Cancel
You must select at least 2 products to compare!
Veracode Logo
41,100 views|24,342 comparisons
GitLab Logo
23,793 views|19,891 comparisons
Mend  Logo
Read 13 Mend reviews
19,920 views|14,073 comparisons
Comparison Buyer's Guide
Executive Summary

We performed a comparison between GitLab and Mend based on real PeerSpot user reviews.

Find out in this report how the two Application Security Tools solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
To learn more, read our detailed GitLab vs. Mend Report (Updated: March 2023).
687,947 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"It pinpoints the errors. Its accuracy is very interesting. It also elaborates on flaws, meaning it provides you with details about what is valid or not and how something can be fixed.""It's comprehensive from a feature standpoint.""The Veracode technical support is very good. They are responsive and very knowledgeable.""The findings of their security analysis are wonderful. You can easily go through all the analyses done by Veracode. You can see what are the flaws and what could be the best possible resolution to minimize those flaws in the application. When an application is being used by the public, security is a challenge. Veracode helps us to analyze all the security flaws, discrepancies, and vulnerabilities inside the application. It provides good reports.""Another feature of Veracode is that they provide e-learning, but the e-learning is not basic, rather it is quite advanced... in the e-learning you can check into best practices for developing code and how to prevent improper management of some component of the code that could lead to a vulnerability. The e-learning that Veracode provides is an extremely good tool.""Veracode's technical support is great. They assigned us a TAM and once a week, we have a brief engagement with the TAM to verify that everything's going well. If we have any outstanding issues, they get serviced and addressed.""Good static analysis and dynamic analysis.""Veracode Security Labs are fantastic. My team loves getting the hands-on experience of putting in a flaw and fixing it. It's interactive. We've gotten decent support from the sales and software engineers, so the initial support was excellent. They scheduled a consultation call to dive deep and discuss why we see these findings and codes. That was incredibly helpful."

More Veracode Pros →

"GitLab is kind of an image of GitHub, so it gives us the flexibility to monitor our changes in the repos.""CI/CD is very good. The version control system is also good. These are the two features that we use.""The solution has an established roadmap that lays out its plans for upgrades over the next two to three years.""The most valuable features of Gitlab are integration with CIE and the ability to rapidly deploy solutions, projects, and applications. It is very easy to use, and there are no complaints.""I have found the most valuable feature is security control. I also like the branching and cloning software.""The most valuable feature of GitLab is its security.""The most valuable feature of GitLab is the automatic merging of code.""I like that you can use GitLab as a double-sided solution for both DevOps and version management. It's a good product for working in these two areas, and the user interface makes it easy to understand."

More GitLab Pros →

"The solution is scalable.""The dashboard view and the management view are most valuable.""Mend has reduced our open-source software vulnerabilities and helped us remediate issues quickly. My company's policy is to ensure that vulnerabilities are fixed before it gets to production.""WhiteSource is unique in the scanning of open-source licenses. Additionally, the vulnerabilities aspect of the solution is a benefit. We don't use WhiteSource in the whole organization, but we use it for some projects. There we receive a sense of the vulnerabilities of the open-source components, which improves our security work. The reports are automated which is useful.""The solution boasts a broad range of features and covers much of what an ideal SCA tool should.""We set the solution up and enabled it and we had everything running pretty quickly.""I am the organizational deployment administrator for this tool, and I, along with other users in our company, especially the security team, appreciate the solution for several reasons. The UI is excellent, and scanning for security threats fits well into our workflow.""There are multiple different integrations there. We use Mend for CI/CD that goes through Azure as well. It works seamlessly. We never have any issues with it."

More Mend Pros →

Cons
"We are testing Veracode's software composition analysis, but we're having trouble integrating it with SVN. It works out of the box when you use Git but doesn't work as well with other tools like SVN. It's more geared toward Git""There are many times when their product goes to check my code and it dies, and I don't know why. I've contacted support and they're not really helpful with this particular problem. I go to the logs and I look at what I can but I can't tell why the check process has essentially just died in the middle of checking.""The ideal situation in terms of putting the results in front of the developers would be with Veracode integration into the developer environment (IDE). They do have a plugin, which we've used in the past, but we were not as positive about it.""In the next release, I would like a proper way of packaging files for scanning and the packing of IOS apps and API Dynamic scan methodology.""The solution could improve the Dynamic Analysis Security Testing(DAST).""The product has issues with scanning.""I do expect large applications with millions of lines of code to take a while, but it would be nice if there was a possibility to be able to have a baseline initial scan. I know that Veracode touts that there are Pipeline Scans that are supposed to take 90 seconds or less, and we've tried to do that ourselves with our ERP application. However, it actually times out after two hours of scanning. If the static scan itself or another option to run a lower tier scan can be integrated earlier on into our SDLC, it would be great. Right now, it takes so long that we usually leave it till a bit later in the cycle, whereas if it ran faster, we could push it to the time when a developer will be checking in code. That would make us feel a lot more confident that we'd be able to catch things almost instantaneously.""The sandbox could use some improvement; when creating a sandbox, it requires us to put the application name in twice, which seems unnecessary."

