IT AI Index
Index Vendors › Mend.io · September 2026 Edition
1 category · Ranked

Mend.io

97Judge labels
11First choices
21Negative labels
12 of 12Models named it
1Category
September 2026 Edition. Every number here is derived from the raw labels under vendor table vv2026-09.2, every buyer segment counted.
Best standing
14% in SCA for mid-market buyers
Rank 3 of 49 in the mid-market standingaccepted challenger
6 of 12 models made it the first choice on the direct prompt; 15% of its 34 labels there were negative.
By buyer segmentStrongest at mid-market.
In sca · each standing computed within its segment · bars are 0 to 100 · the accent bar is the product's own best reading

Standing by category

Every category where a model named Mend.io for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.
CategoryFunctionShareRankNegative rateLabelsQuadrant
Software composition analysisDeveloper platform14%3 of 4915%34accepted challenger

Movement

This is the first edition on this tier, so no move can be computed for Mend.io yet. From the next edition this section shows, per buyer segment, whether its share moved by more than the measured noise floor.

By model

How each model treated Mend.io across every prompt where it was named for a mid-market B2B company. Twelve models, six prompts per category.
ModelFirst choiceAlternativeMentionNegativeLabels
Claude Haiku 4.500202
GPT-5.4 mini11013
Gemini 3.5 Flash02002
Perplexity Sonar10102
Grok 4.1 Fast02114
Mistral Small11103
DeepSeek V4 Flash01113
Llama 4 Maverick10102
Qwen 3.7 Flash21115
Kimi K202114
GLM 4.7 FlashX11002
MiniMax M2.502002

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.
FramingLabels by classFirst choices
Direct30 labels8
Paraphrase2 labelsNone
Comparative27 labelsNone
Budget-constrained10 labels2
Scale-constrained14 labels1
Negative14 labels1not counted in share
First choiceAlternativeMentionNegative97 labels in all, every segment counted; 11 of the 12 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“Mend.io - Known for automated remediation and dependency updates, with an all-in-one subscription model and AI security features that enable 80% faster remediation.” Llama 4 Maverick · SCA · direct prompt · first choice
“Snyk, Mend.io (formerly WhiteSource), and Sonatype (Nexus IQ/Black Duck) are considered leaders due to their balance of speed, accuracy, and integration” Qwen 3.7 Flash · SCA · negative prompt · first choice
“Mend.io is often cited as the best overall choice for mid-market companies due to its automation and proactive approach.” Mistral Small · SCA · direct prompt · first choice
“the best SCA tool today is Mend.io (formerly WhiteSource)” GLM 4.7 FlashX · SCA · direct prompt · first choice

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

“reachability) works well for Java/JavaScript but poorly for Python, Go... Internal benchmarks claim "+46% better" remediation but lack external validation.” Kimi K2 · SCA · negative prompt · soft negative
“While not dead, it's worth noting the product was renamed/rebranded. The older WhiteSource brand may refer to outdated documentation and tools.” DeepSeek V4 Flash · SCA · negative prompt · soft negative
“paid tools like Snyk, Mend, or Sonatype may be better, but they're harder to justify on a tight budget” GPT-5.4 mini · SCA · budget prompt · soft negative
“Some false positives, UI/learning curve; early-stage AI features immature.” Grok 4.1 Fast · SCA · negative prompt · soft negative

Named alongside

The products named in the same answers as Mend.io, over the 97 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and Mend.io was named but was not.
ProductSame answerTook the first choice insteadHead to head
Black Duck81 of 9712Not in the top three
Sonatype Lifecycle70 of 9712Not in the top three
Endor Labs43 of 973Not in the top three
FOSSA33 of 970Not in the top three
JFrog Xray29 of 970Not in the top three
OWASP Dependency-Check28 of 972Not in the top three
Checkmarx SCA26 of 970Not in the top three
GitHub Advanced Security18 of 970Not in the top three
A head-to-head page exists where both products are in a category's top three. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named Mend.io. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, four of the twelve in this edition, so these counts come from 85 of the 97 answers that named Mend.io and are not a share of its labels.

Domains cited

endorlabs.com68
guideflow.com42
mend.ioYour site42
safeguard.sh39
cycode.com37
sonatype.com35
toolradar.com35
dupple.com33
ox.security31
aikido.dev27

347 of the 389 domain citations in answers naming Mend.io came from somebody else's page.

Pages cited

Pages are listed as the models cited them.

Names read as Mend.io

What the judge wrote, as written, with how often. The vendor table decides that these count as Mend.io; a claim can dispute any of them.
Mend 6Mend (formerly WhiteSource) 6Mend.io (formerly WhiteSource) 3Broadcom Mend (formerly WhiteSource) 1WhiteSource 1WhiteSource (now Mend) 1WhiteSource/Mend 1
Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Mend.io's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Mend.io, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

It does not get any change to labels, shares or verdicts, any preview, or any say over which quotes appear. A verification link goes to your work email; an address at mend.io is approved on the spot, any other address is reviewed by hand.

Your name and company appear on the claimed page, or the company alone if you ask below. A title and a LinkedIn address appear there too if you give them, and are left off if you do not. Your email address is never published.