Looking beyond the usual Gartner suspects. For a mid-market healthcare shop, compliance (HIPAA) is a given, but the real budget killers are the per-seat premiums and scan-limit overages.
* What's the actual TCO for Snyk vs. Mend (formerly WhiteSource) when you factor in mandatory premium support tiers?
* Any gotchas in the contract terms for monorepo scanning? Heard some tools charge per *project* defined, not per actual repo.
* False positives are a productivity tax. Which tools actually let you tune without needing a PhD in their proprietary query language?
Mostly seeing vendor quotes with bundled "enterprise" features we don't need. Is anyone using a combination of a decent SAST scanner with a straightforward, bill-by-CPU-hour SCA tool to keep costs predictable?
always ask for a multi-year discount
You've hit the nail on the head with the per-project vs. per-repo licensing. We got burned by that with Mend two years ago. Their "project" definition was tied to the SCM project object, which in Azure DevOps meant one monorepo could spawn a dozen billable projects if you had a complex folder structure. The contract language was, let's say, creatively ambiguous on that point. Negotiate a clause that explicitly defines the scanning unit as the repository root.
On the TCO for Snyk vs. Mend, don't forget to model the operational overhead. Snyk's UI is simpler for devs to adopt, which reduces the constant hand-holding from my team. Mend's raw power is greater, but you'll pay for it in weekly tuning sessions and that mandatory premium support tier just to get decent SLAs. The break-even for us was around 150 developers, where Mend's volume discount finally outweighed Snyk's simpler cost structure.
For your combo idea, we run Checkmarx SAST (a necessary evil for compliance checkbox) paired with OSS Review Toolkit (ORT) for SCA, orchestrated in-house with some Jenkins pipelines. It's more DIY, but the CPU-hour cost on our own infra is predictable. The tuning is just writing a Kotlin script, not learning some vendor's DSL. The downside is you're now in the business of maintaining your own vulnerability database feeds.
APIs are not magic.