Dependency Security · pricing · Updated September 2026
Mend (formerly WhiteSource) pricing (2026)
Mend (formerly WhiteSource) publishes no monthly price — its published figure is on another basis (annual-only, non-USD, or one-time) as checked on 2026-09-27, read from Mend (formerly WhiteSource)'s own pricing page; 3 plans. Best for enterprise AppSec programs. Every figure below links to its source and the date we captured it.
At a glance
- Entry price: not priced monthly
- Free tier: No
- Compliance: HIPAA — · SOC 2 Yes · GDPR Yes
- Best for: enterprise AppSec programs; automated dependency hygiene; AI code security; Java/.NET heavy teams
As of · every figure below links to its source
Mend (formerly WhiteSource) plans & pricing
| Plan | Monthly | Annual | Billing | Notes | Source |
|---|---|---|---|---|---|
| Mend AppSec | not priced monthly | — | Per user / seat | Up to $1,000/developer/year (billed annually), quote-driven so no fixed monthly price. Includes SAST, reachability-driven SCA, container scanning, AI-generated code security, AI-powered remediation, automated dependency updates. No per-scan or per-project fees. | mend.io |
| Mend AI | not priced monthly | — | Per user / seat | Up to $300/developer/year (billed annually), quote-driven. AI component discovery (AI-BoM), system prompt hardening, automated red teaming, runtime guardrails, continuous AI governance. | mend.io |
| Mend Renovate Enterprise | not priced monthly | — | Per user / seat | Up to $250/developer/year (billed annually), quote-driven. Automated dependency management, full-scale automation, Merge Confidence ratings, dedicated support. | mend.io |
Last verified 2026-09-27. Pricing re-verified at mend.io/pricing on 2026-06-18. All three products are list-price maximums ('up to $X/dev/year') with actual cost quote-driven, so no monthly price is recorded. Compliance from mend.io/trust: SOC 2 Type II (Schellman), ISO 27001/27017/27701, GDPR; HIPAA not mentioned. Re-verified 2026-09-02 against the live pricing page; published figures unchanged.
Price changes
No change record has cleared two sources yet, so nothing is published on the wire.
Capabilities
Integrations: GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, Jira, ServiceNow, Docker, JFrog Artifactory, Microsoft Defender for Cloud.
Key features: Reachability-driven SCA to surface only exploitable vulnerabilities; Automated dependency updates via Mend Renovate (open-source core); AI security for AI-generated code and AI component governance; Unified SAST + SCA + container scanning under one per-developer price.
Plan limits: No per-scan or per-project limitations; No per-GB fees; Contributing developer = any employee/contractor accessing the UI or writing/modifying scanned code; Published prices are maximums; actual quotes may be lower.
Frequently asked questions
Does Mend (formerly WhiteSource) support HIPAA?
Mend (formerly WhiteSource)'s public pages do not say whether it supports HIPAA. Its public pages also state SOC 2 and GDPR compliance.
Does Mend (formerly WhiteSource) have a free plan?
No — Mend (formerly WhiteSource) publishes no free tier.
Mend (formerly WhiteSource) vs alternatives
Compare all dependency security · SOC 2-certified dependency security · Open data · MCP
More dependency security tools
Related categories
Display this standing
Mend (formerly WhiteSource) currently holds a silver deskmark here — Rank 3 of 6 · Dependency Security. Anyone may show it. There is nothing to apply for, nothing to pay, and displaying it changes no score: the standing comes from the published algorithm and money never touches it.
The image is drawn from our live data, so it follows the standing rather than freezing it: if Mend (formerly WhiteSource) moves up or down a tier, the plaque on your own site says so at our next publish. Nothing is tracked beyond the ordinary web-server log that records any image request.