Mend

Mend.io (formerly WhiteSource Software) is a software composition analysis (SCA) and application security company. The company rebranded from WhiteSource to Mend.io in 2022. It is headquartered in Tel Aviv, Israel, with a significant presence in the United States.

Mend.io's primary product is an SCA platform that automatically identifies and remediates open-source security vulnerabilities and license compliance issues in software dependencies. The platform is used by development and security teams — DevSecOps buyers — primarily at enterprise organizations that need to manage risk in open-source components across their software supply chain. A key differentiator is automated remediation: rather than only flagging vulnerabilities, the platform can automatically open pull requests with dependency updates to fix identified issues.

The flagship product line covers SCA under the Mend SCA name, scanning codebases for known vulnerabilities (mapped to CVE databases) in open-source libraries. Mend also offers Mend Supply Chain Defender, focused on detecting malicious packages — a capability addressing the growing software supply chain attack surface. The company maintains a proprietary vulnerability database that feeds its detection engine.

Mend.io competes in the SCA and application security testing (AST) market against Snyk, Veracode, and Sonatype (makers of Nexus), among others. Snyk is the most direct competitor, also targeting developer-first SCA workflows. The sector has strong tailwinds from regulatory pressure around software bills of materials (SBOMs) and increasing scrutiny of open-source supply chain risk following high-profile incidents such as Log4Shell.

Mend.io was founded in Israel and its core R&D organization is based in Tel Aviv. The company's engineering and product teams are concentrated in Israel, while go-to-market functions operate primarily from the United States.