Draft:Mend.io

• Comment: press releases are not independent sources. Theroadislong (talk) 08:38, 20 April 2025 (UTC)

---

Mend.io, formerly known as WhiteSource, is a privately held software security company specializing in application security and open-source software security. Founded in 2011 by Rami Sass, Ron Rymon, and Azi Cohen, the company is dual-headquartered in Tel Aviv, Israel, and Boston, Massachusetts. Mend.io provides an application security platform that helps organizations detect and remediate vulnerabilities in both open-source components and custom code. It has been described as a pioneer in open-source security and software composition analysis (SCA) solutions, and has expanded its offerings into broader application security including static application security testing (SAST), container security testing and AI security.

History

WhiteSource was founded in 2011 by Rami Sass (CEO), Ron Rymon, and Azi Cohen with the goal of automating open-source component management for security and compliance. The company’s software composition analysis tool gained adoption among enterprises for helping developers track open-source libraries, licensing, and known vulnerabilities without slowing development. By 2018, WhiteSource had over 500 customers, including 23% of Fortune 100 companies, and offices in Tel Aviv, New York, and Boston.

In October 2018, the company raised a $35 million Series C funding round led by Susquehanna Growth Equity with participation from 83North and Microsoft’s M12 venture fund, bringing its total funding at the time to $46 million. In the years following, WhiteSource broadened its focus beyond dependency scanning, acquiring multiple companies to add automated dependency updating and static code analysis capabilities.

In April 2021, WhiteSource acquired Diffend, a software supply chain security startup focused on detecting malicious open-source packages. The same year, WhiteSource closed a $75 million Series D investment led by Pitango Growth, with participation from existing investors M12, Susquehanna, and 83North. This brought the company’s total funding to over $120 million.

By early 2022, WhiteSource had added static code scanning to its platform. In February 2022, it acquired two European application security startups: Xanitizer (Germany) and DefenseCode (Croatia), enabling static application security testing (SAST) for proprietary code. These acquisitions marked WhiteSource’s expansion from open-source scanning into vulnerability detection for internal codebases.

In May 2022, the company rebranded as Mend (stylized as Mend.io), reflecting its evolution into a broader application security platform centered on automated remediation. Alongside the rebranding, Mend launched what it described as the industry’s first platform to offer automated remediation for both open-source and custom code vulnerabilities. CEO Rami Sass explained that the new name symbolizes the company’s goal to help developers “fix” vulnerabilities efficiently by integrating security automation into developer workflows.

In December 2023, Mend acquired Israeli startup Atom Security, a container security firm specializing in agentless reachability analysis. The acquisition price was not disclosed but was reported as “several million dollars.” The Atom Security deal was Mend’s fifth acquisition in a span of three years.

As of 2024, Mend.io reports over 1,000 customers worldwide, including approximately one-quarter of the Fortune 100. Its client base includes global enterprises such as Microsoft, IBM, Comcast, and KPMG. The company also maintains a network of channel and technology partners to help scale and integrate its solutions across industries.

Products and Services

Mend.io offers an integrated application security platform that includes several major components:

Software Composition Analysis (SCA)

Mend.io’s original offering is a Software Composition Analysis (SCA) tool that scans open-source dependencies in software projects for known vulnerabilities and license compliance issues. The company maintains a large vulnerability database covering millions of open-source components across more than 200 languages. The platform can automatically generate pull requests to fix vulnerable libraries, an approach pioneered by WhiteSource to reduce the remediation burden on developers. This feature helps minimize alert fatigue by offering guided, one-click fixes to developers.

Static Application Security Testing (SAST)

After 2021, Mend.io expanded into proprietary code scanning through the acquisitions of Xanitizer and DefenseCode. The resulting SAST capabilities analyze source code or binaries for common vulnerabilities, including SQL injection and cross-site scripting (XSS). In 2022, Mend announced it was the first platform to offer automated remediation for SAST findings—providing developers with suggested code patches for vulnerabilities in proprietary code. This remediation-first approach is intended to accelerate vulnerability resolution within development workflows.

