Mend vs Apiiro for a Node.js project - integration and alert fatigue

I've been conducting an evaluation of SAST and SCA tooling for a large, multi-service Node.js monorepo (using pnpm workspaces) and have narrowed the field down to two finalists: Mend (formerly WhiteSource) and Apiiro. While both platforms promise comprehensive dependency scanning and security analysis, I'm encountering significant friction points that go beyond the standard feature comparison matrix. My primary concerns are rooted in the practicalities of integration into existing CI/CD pipelines and the management of alert fatigue, which in my experience is where these tools truly succeed or fail.

The integration models differ substantially. Mend offers a more traditional, pipeline-embedded scanner via its unified agent or CLI, which is straightforward but adds a non-trivial time overhead to our PR builds. Apiiro's "shift-left" approach, with its IDE plugins and pre-commit hooks, is conceptually appealing, but its deep integration requires a heavier commitment to the Apiiro platform for risk assessment, which introduces a new layer of vendor lock-in. For our team, which uses GitHub Actions, the integration code looks something like this for Mend:

```yaml
- name: Mend Scan
uses: mend-scan@v2
with:
apiKey: ${{ secrets.MEND_API_KEY }}
productToken: ${{ secrets.MEND_PRODUCT_TOKEN }}
configFile: './.mend/mend.yml'
```

Apiiro, conversely, pushes for a model where the pipeline notifies its platform of changes, and the analysis happens asynchronously, which changes the feedback loop dynamics.

My second, and more pressing, issue is alert fatigue. Initial scans with both tools on a moderately complex service yielded the following:

* **Mend:** Flagged 1,247 vulnerabilities. After applying their auto-policy filters (ignoring low severity for dev dependencies, etc.), this dropped to ~400. Manual review revealed ~60% were in transitive dependencies of packages we use for development and testing only, with no path to runtime execution.
* **Apiiro:** Reported 938 "risks," but its context-aware analysis bundled many CVEs under a single "package risk" finding. However, it also introduced ~200 "code security" findings (hardcoded secrets patterns, weak crypto patterns) of which a staggering 80% were false positives based on trivial regex matches in our test fixtures and mock data.

The question for the community is not which tool finds more vulnerabilities—they both find an overwhelming number—but how they enable a team to *manage* the deluge. I'm particularly interested in:

* **Monorepo Granularity:** How effectively do their policy engines allow you to suppress or prioritize findings on a per-workspace or per-service basis within a single repository?
* **Noise Reduction Workflow:** Beyond simple severity filters, what mechanisms exist for automatically triaging findings based on context (e.g., dependency scope: `devDependencies`, absence of execution path, presence of mitigating controls)?
* **Integration Overhead:** Real-world experience on the stability and performance impact of their CI plugins/agents in large Node.js projects.

I have my own data from this PoC, but I'm keen to hear from teams that have scaled either tool beyond the pilot stage. The marketing materials all claim to solve alert fatigue, but the architectural and configurable levers they provide tell a different story.