More Veracode Cons →

"In the free version, when a merge request is raised, there is no way to enforce certain rules. We can't enforce that this merge request must be reviewed or approved by two or three people in the team before it is pushed to the master branch. That's why we are exploring using some agents.""It should be used by a larger number of people. They should raise awareness.""GitLab could improve the patch repository. It does not have support for Conan patch version regions. Additionally, better support for Kubernetes deployment is needed as part of the package.""The price of GitLab could improve, it is high.""The solution could improve by providing more integration into the CI/CD pipeline, an autocomplete search tool, and more supporting documentation.""This solution could be improved by adding modifications such as slack notifications.""I'm new to GitLab, so I would appreciate more documentation about the code and commands.""For as long as I have used GitLab, I haven't encountered any major limitations. However, I think that perhaps the search functionality could be better."

More GitLab Cons →

"The turnaround time for upgrading databases for this tool as well as the accuracy could be improved.""The only thing that I don't find support for on Mend Prioritize is C++.""The initial setup could be simplified.""I would like to see the static analysis included with the open-source version.""At times, the latency of getting items out of the findings after they're remediated is higher than it should be.""They're working on a UI refresh. That's probably been one of the pain points for us as it feels like a really old application.""I rated the solution an eight out of ten because WhiteSource hasn't built in a couple of features that we would have loved to use and they say they're on their roadmap. I'm hoping that they'll be able to build and deliver in 2022.""It should support multiple SBOM formats to be able to integrate with old industry standards."

More Mend Cons →

Pricing and Cost Advice
  • "From a cost perspective, it seems okay, although we will probably evaluate alternatives next time it's up for renewal because for us, it's a relatively high cost, and we want to make sure that we are using our resources most appropriately."
  • "The pricing is a little on the high side but since we combine our product into one suite, it is easy to do and works well for us."
  • "It is quite good. If you adapt it for the whole organization, it is quite affordable. The pricing plans are good as compared to the other competitors, and any small, medium, or big company can easily adopt Veracode. Its cost includes deployment, training, and support for one year."
  • "The cost has been a barrier to wider use here. I think my team is the only one at the university. Other folks might like to use it, but it's pretty pricey. You could see what else is in the market, but I hear that's the price for most solutions. You might not find a better deal in the market, or it might be an incomplete solution. I mean, for the level of interaction we get with Veracode staff, it's been pretty good."
  • "There is a fee to scale up the solution which I consider expensive."
  • "I know that Veracode is a semi-pricey solution. If you are serious about security, I would recommend that you use an open-source option to learn how the scanning process works and then look into Veracode if you want to really step up your game and have an all-in-one solution."
  • "I wouldn't really recommend Veracode for a small firm, because it might be a little pricey for them. But for a large organization, with more than 1,000 applications in the enterprise, there are tiered levels of pricing."
  • "There are no setup or implementation charges. They offer a free trial and free consulting services... The price depends on your requirements, your source code sizes, and how complicated your source code is."
  • More Veracode Pricing and Cost Advice →

  • "It seems reasonable. Our IT team manages the licenses."
  • "Its price is fine. It is on the cheaper side and not expensive. You have to pay additionally for GitLab CI/CD minutes. Initially, we used the free version. When we ran out of GitLab minutes, we migrated to the paid version."
  • "It is very expensive. We can't bear it now, and we have to find another solution. We have a yearly subscription in which we can increase the number of licenses, but we have to pay at the end of the year."
  • "I don't mind the price because I use the free version."
  • "We are using its free version, and we are evaluating its Premium version. Its Ultimate version is very expensive."
  • "The price of GitLab could be better, it is expensive."
  • "I'm not aware of the licensing costs because those were covered by the customer."
  • "GitLab is an open-source solution."
  • More GitLab Pricing and Cost Advice →

