Mend.io (formerly WhiteSource) is an open source security and license compliance platform. According to its official introduction, traditional application security misses AI risks, while standalone AI security tools are disconnected from code. Mend.io seeks to bridge this gap with unified security for AppSec and AI, with the goal to "harden logic, protect code, automate the rest," providing unified governance for the software teams write and the AI they build.
I. Purpose and Positioning The official statement points out that the attack surface has changed, but most security tools have not kept up. AI components, open source dependencies, and agents in production environments introduce risks that traditional developer security tools cannot discover, test, or govern. Mend.io is positioned to address supply chain blind spots: modern codebases contain thousands of open source packages, AI models, and agents, many of which have not undergone security review; if you cannot inventory them, you cannot prioritize risk. At the same time, AI agents are non-deterministic, and prompt changes, model updates, or new input paths may introduce vulnerabilities that did not exist in the previous round of AI security scanning, which static tools cannot capture. In addition, static analysis and pre-deployment scanning cannot prevent runtime exploitation; injection attacks and behavioral abuse occur in production environments, while compliance pressures (such as the EU AI Act, Executive Order 14028, and the Cyber Resilience Act) require verifiable technical evidence proving that software and AI systems have been inventoried, tested, and protected.
II. Main Capabilities The platform claims to provide full-stack software and AI visibility, able to present every component in the codebase—packages, AI models, agents, system prompts—including shadow dependencies missed by standard tools, and to continuously update SBOM/AI-BOM for security and compliance teams to use. For dynamic AI risks, it provides continuous AI behavior testing: running automated attack simulations before every build release, covering injection, data leakage, and AI-specific vectors. For runtime risks, it provides runtime in-app protection: enforcing behavioral controls between users and applications, monitoring real-time interactions, enforcing policies, and blocking unsafe behavior, proactively and continuously without relying on patch cycles. For compliance, it provides a single evidence layer that aggregates inventories, findings, test results, and remediation status into a unified governance workflow, forming a structured, auditable record.
III. Specific Feature Items The officially listed features include: CRA attestation, NIST attestation, model discovery, system prompt hardening, AI risk ranking, AI security testing, runtime guardrails, SCA+SAST+DAST, secret detection, reachability analysis, automatic remediation, contextual guidance, policies and build gates. The platform also emphasizes unified AppSec across the SDLC, including SCA, SAST, Renovate Enterprise, and AI; and can automate dependency updates to keep dependencies healthy.
IV. How to Use The materials only provide the official website https://www.mend.io/ , no specific installation commands, code examples, or step-by-step operating procedures are provided, so usage instructions are not yet available. The text mentions integration with CI/CD and code repositories, as well as policy enforcement and build gates, but does not provide detailed configuration instructions.
V. Applicable scenarios and user feedback It is suitable for AI security, application security, and dependency management, aimed at security and development teams, with the goal of reducing tool fragmentation and lowering remediation workload. Official citations of user evaluations state that after use, production vulnerabilities were reduced by about 80%, open source audits were shortened from about one week to 15 minutes, remediation time was reduced by at least 80%, CVEs can be automatically discovered, and it helps achieve "shift left," identifying and fixing open source dependency (SCA) and custom code (SAST) vulnerabilities during the development cycle; reachability analysis helps prioritize exploitable vulnerabilities and reduce developer fatigue.
VI. Limitations and information not provided The materials do not provide specific pricing, fees, free trials, supported platforms, deployment methods, language support scope, or content related to Chinese regulations. Regarding compliance capabilities such as CRA and NIST, the applicable scope and specific implementation details are not expanded upon. The above content is organized solely based on the official text, and any facts not provided are marked as not yet available.
