Mend.io AppSec Platform

We are using Mend.io for open-source component scanning mainly, all third-party open-source components. This is especially for the software composition analysis. We do have a large number of supply chain-related vulnerabilities from the AppSec aspect. Using Mend.io, we scan all the dependency risk, and then we are able to understand the outdated packages. We are able to get the CVEs with respect to the open-source components. According to that, we will apply updating the packages to the latest patch. Then we clear all the dependency checks and identify all the libraries to which component is communicating to which component, whether we have a direct dependency or a transitive dependency. Then we update the software bill of materials for the vulnerability. The main purpose of using Mend.io is for the software supply chain security to identify and remediate the vulnerabilities which come across the open-source software components, especially dependency checks.

In my opinion, it is the best because with respect to the scan coverage. It is giving basically all the components whatever we are looking for and all the requirements we basically required. Comparatively to other tools, especially in terms of identifying and integrating into our DevSecOps primarily into our security, Mend.io is compatible with respect to integrating with our CI/CD, and then using that, we will be able to detect and fix the vulnerabilities. The coverage of integration is good across all the technologies it is supporting. In terms of noise ratio, comparatively it is less and gives a good, accurate number of issues. There are some gaps with respect to giving an exact vulnerability. However, we were doing some tuning of the tool with respect to helping to understand basically what we are expecting to scan, then what could be the output. In that aspect, the tool also has the option to tune the tool, and we can customize what our requirement is, and based on that, we can pull the scan. That is good.

We were able to integrate with our CI/CD pipelines. That is totally automated with respect to scan as well as updating the remediation.

At this moment, I would say Mend.io is working based on our requirements. But in future, if we start exploring more and moving towards the AI side, AI technologies, and then obviously the threats based on the vulnerabilities, the vulnerabilities which we identified in the past and the same vulnerability or CVE is repeating in the future, then how the data is analyzed by the tool and how it is giving the threat intelligence reports. That is more towards the AI apps. Obviously we need to look for that because at this moment we are not using for that purpose. But we need to explore that analytics part, how much it is capable of in terms of having the correct data and how much the capability the tool has so that it can give the threat intelligence reports, looking at the previous past data to get the results driven for the future requirements. We need to explore that. At this moment, without experimenting, I could not say whether this tool will be good or bad, but I am hoping this could support the analytics as well.

The key benefit of Mend.io is that we were able to automate and integrate this tool into our CI/CD, and we can scan. Basically, it can reduce the cybersecurity risk by identifying the risk and then fixing the vulnerable open-source components before they get exploited. We can integrate them into our CI/CD, and we can identify and fix the issues. It improves the compliance with respect to not only the component but also we can look at the license management aspect, policy enforcement aspect, then updating the bill of materials, generating the SBOM, and making sure that the vulnerability information is stored and that can give a future aspect of detecting early and giving the good results. Obviously, it can reduce our cost by lowering the remediation cost by finding and fixing the issue during the early stage of our SDLC. During the development life cycle itself, we can integrate these into pipelines as part of our DevSecOps integration. It will have a capability to support all the integrations within our DevSecOps. That will give us faster results and the ability to quickly find out the vulnerabilities and then fix them so that way we can reduce the cost. Proactively, we can pick up the vulnerabilities and then fix them rather than moving to the later stage of the software development life cycle.

With respect to the end-user perspective, we can directly integrate these into, for example, IDEs or maybe Git repositories and then CI/CD pipelines. We can automate all the dependencies. We can identify the issue and fix it, so that obviously reduces the manual effort. Based on the severity which it is giving, we can prioritize the exploitability of the vulnerability. We can understand the risk context. It will help us to focus on what matters most. That way, basically, both from the end-user perspective and as well as the business perspective, leveraging this tool definitely helps us to identify the vulnerability at the early stage of the software development life cycle and also be able to get it fixed. All the ways of development aspect as well as the business aspect, it is helping us as a tool to proactively manage vulnerability management very effectively to minimize the risk from the software supply chain.

With respect to improvements with Mend.io, as I mentioned, today it is not supporting the threat intelligence. Most of the time, basically, we are embracing the vulnerability and the software supply chain. But if we can have a more stronger threat intelligence integration, for example, more real-time exploit intelligence or maybe more attack campaign correlation, that would help us better understand how we can leverage this tool. This would help our teams to better understand the vulnerabilities being actively exploited in the wild. That intelligence if we can build up in Mend.io, we can accommodate it.

With respect to scoring, while leveraging Mend.io and we are scanning and doing all the exploitability analysis, the improvements would be how whether that given score is really meaningful, if it is flagging as a critical or high, whether that is really a meaningful severity, or do we need based on the asset criticality scoring to understand. And what is the business impact scoring? Those things basically, we need to feed the data so that we can prioritize. It is more important to understand how much priority I need to give to fix the issue. That prioritization we need to develop.

Then enhancing cloud-native security. For example, especially in the Kubernetes environment, we do have a large number of even open-source packages. In a container environment also, in a broader coverage model, how we can leverage the different type of scanners in the modern cloud environment. Leveraging Mend.io, how basically we can integrate this enhanced capabilities to integrate with the cloud-native security. That and all basically we need to build up into the tool.

The last but not least is AI security capabilities. Since organizations are increasingly adopting the AI, how Mend.io could help us further. For example, AI model security assessment, maybe LLM risk-related analysis, how it can, AI supply chain security. How we can leverage this tool and what kind of the aspects and the features Mend.io has, building a deeper AI security capabilities, so that should align with my business requirements. That aspect basically we need to improve the tool.

Then obviously reducing false positives. Obviously we need to see real defects instead of giving a large number of noise where actually my effectiveness and efficiency will get hampered. We need to improve more and more to reduce the false positive and give real threats. These and all basically we need to have some improvements on Mend.io.

It is not complex. I could say it is user-friendly.

We have both cloud as well as on-prem.

I would rate it as a ten. We always used to get the right support.

To be honest, I don't know how much pricing actually my organization is spending leveraging the tool, but what I got to know compared to other tools, this is good.

I would rate it as nine.

In terms of threat intelligence, at this moment, whatever the bill of materials we are giving, based on that, actually, with respect to enrichment, for example, looking at the CVE database and looking at the National Vulnerability Database, then some CVSS related information, that way basically it is giving us some vulnerabilities. But with respect to more on threat intelligence perspective, we also need to understand, it is important to understand that Mend.io is not a dedicated threat intelligence platform. If you look at the Microsoft Defender, maybe CrowdStrike intelligence or some other tools, maybe those are actually really threat intelligence platforms. Whereas Mend.io is not a really threat intelligence platform. But instead, we need to see how we can consume the vulnerability intelligence to improve our software supply chain security based on our decision so that we can leverage the tool. To conclude, the strengths of Mend.io that can give the threat intelligence, especially looking at the CVE database, looking at the National Vulnerability Database, then EPSS, for example, Exploit Prediction Scoring System, CVSS scoring system. Based on these, actually it is giving us the threats and as well as giving us the report. But really, we cannot completely say it is purely, at this moment we do have a threat intelligence capabilities, but we need to explore more on that aspect. I would rate this review as a ten overall.