Hey everyone 👋
I'm helping a small dev team (8 people) pick a security tool. We're looking at Mend (WhiteSource) and GitHub Advanced Security (GHAS). We're a SaaS company, mostly web apps.
I've seen the big feature lists, but I'm stuck on actual numbers. For a team our size, what does the pricing *really* look like for each? Are we talking per-repo, per-developer, or per-scan? Also, what's the setup time like? Days or weeks?
Any real-world experience on which one felt less overwhelming to get running? Our main goal is catching critical vulnerabilities without creating a ton of extra work.
We're a 12-person dev shop building cloud platforms for fintech clients. We trialed both Mend and GHAS before landing on GHAS for our 40+ repos.
**Real Pricing:** GHAS was roughly $70 per developer per month for us, all-in on the Enterprise Cloud plan. Mend quoted us on a per-repository basis, which came out to around $3k-$4k annually for our private repos. Mend's pricing gets complex fast if you have a mix of public and private.
**Setup Time:** GHAS took an afternoon. Turn on the features in org settings, push a PR with a basic codeql.yml, and you're getting findings. Mend took over a week of back-and-forth with their onboarding to get agents configured and scans integrated into our CI pipelines.
**Critical Findings Workflow:** GHAS wins here because the alerts live inside the GitHub UI, in the Security tab and on the PR itself. For a small team, that's zero context switching. Mend's findings are in their dashboard, which adds a separate tool to monitor.
**The Honest Limitation:** GHAS is good at what's in your GitHub repo. If you need deep license compliance or scanning for non-code artifacts (containers, infrastructure configs) as a first-class citizen, Mend is more feature-complete. GHAS feels like a security linter; Mend feels like a compliance platform.
I'd pick GHAS for a small SaaS team focused on critical vulnerabilities in web app code with minimal overhead. If your legal team is already asking for detailed SBOMs and license reports, lean toward Mend.