Hi everyone! 👋 I've been using Mend (we still call it WhiteSource internally) for about a year now at my company (~300 people, B2B SaaS). We were looking to get a better handle on open-source security and licensing.
The onboarding was smooth and the findings are definitely eye-opening. It finds things our old methods missed. But I'm starting to wonder about the ROI.
Our bill feels significant for our size. We mostly use the SCA and license compliance parts. The SAST features we tried felt a bit heavy for our workflow. I'm curious: for other mid-market teams, do you feel the automated fix PRs and policy management justify the cost compared to, say, combining a few cheaper tools?
Also, has anyone successfully negotiated pricing? What are the key metrics they look at? Thanks for any insights!
I run the platform integrations team for a 450-person B2B fintech, and we've had Mend in production for about three years, running scans across ~200 microservices and our main frontend monorepos.
1. **Mid-market pricing is punitive.** Our annual bill sits just under $70k, and that's after a fight. They anchor heavily on "developer seat" count, which for them includes anyone who could commit code, not just active users. We got them down from quoting against 180 engineers to billing for 120, but that negotiation was brutal. Expect to pay $45-85k annually at your size, and the jump to the next tier is steep.
2. **Automated fix PRs are a 60/40 win.** They work reliably for straightforward dependency bumps in ecosystems like npm and Maven. For Gradle or multi-module projects, we had to write custom scripts to bridge the gap. They save maybe 15 hours a month of manual toil for our team, but that's only because we spent 40 hours tuning the rules to stop it from suggesting breaking changes.
3. **The policy engine is where you claw back value.** If you don't dedicate a week to configuring policies for license compliance and vulnerability severity by environment (prod vs. dev), you'll drown in noise. Once set, it genuinely automated our security gate for deployments. No other tool we trialed (Snyk, FOSSA) had policy rules this granular without needing full GitOps.
4. **Support and vendor lock-in are real friction.** Response time on standard tickets is 36-48 hours. You need a dedicated CSM to get engineering answers, and that's an enterprise-tier add-on. The bigger issue is the migration cost: their historical data and policy configurations are not portable. Leaving would mean losing your compliance audit trail, which for us is a non-starter now.
My pick is to stick with Mend for another year **only if** you have a dedicated platform/infra engineer who can own the policy configuration and you're in a regulated industry where audit trails matter. If those aren't true, a combo of Snyk Open Source and FOSSA for licensing will likely run you 40% less. Tell us your compliance requirements and how many hours a week your team currently spends manually reviewing dependency PRs.
APIs are not magic.
Your point about the policy engine is dead on, but let's not pretend that's a feature, it's a cost shift. You pay them a premium so you can spend a week of senior engineer time to build the guardrails that stop their own tool from creating chaos. That's not value, that's you paying them to fix their overly broad automation.
And the 15 hours saved per month only pencils out if you ignore the 40 hours of tuning and the ongoing script maintenance. In our case, we found that "custom scripting" for Gradle became a part-time job for a platform engineer. The total cost of ownership on that automation is often a net negative once you factor in the salary of the person babysitting it.
Anyone else find that the real negotiation lever isn't the seat count, but getting them to itemize what each part of the bundle actually costs? They hate that.
Buyer beware.