Mend (formerly WhiteSource) vs. MergeBase: A Side-by-side Software Composition Analysis Tool Comparison

In May of 2022, longstanding SCA solution and leader in application security WhiteSource rebranded as Mend. Mend is still one of the most widely used SCA tools in the cybersecurity world and a common candidate when companies consider a new SCA solution—but is it right for you?

Choosing a software composition analysis tool is an important decision that will affect your cybersecurity for years to come. But since the product category is relatively new, it can be difficult to evaluate your options and understand what sets the best solutions apart. 

This comparison evaluates Mend and MergeBase on five capabilities that companies find most important when choosing an SCA tool. (If you’d like to see our analysis of all the major SCA solutions side by side, check out our SCA buyer’s guide.)

Mend vs. MergeBase: a side-by-side comparison

We’ve measured these tools’ competencies in the five most critical areas where a quality SCA tool needs to perform. This guide is based on our extensive industry experience, conversations with cybersecurity professionals, and our own research. 

The five core areas are: 

1. Developer guidance with compatibility check
2. Comprehensive SBOM support
3. Low false positives output
4. Integration to the DevOps process with runtime protection
5. Total cost of ownership

We’ll unpack these individual competencies in a moment, but here’s how Mend and MergeBase stack up against each other at a glance, on a scale of 1–5. These scores are based on each tool’s capabilities as of January 2023.

At this point, you should be asking, “Isn’t it a bit suspect for MergeBase to give themselves a perfect score?” 

Fair point, but there are a few good reasons for this: 

1. This scoring system focuses on the five areas that are absolutely vital to choosing a strong SCA solution. We arrived at these factors after countless conversations with IT security and development teams over the years: these are the ones that come up over and over. 
2. We could score all of these solutions across many more factors—like the size of the company’s internal research team, the number of integrations available, etc. However, getting reliable numbers for these factors is difficult to do, and even if we did get accurate numbers, they could change next week.
3. MergeBase was specifically built to master these five areas. When companies switch from another solution to MergeBase, it’s because of one (or several) of these factors.  
4. While MergeBase is strictly an SCA solution, other SCA tools like Mend are parts of much larger software security suites. With breadth of coverage comes a lack of focus. If we were to rate ourselves against everything that Mend does, our score would look a lot different—but we’re not playing their game.

Let’s look at how these two stack up against each other in detail.

Mend vs. MergeBase on developer guidance

At the bare minimum, an SCA tool should alert developers to third-party vulnerabilities in their applications. A more advanced SCA will not only point out the vulnerabilities, but also give your developers directions for patching them—which can drastically decrease the time it takes to fix them. 

When choosing an SCA solution, it’s important to acknowledge the level of guidance the tool will give your developers. A tool with top-tier guidance will tell your developers what their patch options are and whether or not the patches are compatible with your application—and some will even offer auto-patching and suppression management features. Here’s how Mend and MergeBase compare on this front:

We graded these tools’ developer guidance capabilities on the following five-point scale:

The MergeBase advantage: Not only does our tool provide information on each patch’s risks, compatibility, and popularity, but MergeBase can automatically implement safe patches for you—so your product and security teams can make informed decisions and move on.

Mend vs. MergeBase on SBOM support

The software bill of materials (SBOM) plays an essential role for both software companies and their enterprise customers. Organizations that deliver software applications face increasing regulatory and compliance pressures to produce a comprehensive SBOM: one that not only shows vulnerabilities and licenses, but also points out technical debt (portions of code that need future cleanup).

For enterprise customers, it’s more common to ask your vendor for an accompanying software bill of materials. But it’s also important to validate the SBOMs that these vendors provide—which an advanced SCA tool can help you do. Here’s how Mend and MergeBase stack up in this area:

We graded these tools’ SBOM support on the following five-point scale:

The MergeBase advantage: Although Mend allows you to export SBOMs for your applications (which can be helpful when selling into regulated industries), it falls short in terms of comprehensive SBOM support. On the other hand, MergeBase allows you to import and export multiple SBOM formats, and clearly delineates all dependency relationships between the components and subcomponents in your application. Plus, you can visually navigate your SBOM inside MergeBase, so you can see how your third-party code is nested and where any given vulnerability lies.

Mend vs. MergeBase on false positives

SCA false positives are just plain bad for business. In our 2022 report, The True Costs of False Positives in Software Security, 62.1% of surveyed technology leaders revealed that decreasing false positives is a higher business priority than increasing true positives. False positives waste valuable time and significantly hamper productivity on both development and security teams—and they can even harm relationships between teams. 

We ran both Mend and MergeBase against a set of applications with 511 known vulnerabilities to see how many they’d catch, how many they’d miss, and how many false positives they’d flag. Here’s how they stacked up:

We graded their ’ accuracy on the following five-point scale:

The MergeBase advantage: While Mend is a solid technical product, they tend to flag a great deal of false positives (up to ten times as many as MergeBase). One of the reasons we built MergeBase was to take on the problem of false positives in the SCA space—without missing true positives. By design, MergeBase is the most accurate SCA tool on the market today.

Mend vs. MergeBase on DevOps integration

Most SCA solutions claim to protect and integrate into your DevOps process. While both Mend and MergeBase integrate with your build pipeline and repository and support container scanning, only MergeBase offers binary application scanning and runtime protection. Here’s how these particular tools stack up against each other:

We graded these tools’ DevOps integration capabilities on the following five-point scale:

The MergeBase advantage: MergeBase is built on a Shift Left Security philosophy. Our SCA tool protects your build pipeline and runtime, integrates with your repository, and allows for both container and binary scanning—so you’re always aware of known vulnerabilities in your third-party code, whether it’s open source or licensed.

Mend vs MergeBase on total cost of ownership

Each SCA tool comes with a cost. This goes beyond the price you pay for the tool, though: you should also consider the cost of labor to use the tool. For example, a tool with a low subscription fee and a high false positive rate may end up costing you more in development time than a tool with a higher subscription fee and lower false positive rate.

Then there’s the pricing structure itself to consider. Some SCAs are transparent with pricing, others use complex formulas based on variable directional metrics, and others are entirely opaque. So when cross-evaluating SCA options, we looked for two factors:

1. Competitive pricing: The vendor uses transparent, straightforward pricing.
2. Labor savings: The tool has robust enough capabilities to reduce software supply chain security supply labor costs.

Here’s how Mend and MergeBase stack up:

We graded these tools’ total cost of ownership on the following five-point scale:

A note on Mend: We commonly hear professionals in the cybersecurity industry praise Mend for being a good company to work with: they’re transparent with their pricing and don’t tend to push hidden fees on their customers. They scored lower in this regard because of the amount of labor that goes into dealing with false positives—but in terms of pricing, they are rather competitive. 

The MergeBase advantage: Our pricing model is entirely transparent, with no hidden fees or limits—plus MergeBase saves labor with a low false positive rate, clear developer guidance, automatic patching, prioritization, and other remediation options.

Choose the SCA that’s right for you

Selecting the right SCA is critical to protecting your organization, and these five factors are the strongest indicators of how valuable an SCA tool can be to your organization. 

We built MergeBase so you can rapidly secure your software supply chain without slowing down your business.

For more information on this guide and to learn more about how MergeBase can help protect your software supply chain, please connect with us at info@mergebase.com. Or, if you’d like to see MergeBase in action, we’d love to show you a demo!