It works seamlessly. We never have any issues with it."

"Attribution and license due diligence reports help us with aggregating the necessary data that we, in turn, have to provide to satisfy the various licenses copyright and component usage disclosures in our software."

"The best feature is that the Mend R&D team does their due diligence for all the vulnerabilities. In case they observe any important or critical vulnerabilities, such as the Log4j-related vulnerability, we usually get a dedicated email from our R&D team saying that this particular vulnerability has been exploited in the world, and we should definitely check our project for this and take corrective actions."

More Mend.io pros

Cons

"I would like more customized categories because our company is so big. This is doable for them. They are still in the stages of trying to figure this out since we are one of their biggest companies that they support."

"On the dashboard, there should be an option to increase the column width so that we can see the complete name of the GitHub repository. Currently, on the dashboard, we see the list of projects, but to see the complete name, you have to hover your mouse over an item, which is annoying."

"I would like the FOSSA API to be broader. I would like not to have to interact with the GUI at all, to do the work that I want to do. I would like them to do API-first development, rather than a focus on the GUI."

"The solution provides contextualized, actionable, intelligence that alerts us to compliance issues, but there is still a little bit of work to be done on it. One of the issues that I have raised with FOSSA is that when it identifies an issue that is an error, why is it in error? What detail can they give to me? They've improved, but that still needs some work. They could provide more information that helps me to identify the dependencies and then figure out where they originated from."

"I wish there was a way that you could have a more global rollout of it, instead of having to do it in each repository individually. It's possible, that's something that is offered now, or maybe if you were using the CI Jenkins, you'd be able to do that. But with Travis, there wasn't an easy way to do that. At least not that I could find. That was probably the biggest issue."

"FOSSA does not show the exact line of code with vulnerabilities, which adds time to the process as we have to locate these manually."

"The technical support has room for improvement."

"One thing that can sometimes be difficult with FOSSA is understanding all that it can do. One of the ways that I've been able to unlock some of those more advanced features is through conversations with the absolutely awesome customer success team at FOSSA, but it has been a little bit difficult to find some of that information separately on my own through FAQs and other information channels that FOSSA has. The improvement is less about the product itself and more about empowering FOSSA customers to know and understand how to unlock its full potential."

More FOSSA cons

"Needs better ACL and more role definitions. This product could be used by large organisations and it definitely needs a better role/action model."

"Make the product available in a very stable way for other web browsers."

"The initial setup could be simplified."

"The turnaround time for upgrading databases for this tool as well as the accuracy could be improved."

"It would be good if it can do dynamic code analysis. It is not necessarily in that space, but it can do more because we have too many tools. Their partner relationship support is a little bit confusing. They haven't really streamlined the support process when we buy through a reseller. They should improve their process."

"We have ended our relationship with WhiteSource. We were using an agent that we built in the pipeline so that you can scan the projects during build time. But unfortunately, that agent didn't work at all. We have more than 500 projects, and it doubled or tripled the build time. For other projects, we had the failure of the builds without any known reason. It was not usable at all. We spent maybe one year working on the issues to try to make it work, but it didn't in the end. We should be able to integrate it with ID and Shift Left so that the developers are able to see the scan results without waiting for the build to fail."

"They're working on a UI refresh. That's probably been one of the pain points for us as it feels like a really old application."

"The UI is not that friendly and you need to learn how to navigate easily."

More Mend.io cons

Pricing and Cost Advice

"The solution's pricing is good and reasonable because you can literally use a lot of it for free."

"FOSSA is a fairly priced product. It is not either cheaper or expensive. The pricing lies somewhere in the middle. The solution is worth the money that we are spending to use it."

"Its price is reasonable as compared to the market. It is competitively priced in comparison to other similar solutions on the market. It is also quite affordable in terms of the value that it delivers as compared to its alternative of hiring a team."

"FOSSA is not cheap, but their offering is top-notch. It is very much a "you get what you pay for" scenario. Regardless of the price, I highly recommend FOSSA."

"The solution's cost is a five out of ten."

"As we were using an SaaS-based service, the solution must be scalable, although my understanding is that this is based on the licensing model one is using."

"When comparing the price of WhiteSource to the competition it is priced well. The cost for 50 users is approximately $18,000 annually."

"The version that we are using, WhiteSource Bolt, is a free integration with Azure DevOps."

"This is an expensive solution."

"Over the last two years, they have tried to add more and more features to their license packages, but the price is a little bit high, comparatively."

"Pricing and licensing are comparable to other tools. When we started, it was less than our existing solution. I can't go into specifics, but it isn't cheap."

"The solution involves a yearly licensing fee."

"WhiteSource is much more affordable than Veracode."

More Mend.io pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

814,649 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

28%

Computer Software Company

15%

Financial Services Firm

13%

Healthcare Company

Financial Services Firm

18%

Computer Software Company

16%

Manufacturing Company

12%

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about FOSSA?

I am impressed with the tool’s seamless integration and quick results.

See all answers

What is your experience regarding pricing and costs for FOSSA?

The solution's pricing is good and reasonable because you can literally use a lot of it for free. You have to pay for the features you need, which I think is fair. If you want to get value for free...

See all answers

What needs improvement with FOSSA?

If you have thousands of applications, organizing them all into teams or tags is challenging. There is a point where you start using FOSSA at a very large scale, and the user interface needs to adj...

See all answers

How does WhiteSource compare with SonarQube?

Red Hat Ceph does well in simplifying storage integration by replacing the need for numerous storage solutions. This solution allows for multiple copies of replicated and coded pools to be kept, ea...

