We're scaling up our SCA. Currently using a mix of open-source scanners in GH Actions, but it's becoming a management nightmare for 200+ devs. Need something that integrates at commit, PR, and build, with decent policy enforcement.
Evaluating Mend (formerly WhiteSource) against Snyk and Checkmarx SCA. Priorities:
* **Pipeline integration** (GitHub Actions, Jenkins)
* **Remediation speed** - how fast can devs fix things?
* **Noise reduction** - can't have 1000s of false positives
* **License compliance** - automated, not manual.
Here's our current basic setup that's failing us:
```yaml
# github/workflows/sca.yml
- name: OSS Scan
run: |
trivy fs . --scanners vuln,license --severity CRITICAL,HIGH
```
This just dumps a list. No policy gates, poor deduplication.
**Key questions for those who scaled Mend:**
* How's the PR comment/break behavior? Does it block merges effectively?
* Is the Jenkins plugin stable for large monorepos?
* How painful is the initial policy tuning to cut noise?
Budget is a factor, but less than developer time wasted. Concrete workflow experiences appreciated.
cg
YAML all the things.
I'm a senior platform engineer at a 300-dev fintech, managing cloud and security tooling for our AWS/ECS/Jenkins stack. We ran Mend for about 18 months after outgrowing DIY scanners.
Core Comparison:
1. **Pipeline Integration & Stability**: Mend's Jenkins plugin is stable but heavy. For our large monorepo (one main service), the scan added 4-7 minutes to the build stage. The GitHub Actions integration is more reliable. PR comments are effective and can block merges based on policy, but the default settings will overwhelm you with comments.
2. **Noise Reduction & Policy Tuning**: This is the biggest upfront cost. Out of the box, Mend flagged ~70% of findings as high/critical for us, most being in transitive dev dependencies. It took us two months of dedicated tuning - creating component exclusion lists, adjusting severity per ecosystem, and setting license policies - to get actionable alerts. Now, only about 15% of PRs get a security comment.
3. **Remediation Speed**: Mend wins here for direct dependencies. The auto-generated PRs to bump vulnerable versions are fast and work well. For deeper transitive issues, it's slower. Their suggested fixes can be outdated or suggest major version jumps that break compatibility. Developers appreciated the direct PR fixes, but the complex chain issues still required manual intervention.
4. **License Compliance & Cost**: License compliance is automated and thorough, probably their strongest feature. Pricing is opaque but typically enterprise. We were quoted on a per-developer basis, which landed in the $25-40/user/month range for our size, significantly more than Snyk's transparent per-developer pricing. The hidden cost is the internal platform team time required for policy management.
Your Pick:
I'd recommend Mend if license compliance is your absolute top priority and you have the platform team bandwidth for a 2-3 month tuning period. If developer speed and pipeline friction are bigger concerns, look harder at Snyk. To make a clean call, tell us the size of your platform/security team dedicated to tool management and what percentage of your vulnerabilities typically come from direct vs. transitive dependencies.