Hi everyone,
I’m starting to evaluate Mend (formerly WhiteSource) for our AWS/Kubernetes environment, and I’d like to design a meaningful proof-of-concept. We’re a mid-sized team using Terraform for IaC, GitHub Actions for CI/CD, and have a mix of containerized Node.js/Go services and some serverless Lambda functions.
I want to move beyond just a vulnerability scan of a single repo. What real-world scenarios and integrations should I prioritize testing to see if it fits our workflow? Here’s what I’m thinking so far:
**Core areas for the PoC:**
* **CI/CD Integration:** Testing Mend’s GitHub Action or Jenkins plugin to see how it behaves on PRs and breaks the build on critical issues.
* **Infrastructure as Code:** Can it scan our Terraform modules for security misconfigurations, not just application dependencies?
* **Container & Serverless:** Scanning Dockerfiles and Lambda layers during the build process, and checking runtime insights if possible.
* **Remediation Workflow:** How easy is it to generate a fix PR or suppress a false positive? The developer experience is key.
I plan to run it against:
* A representative service with a known, old vulnerable dependency.
* A Terraform module that provisions an S3 bucket or EKS cluster.
* A Docker build with a base image that has CVEs.
What am I missing? For those who’ve been through this evaluation, were there any specific tests that revealed a deal-breaker or a standout feature? I’m particularly interested in how it handles prioritization and noise reduction in a cloud-native context.
Thanks in advance for your insights.
-- Amy
Cloud cost nerd. No, I don't use Reserved Instances.
Great starting list! Your focus on the developer experience for remediation is spot on - that's often where these tools succeed or fail in adoption.
I'd push you to make the **false positive suppression** test a top priority. Run it against a library your team knows is safe but that Mend flags. How many clicks does it take for a developer to mark it as approved? Can you easily apply that rule across all projects? If it's a hassle, engineers will start ignoring alerts.
Also, don't just test the GitHub Action in isolation. Mock up a scenario where a critical vuln is found in a PR - does the Mend comment clearly show the fix path, or is it just a scary block? You want the tool to guide the action, not just stop the line.
Good luck with the evaluation!
Automate everything
You're right about the false positive workflow, but I'd add that you need to test the *reverse* as well: what happens when a suppressed item becomes truly dangerous due to new CVSS data? The tool should re-alert you with high visibility, not just update a buried dashboard. I've seen teams get burned because their "approved" exceptions weren't periodically re-evaluated.
Also, for the PR scenario, check if Mend can show the fix *version* directly in the PR comment. Some tools just say "vulnerability in library X" and leave the developer to hunt for which non-breaking minor patch actually resolves it. That extra minute of friction adds up across a large team.
Right-size or die
Your representative service with a known vulnerable dependency is the perfect test. Don't just see if Mend finds it - time how long it takes from the scan finishing to a developer having a clear, actionable fix.
Can they immediately generate a pull request with the exact version bump that resolves it? Or do they get a report that sends them searching through changelogs? If it's the latter, your team will dread every alert.
Oh, the reverse alert point is so important, and it's something I'd never have thought to test. It makes me wonder, what's the actual alert mechanism? Does it just pop back onto a dashboard, or does it trigger a new ticket/PR comment/Slack message for the team that originally suppressed it? A buried dashboard update defeats the whole purpose.
Also, totally agree on the fix version in the PR comment. That minute of friction feels huge when you're trying to keep a PR moving. Have you seen tools that are actually good at this? I'd love some names to check out.