See all answers

How does WhiteSource compare with Black Duck?

We researched Black Duck but ultimately chose WhiteSource when looking for an application security tool. WhiteSource is a software solution that enables agile open source security and license compl...

See all answers

What do you like most about Mend.io?

The best feature is that the Mend R&D team does their due diligence for all the vulnerabilities. In case they observe any important or critical vulnerabilities, such as the Log4j-related vulner...

See all answers

Comparisons

Black Duck vs FOSSA

Compared 45% of the time

Snyk vs FOSSA

Compared 17% of the time

JFrog Xray vs FOSSA

Compared 7% of the time

Fortify Static Code Analyzer vs FOSSA

Compared 6% of the time

Sonatype Lifecycle vs FOSSA

Compared 4% of the time

More FOSSA Competitors

SonarQube Server (formerly SonarQube) vs Mend.io

Compared 26% of the time

Black Duck vs Mend.io

Compared 15% of the time

Snyk vs Mend.io

Compared 9% of the time

Veracode vs Mend.io

Compared 8% of the time

GitHub Advanced Security vs Mend.io

Compared 2% of the time

More Mend.io Competitors

Product Reports

Buyer's Guide

FOSSA

November 2024

Download FOSSA product report

Buyer's Guide

Mend.io

October 2024

Download Mend.io product report

Also Known As

No data available

WhiteSource, Mend SCA, Mend.io Supply Chain Defender, Mend SAST

Learn More

Video not available

FOSSA

Mend.io

Overview

Up to 90% of any piece of software is from open source, creating countless dependencies and areas of risk to manage. FOSSA is the most reliable automated policy engine for legal teams to maintain license compliance, security to fix vulnerabilities, and engineering to improve code quality across the entire software supply chain. As the only developer-native open source management platform, FOSSA fully integrates with your existing CI/CD pipeline to provide complete visibility and context earlier in the software development lifecycle. For the first time, teams can collaboratively shift left and audit, analyze, control, and remediate license issues and vulnerabilities right in their existing workflows.

Mend.io is a software composition analysis tool that secures what developers create. The solution provides an automated reduction of the software attack surface, reduces developer burdens, and accelerates app delivery. Mend.io provides open-source analysis with its in-house and other multiple sources of software vulnerabilities. In addition, the solution offers license and policy violation alerts, has great pipeline integration, and, since it is a SaaS (software as a service), it doesn’t require you to physically maintain servers or data centers for any implementation. Not only does Mend.io reduce enterprise application security risk, it also helps developers meet deadlines faster.

Mend.io Features

Mend.io has many valuable key features. Some of the most useful ones include:

Vulnerability analysis
Automated remediation
Seamless integration
Business prioritization
Limitless scalability
Intuitive interface
Language support
Integration
Continuous monitoring
Remediation suggestions
Customization

Mend.io Benefits

There are many benefits to implementing Mend.io. Some of the biggest advantages the solution offers include:

Easy to use: The Mend.io platform is very user-friendly and easy to set up.

Third-party libraries: The solution eases the process of keeping track of all the used third-party dependencies within a product. It not only scans for the pure occurrence (also transitively) but also takes care of licenses and vulnerabilities.

Static code analysis: With Mend.io’s static code analysis, you can quickly identify security weaknesses in custom code across desktop, web, and mobile applications.

Broad support: Mend.io provides 27 different programming languages and various programming frameworks.

Easy integration: Mend.io makes integration very easy with existing DevOps environments and CI/CD pipelines so developers don’t need to manually configure or trigger the scan.

Ultra-fast scanning engine: The solution’s scanning engine generates results up to ten times faster than legacy SAST solutions.

Unified developer experience: Mend.io has a unified developer experience inside the code repository that shows side-by-side security alerts and remediation suggestions for custom code and open-source code.

Reviews from Real Users

Below are some reviews and helpful feedback written by PeerSpot users currently using the Mend.io solution.

Jeffrey H., System Manager of Cloud Engineering at Common Spirit, says, “Finding vulnerabilities is pretty easy. Mend.io (formerly WhiteSource) does a great job of that and we had quite a few when we first put this in place. Mend.io does a very good job of finding the open-source, checking the versions, and making sure they're secure. They notify us of critical high, medium, and low impacts, and if anything is wrong. We find the product very easy to use and we use it as a core part of our strategy for scanning product code moving toward release.”

PeerSpot reviewer Ben D., Head of Software Engineering at a legal firm, mentions, “The way WhiteSource scans the code is great. It’s easy to identify and remediate open source vulnerabilities using this solution. WhiteSource helped reduce our mean time to resolution since we adopted the product. In terms of integration, it's pretty easy.”

An IT Service Manager at a wholesaler/distributor comments, “Mend.io provides threat detection and an excellent UI in a highly stable solution, with outstanding technical support.”

Another reviewer, Kevin D., Intramural OfficialIntramural at Northeastern University, states, "The vulnerability analysis is the best aspect of the solution."

Sample Customers

AppDyanmic, Uber, Twitter, Zendesk, Confluent

Microsoft, Autodesk, NCR, Target, IBM, vodafone, Siemens, GE digital, KPMG, LivePerson, Jack Henry and Associates

Buyer's Guide

FOSSA vs. Mend.io

October 2024

Free Report: FOSSA vs. Mend.io

Find out what your peers are saying about FOSSA vs. Mend.io and other solutions. Updated: October 2024.

DOWNLOAD NOW

814,649 professionals have used our research since 2012.

See our FOSSA vs. Mend.io report.

See our list of best Software Composition Analysis (SCA) vendors.

We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.