Mend.io
Mend.io scans open-source code and dependencies for security flaws and license risk.
On the record
Checkpoint: Next Gartner or Forrester AST/SCA report repositioning Mend versus Snyk, Sonatype, and AI-native rivals
The call
Mend.io survives on old enterprise contracts while GitHub bundles the same function for free and AI-native rivals chase the next generation of buyers.
Mend.io helps companies find and fix security problems in their code by scanning software dependencies for known vulnerabilities and license issues. The company is struggling because Microsoft's GitHub and the startup Snyk are both offering similar tools built directly into developer workflows, while newer AI-powered competitors like Endor Labs and Socket are automating the same vulnerability-detection work faster and cheaper. The one thing that could save Mend is if its new AI tools for managing regulated artificial intelligence systems (like compliance with EU rules) catch on with customers, but so far only 15 percent of its existing users have adopted those tools after a year and a half.
Why
01
AI pressure: Cycode, Endor Labs, Socket, Semgrep, and other AI-native scanning entrants. These tools use AI to find and even auto-fix vulnerable dependencies, commoditizing the CVE-matching work Mend built its business on. Could AI do the core job? Yes, likely.
02
Bigger players: GitHub Advanced Security (Microsoft) and GitLab. GitHub bundles dependency scanning straight into the platform developers already use, squeezing out standalone tools like Mend during renewals. Could a giant copy it? Yes, easily.
03
What protects it. Mend still holds real enterprise renewal contracts and workflow integrations that take time and effort to rip out.
What would change this call
Mend.io announces a new funding round or M&A/acquisition within 6 months. Would validate the AI-security pivot as investable rather than a legacy business running down.
Mend AI adoption crosses roughly 40% of installed base with a named EU AI Act customer by early 2027. Would show the AI-compliance pivot is becoming a real product seal, not a stalled feature.
Headcount at Mend.io continues declining in next Crustdata/UnifyGTM updates despite 'record growth' claims. Would indicate the legacy SCA business is shrinking under incumbent and AI-native pressure.
Mend AI adoption crosses roughly 40% of installed base with a named EU AI Act customer by early 2027. Would show the AI-compliance pivot is becoming a real product seal, not a stalled feature.
Headcount at Mend.io continues declining in next Crustdata/UnifyGTM updates despite 'record growth' claims. Would indicate the legacy SCA business is shrinking under incumbent and AI-native pressure.
Key numbers
- Headcount fell to 256, down 9% YoY
- No new funding round in 64 months
- Mend AI adoption at only 15% of installed base
Named risks
- No new funding round since April 2021 despite 64+ months elapsed, raising capital runway and exit-pressure concerns.
- Headcount decline (9% YoY to 256 by June 2026) contradicts claimed 'record growth,' suggesting internal strain or restructuring.
- GitHub Advanced Security and GitLab bundling compress standalone SCA demand, Mend's core legacy revenue base.
- Mend AI adoption stuck at only 15% of installed base 18 months after launch, unproven as a durable moat.
- Fell from Forrester SCA leaders to Challenger tier, signaling erosion of analyst-perceived competitive standing.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| GitHub (Advanced Security) | losing to | Bundled scanning ships alongside GitHub as of 2026, pressuring Mend's standalone SCA renewals per CB Insights, May 12, 2026 |
| Snyk | losing to | Described as developer-first SCA market leader with strong free tier versus Mend, per analysis dated March 12, 2026 |
| GitLab | losing to | Listed as a leader ahead of Mend's 'Challenger' status in CB Insights competitive matrix, May 12, 2026 |
| Cycode | contesting | Cited as AI-native platform leader in 2025 Gartner AST Magic Quadrant, pressuring Mend's AI-security positioning |
| Checkmarx | contesting | Markets itself directly as a Mend alternative on SAST/DAST/SCA breadth as of June 6, 2026; Mend counters on AI-stack coverage May 13, 2026 |
| Sonatype | contesting | Ranked ahead of Mend in prior Forrester SCA Wave rankings that demoted Mend from leaders by June 2023 |
Questions people ask
- Is Mend.io profitable or growing in 2026?
- Mend.io claims 20% year over year revenue growth and 25% new customer logo growth for the year preceding February 24, 2026, per its own newsroom release, though third-party trackers show headcount declining to 256 employees by June 2026.
- Has Mend.io raised any new funding recently?
- No. Mend.io's last disclosed round was a $75M Series D in April 2021 led by Pitango VC. As of June 19, 2026, Crustdata notes funding was 'last raised 64 months ago' with no new round reported since.
- Is Mend.io laying off employees?
- Crustdata reports Mend.io headcount fell from about 317 (Feb 2023) to 298 (Oct 2024) to 256 by June 19, 2026, a 9% YoY decline, though UnifyGTM separately reports 199 employees with 7.2% YoY growth, an unresolved discrepancy.
- Who is Mend.io's biggest competitor?
- Snyk is described as the developer-first market leader in the SCA space as of March 2026, while GitHub Advanced Security and GitLab ship bundled competing scanning tools that pressure Mend's standalone SCA business, per a CB Insights matrix dated May 12, 2026.
- Could AI replace Mend.io's core product?
- Mend.io's legacy dependency scanning, CVE matching, and license flagging are commoditizing fast via AI-native entrants like Cycode, Endor Labs, and Socket, per June 30, 2026 competitive analysis, pushing Mend to pivot toward AI-BOM and AI compliance tooling.
- Who owns Mend.io?
- Mend.io is privately held and venture-backed, formerly named WhiteSource before rebranding in May 2022. Its most recent investors include Pitango VC, Susquehanna Growth Equity, Poalim Equity, M12 (Microsoft's venture fund), and 83North, per its April 2021 Series D.
Timeline
- 2026-07-14Mend.io hires new CPO, EVP/GM of AI, and CRO; wins AI Breakthrough Award for AI Software Development Solution
- 2026-05-01Mend.io partners with GitHub to bring Mend Renovate Cloud to open-source maintainers
- 2026-03-01Mend.io expands global infrastructure with dedicated cloud region in India
- 2026-02-24Mend.io names Azi Cohen CEO, moves Rami Sass to GM of Mend AI, reports 20% YoY revenue growth
- 2025-07-31Mend.io launches Mend Forge, an AI-native innovation engine for AppSec R&D
- 2025-03-01Mend.io launches Mend AI and Mend AI Premium with AI-BOM and AI red-teaming features
- 2025-01-28Mend.io launches AI-automated remediation for Mend SAST
- 2023-12-19Mend.io acquires/merges with Atom Security
- 2023-06-01Mend.io falls out of leaders category in Forrester's SCA Wave
- 2022-05-25WhiteSource rebrands as Mend.io
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Mend.io Expands Leadership to Advance AI Security (2026-02-24)
- Mend.io - Headcount, Funding & Open Jobs (2026-06-19)
- Sonatype, Snyk, Synopsys Top SW Comp Analysis Forrester Wave (2026-06-25)
- Products, Competitors, Financials, Employees, Headquarters Locations (2026-05-12)
- Mend.Io Named A Visionary In The 2023 Gartner Magic Quadrant (2025-08-29)
- Whitesource Rebrands As Mend (2022-05-25)
- Companies using Mend.io and its marketshare (2026-07-10)
- Management and Employees List (2026-06-19)
- Mend Company Profile (2024-06-24)
- Mend.io Launches Highly Accurate AI Remediation for Mend SAST (2025-04-28)
- Mend.io Launches Mend AI (2025-04-28)
- Mend.io Unveils Mend Forge to Tackle AI Era AppSec Challenges (2025-08-01)