FossID Workbench vs Mend SCA
FossID Workbench
fossid.com
Mend SCA
mend.ioSide by side
| Figure | FossID Workbench | Mend SCA |
|---|---|---|
| Price from | — | $20.83/mo |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 3 |
| Spec score · Software Composition Analysis Software | 8.2 (#12) | 8.6 (#6) |
| Spec score · Dependency Management Software | 8.2 (#8) | 8.5 (#6) |
| API | The Workbench API supports custom workflows for scanning, gating, and notifying. | Mend API 3.0 is REST-based, uses organization JWT tokens that expire after 30 minutes, supports cursor pagination and has searchable REST documentation. |
| Founded | 2016 | 2011 |
| Headquarters | Stockholm, Sweden | Givatayim, Israel |
| Integrations | Workbench can import code from GitHub, GitLab, and Bitbucket, and supports CI/CD workflows, a Workbench Agent, and an API for custom scans, gates, and notifications. | The integrations page lists GitHub, GitLab, Bitbucket, Azure DevOps, Jira, ServiceNow, Jenkins, Docker, JFrog Artifactory and several IDEs. |
| Intended users | FossID describes its tools for engineering, DevSecOps, compliance, legal, and audit teams, and says it is trusted by enterprise software teams. | Mend positions SCA for developers and security and legal teams managing open source security and compliance risks. |
| Purpose | FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases. | Mend SCA identifies, prioritizes and remediates security and license risks in applications’ open source components. |
| SBOM | Workbench can create SBOMs with component, license, vulnerability, and usage information and export them in SPDX or CycloneDX formats. | Mend exports SPDX and CycloneDX SBOMs, imports third-party SBOMs and uses VEX data. |
| Security certifications | FossID announced ISO/IEC 27001 information security management and ISO 9001 quality management certifications in 2024. | Mend says its controls are evaluated for SOC 2 Type II and that its information security management system incorporates ISO 27001, ISO 27017 and ISO 27701 controls. |
| Support | FossID directs customers to its support portal for help and ticket submission. | The site links customers to Mend’s support portal to open and track support tickets. |
Plans
Mend SCA
- Mend Renovate Enterprise$250 a year
- Mend AI$300 a year
- Mend AppSec$1,000 a year
In their own words
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.