Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Mend.io, formerly known as Whitesource #securityvulnerability #coding

Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.

2025 OWASP Top 10 for LLM Applications: A Quick Guide

Published first as a whitepaper in late 2024, the 2025 OWASP Top 10 for LLM Applications is yet another monumental effort from OWASP made possible by a large number of experts in the fields of AI, cybersecurity, cloud technology, and beyond—including Mend.io Head of AI Bar-El Tayouri. LLMs are still new to the market but beginning to mature, and the OWASP Top 10 for LLM Applications is maturing alongside it.

Fake VS Code Extension on npm Spreads Multi-Stage Malware

In a recent discovery, our research team uncovered a fake VS-code extension—truffelvscode—typosquatting the popular truffle for VS-code extension. This extension serves as a trojan horse for multi-stage malware. This blog takes a closer look at how the malicious extension operates, its obfuscation techniques, and IOCs related to this incident.

The Truth Behind Successful Security Operations Centers (SOC) |Secrets of AppSec Champions

In this eye-opening episode, Reanna Schultz, an experienced Security Operations Center (SOC) team leader, pulls back the curtain on what makes a modern SOC truly effective. Drawing from her six-year journey through various cybersecurity roles, she reveals how SOCs serve as an organization's first line of defense against cyber threats.

AI Powered Remediation: Mend SAST Performs +46% Better Than Competitors

Security teams face limited resources and a growing attack surface while developers struggle with security responsibilities that feel burdensome, annoying, or seem to conflict with their first priorities. AppSec teams turn to static application security testing (SAST) tools to identify vulnerabilities in first-party code early in the software development lifecycle while developers can still fix issues before the code is old and forgotten about.

Mend.io and JetBrains Partner to Bring Enhanced Code Security to Developers

At Mend.io, we’re passionate about code security. That’s why we’re thrilled to announce a strategic partnership with JetBrains that integrates Mend.io’s robust security solutions directly into JetBrains IDEs and Qodana environments. With the help of Mend.io, JetBrains users will now have access to robust Software Composition Analysis (SCA) and malicious package detection.

Building Trust in Cybersecurity: Insights from Veteran CISO Rob Wood | Secrets of AppSec Champions

Trust is the invisible currency of business, and it's built in drops but lost in buckets. As security professionals, we often focus on competence - having the right controls, frameworks, and processes in place. But competence alone isn't enough when things go wrong. When a security incident happens, your customers' trust in you hangs in the balance. They're scared, frustrated, and looking for leadership. This is where benevolence and integrity become crucial.

How Ping Identity Automated Security & Cut Scanning Time from Weeks to Minutes with Mend.io

Join Bruno Lavit, Risk Manager at Ping Identity, as he shares how they transformed their application security process using Mend IO. Learn how Ping Identity went from time-consuming manual security scans to fully automated CI/CD pipeline integration, reducing scanning time from weeks to minutes. Ping Identity improved their security posture while accelerating software development. Perfect for AppSec managers, CSOs, and risk managers looking to enhance their security automation.

Mend Renovate Enterprise Cloud: Dependency Updates at Scale

If there’s one thing development and security teams can agree on, it’s that updating dependencies is a worthwhile endeavor. Keeping open-source dependencies up to date reduces bugs—both now and in the long run. And whether those bugs are security vulnerabilities or functional issues, everyone is happy to see them go.

How Yahoo Scaled Application Security & Saved Millions with Mend.io

Join Chris Madden, Distinguished Technical Security Engineer at Yahoo, as he shares how Yahoo scaled its application security program with Mend.io. In this insightful video, Chris details the challenges Yahoo faced in managing open source security and compliance risks, and how Mend.io's AppSec platform helped them: Discover how Mend.io enabled Yahoo to address critical vulnerabilities like Log4Shell, codify security policies, and achieve quantifiable benefits across their organization. If you're looking to improve your AppSec posture, especially at enterprise scale, this video is a must-watch!