After 18 months of using Mend (formerly WhiteSource) as our primary SCA tool, our team has reached a consensus on its strengths and significant frustrations. We implemented it to automate vulnerability remediation and maintain license compliance across a large Java and JavaScript microservices portfolio.
Here’s a breakdown of our experience.
**What we loved:**
* **Remediation automation:** The ability to automatically create pull requests with suggested dependency upgrades was a major time-saver. It integrated cleanly with our GitHub Enterprise workflow.
* **Comprehensive vulnerability database:** The breadth and update frequency of its database gave us confidence we weren't missing critical CVEs. The prioritization based on actual reachability in our code was valuable.
* **License compliance clarity:** The policy engine for licenses worked well. Generating compliance reports for legal was straightforward and reduced manual review.
**What made us consider switching:**
* **Alert fatigue and noise:** Despite tuning policies, we received a high volume of alerts for vulnerabilities in development dependencies or transitive dependencies with no actual execution path. The signal-to-noise ratio became a persistent management issue.
* **UI and performance bottlenecks:** Navigating the product's interface, especially when dealing with hundreds of projects, felt slow. Certain batch operations, like applying a policy change across multiple repositories, were clunky.
* **Integration friction with our CI pipeline:** While the basic integration worked, more advanced CI pipeline scenarios (like monorepos with complex builds) required custom scripting that felt unsupported. This increased maintenance overhead.
Our overall health score for the tool would be mixed. It delivers on core SCA promises but introduces workflow inefficiencies that have led us to evaluate alternatives. We are now specifically looking at tools that offer more granular control over alerting and provide a faster, more developer-friendly interface.
I'm curious if other long-term users have hit similar pain points, and if so, how you've addressed them.