Software Supply Chain Security

Mend.io’s supply chain security tools help protect against threats in open-source ecosystems. The Supply Chain Defender module—based on Diffend’s technology—can detect and block risky open-source packages before they are integrated into builds. For example, Mend's plugin for JFrog Artifactory can prevent the inclusion of suspicious npm or Ruby gems that may contain malware or are part of typosquatting attacks. These capabilities gained urgency after incidents like the SolarWinds attack. Mend combines supply chain data with SCA and SAST results to provide a holistic view of application risk.

Container and Cloud-Native Security

Following the 2023 acquisition of Atom Security, Mend.io introduced container security features under its platform, sometimes referred to as “Mend Container.” Atom’s agentless reachability analysis enables Mend to prioritize vulnerabilities in container images based on runtime likelihood—without requiring runtime instrumentation.

Mend AI

In June 2024, Mend launched Mend AI, a product focused on securing artificial intelligence components within software. Mend AI can automatically discover and catalog AI/ML assets such as pre-trained models, AI frameworks, RAGs, and AI agents. The tool analyzes each component for licensing, known vulnerabilities, and other security or compliance risks. Mend AI produces an “AI Bill of Materials” (AI-BOM), giving organizations visibility into AI software elements and enabling them to apply governance and security policies.

Platform Integration and Developer Workflow

Mend.io emphasizes automation and seamless integration into development workflows. Its platform offers connectors for GitHub, GitLab, Bitbucket, Azure DevOps, and CI/CD tools, embedding security into the software development lifecycle. By prioritizing actionable results and fix automation, Mend aims to help developers and DevOps teams address vulnerabilities without disrupting productivity.

Acquisitions

Mend.io (formerly WhiteSource) has expanded its technology portfolio through several strategic acquisitions:

• Renovate (2019): In November 2019, WhiteSource acquired Renovate, an open-source dependency update tool developed by Rhys Arkins. Renovate automates the process of detecting outdated libraries and creating pull requests to update them. WhiteSource made the tool's commercial features freely available and rebranded it as WhiteSource Renovate. The acquisition added automated dependency management capabilities to WhiteSource's SCA product, helping developers proactively reduce risks from outdated components.

• Diffend (2021): In April 2021, WhiteSource acquired Diffend, a stealth-mode startup focused on software supply chain security. Diffend developed technology to detect malicious or anomalous open-source packages, such as typosquatting attacks or hidden malware. Its features became the basis for Mend’s supply chain security module (often referred to as Mend Supply Chain Defender). The acquisition addressed increasing concerns over supply chain attacks and enabled Mend to vet open-source components before use.

• Xanitizer (2022): In January 2022, WhiteSource acquired Xanitizer, a German company known for high-precision static application security testing (SAST). Xanitizer specialized in low-false-positive detection of code vulnerabilities in languages such as Java and C#. The acquisition provided WhiteSource with a mature SAST engine and supported its transition into proprietary code scanning.

• DefenseCode (2022): In early 2022, WhiteSource also acquired DefenseCode, a Croatian application security company.

• Atom Security (2023): In December 2023, Mend.io acquired Atom Security, an Israeli startup specializing in container security. Founded earlier in 2023, Atom developed an agentless reachability analysis engine that predicts which vulnerabilities in container images are likely to be triggered during runtime—without requiring runtime instrumentation. The deal was valued at “several million dollars” and marked Mend’s fifth acquisition in three years. Atom’s co-founders joined Mend, with co-founder Bar-El Tayouri becoming Head of Mend AI following the acquisition. Atom’s technology was integrated into Mend’s container security products, enhancing prioritization of exploitable vulnerabilities.

These acquisitions supported Mend’s strategy to offer a unified and comprehensive application security platform. Renovate improved developer maintenance workflows; Diffend addressed supply chain risks; Xanitizer and DefenseCode expanded into proprietary code security; and Atom Security bolstered cloud-native and container security. The company reportedly invested “tens of millions of dollars” across these acquisitions.

See also

• Software composition analysis
• Static application security testing
• Software supply chain
• Application security