Alright, let's settle a bet from our last retro. The CISO wants "actionable SBOMs" (whatever that means) for our compliance handshake with that big automotive vendor. My team's buried in legacy J2EE stuff that probably has dependencies on libraries older than some interns, so we need to generate these Software Bill of Materials things *and* get them out the door in a usable format.
We've been trialing both FOSSA and Mend (I still accidentally call it WhiteSource, sue me). Both find the scary stuff, sure. But when it comes to actually *exporting* a clean SBOM to toss over the wall to another party, my experience has been... divergent.
FOSSA's SPDX and CycloneDX exports feel like they were built for engineers who might actually have to *use* the output. The JSON is structured, the fields make sense, and I can actually trace a component back to its license without wanting to flip a table. Mend's export, on the other hand, sometimes feels like it was designed by a compliance bot from the year 2050 who hates humans. It's all there, but finding the specific relationship data can be like searching for a specific noodle in a spaghetti bowl.
My specific pain point? Getting a simple, component-level CycloneDX SBOM out for a single microservice, not the entire universe of our codebase. One tool made it a two-click affair. The other required a custom report configuration that made me question my life choices.
Anyone else been down this particular rabbit hole? I'm less interested in the vuln scanning bake-off and more in the "get this data out of the tool in a standard format without a PhD in JSON jujitsu" experience.
- Happy eval-ing
I'm a platform engineer at a mid-sized fintech (~200 devs) working on a mix of containerized Node microservices and some aging monoliths. We've had both FOSSA and Mend running side-by-side for about 18 months to cover our different compliance profiles.
**Core Comparison:**
1. **Export Schema Clarity:** FOSSA's CycloneDX exports are consistently flat, predictable JSON. I can write a simple parser for our vendor portal that reliably plucks a component's name, version, and license from `components[].purl` and `components[].licenses`. Mend's SPDX export has all the data, but license info is often nested under `hasExtractedLicenseInfos` or cross-referenced via `licenseConcluded` IDs, requiring extra logic. For a "toss over the wall" use case, FOSSA's output required about 40% less transformation code.
2. **API vs UI Workflow:** FOSSA treats SBOM export as a first-class API citizen. You can GET `/api/projects/{id}/sbom` with a `format=cyclonedx-json` param and pipe it directly into your CI/CD handoff. Mend's process, in my experience, is more UI-driven or requires their CLI tool, adding a step. If you're automating the "compliance handshake," FOSSA's endpoint model wins.
3. **Legacy Scannability:** For your old J2EE stack, Mend's agent-based scanning did pull out more deep, transitive dependencies from some ancient WAR files. However, that created its own noise problem - the SBOM was huge. FOSSA's analysis was more conservative, which actually resulted in a more "actionable" list for the vendor, even if it was theoretically less exhaustive.
4. **Pricing & Scaling:** Both are enterprise-y and you'll need a quote, but the scaling model differs. FOSSA's cost scaled more with the number of unique projects/repos we tracked, which was predictable. Mend's pricing at my last shop had elements that scaled with scan volume, which spiked unpredictably during major release cycles. If you have a high scan cadence, press them on that.
**My Pick:**
I'd recommend FOSSA for your specific case of generating clean, automated exports for a third-party vendor. Its API and straightforward schema mean you can probably wire it up in a week and forget it. If your CISO's real, unstated need is a *maximum* depth audit of every possible library for internal compliance, lean toward Mend - just brace for the data massaging. To decide cleanly, tell us: are you automating this export daily, and does your vendor's portal accept a raw SPDX tag-value file or *only* JSON?
Webhooks or bust.