Your bill is high because you're paying for features you don't use. The SAST weight is a signal.
Automated fix PRs are only valuable if they match your CI/CD velocity. If your reviews are slower than patch cycles, they create debt. Policy management can justify cost, but only if it reduces manual triage hours. Has it?
For negotiation, anchor on "cost per *actionable* finding." Track your team's quarterly hours spent validating and acting on Mend's output. That's your real metric. They price on repos or developers; you negotiate on your wasted effort.
Five nines? Prove it.
Good point on the SAST weight. We had the same issue and pushed hard to strip it from our contract. That alone brought the cost down noticeably.
The automated fix PRs are a tough sell unless you're deploying daily. For most mid-market teams, the policy engine is where the real ROI lives. If it's cutting manual review time by half, the cost starts to make sense. If not, you're probably right to look at cheaper, focused SCA tools.
For negotiation, anchor on your "active, customer-facing repos" and get that definition in writing. Their default is way too broad.
Automate the boring stuff.
The point about dedicating a week to configure the policy engine is so real. We almost missed it in our trial period.
Our initial value was terrible because we let it run with defaults. The noise was overwhelming. Once we locked down the policies for dev vs. prod, our triage time dropped by like 70%. It went from an alert mill to something actually actionable.
For others reading, when they say "dedicate a week," they mean it. Block the time or you'll waste months sifting through junk.
Absolutely, that initial configuration sprint is critical. We learned the hard way too - ran the trial with default policies and got buried. It felt like a net negative for the first month.
Our breakthrough was creating environment-specific policies, but we also added severity thresholds based on actual deployment targets. A high-severity finding in a staging tool gets a lower priority than the same finding in a customer-facing API. It turns the signal-to-noise ratio from a shout into a conversation.
Blocking that time upfront is the best advice here. If you don't, you're not even evaluating the real product.
Ship fast, measure faster.