  • "The solution involves a yearly licensing fee."
  • "As we were using an SaaS-based service, the solution must be scalable, although my understanding is that this is based on the licensing model one is using."
  • "WhiteSource is much more affordable than Veracode."
  • "This is an expensive solution."
  • "When comparing the price of WhiteSource to the competition it is priced well. The cost for 50 users is approximately $18,000 annually."
  • "Its pricing model is per developer. It depends on the number of developers in the company. The license is for a minimum of 20 developers. So, even if you are a small startup with less than 10 developers, you have to buy a license for 20 developers on a yearly subscription, which makes it quite expensive for startup customers. I provide consultation to startup accelerators. They're small at the beginning, and only once they grow to 20 developers, they can afford this tool. As a result, WhiteSource is missing this target audience. Their licensing is not flexible."
  • "We always negotiate for the best price possible, and as far as I know, Mend has done an excellent job with their pricing. Our management is happy with the pricing, which has led to renewals."
  • "Pricing and licensing are comparable to other tools. When we started, it was less than our existing solution. I can't go into specifics, but it isn't cheap."
  • More Mend Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
    687,947 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis… more »
    Top Answer:The user interface is excellent, the code review process is quick and provides great analytics to understand our code… more »
    Top Answer:It is quite good. If you adapt it for the whole organization, it is quite affordable. The pricing plans are good as… more »
    Top Answer:The solution has an established roadmap that lays out its plans for upgrades over the next two to three years.
    Top Answer:GitLab is a paid version, Ultimate GitLab. It has three editions: one is a free edition or a community edition. They… more »
    Top Answer:The release schedules are quite clear. Even if I'm expecting some improvement, the improvement release cycles are… more »
    Top Answer:Red Hat Ceph does well in simplifying storage integration by replacing the need for numerous storage solutions. This… more »
    Top Answer:We researched Black Duck but ultimately chose WhiteSource when looking for an application security tool. WhiteSource is… more »
    Top Answer:The license management of WhiteSource was at a good level. As compared to other tools that I have used, its… more »
    Comparisons
    Also Known As
    WhiteSource
    Learn More
    Overview

    Veracode covers all your Application Security needs in one solution through a combination of five analysis types; static analysis, dynamic analysis, software composition analysis, interactive application security testing, and penetration testing. Unlike on-premise solutions that are hard to scale and focused on finding rather than fixing, Veracode comprises a unique combination of SaaS technology and on-demand expertise that enables DevSecOps through integration with your pipeline, and empowers developers to find and fix security defects.

    GitLab is an open-source code repository and application code development platform that aims to simplify the process of software development through to the eventual product release and upgrade. It contains all of the tools that developers need to take control of every stage of the software development process. GitLab makes it easy for teams to create checklists that they can follow when they begin to write the code and do other tasks that are critical to the success of their project. GitLab also enables organizations to automate the shipping of software code to those servers that they need to get to without requiring human intervention.

    GitLab Benefits

    Some of the ways that organizations can benefit by deploying GitLab include:

    • Easy solution configuration. GitLab does not require organizations to devote significant time and other resources to bringing it online. It can be quickly installed by a business’s IT team to any device or cloud that is most convenient for them. IT teams can install it using either GUI installer or a command line installer, depending on what is more convenient for them.
    • Source code storage and management security. Developers can use GitLab to control who is able to access the source code that they are working on and manage the security of the location where the code is being stored. Gitlab makes it so that users get to decide the privacy status of their code and storage. This keeps unauthorized individuals from gaining access to their sensitive and proprietary code.
    • DevOps feedback. GitLab gives users the ability to learn from what they are doing and improve their DevOps practices. It will assign to their DevOps pipeline scores that can enable them to see where they might be lacking and do better.

    GitLab Features

    • Secret detection customization. Users can set GitLab to scan for sensitive data that might have accidentally been stored with the source code under development. Users can set custom parameters and discover at-risk data before it can be leaked.
    • Custom notifications. This feature makes it easy for developers to keep track of the changes that are being applied to their projects. They can set GitLab so that it sends them a notification when changes are made. These notifications can be customized to meet the developer's specific needs.
    • Built-in CI/CD capabilities. Users are able to build, test, and deploy their software without turning to outside integrations. The CI/CD automation is built-in so that all of these functions can be easily automated as necessary.

    Reviews from Real Users

    GitLab is a solution that stands out when compared to many of its competitors. Two major advantages it offers are the overall completeness of the solution and the way that it enables application developers to work on various parts of a given project simultaneously.

    Kulbhushan M., co-founder and technical architect at Think NYX Technologies LLP, writes, “The SaaS setup is impressive, and it has DAST solutions. It also has dependency check and scanning mechanisms. If we were using other solutions, they would have to be configured, and we would have to set them to us as a third party, but GitLab is straightforward. GitLab is a single solution that helps us do everything we need.”

    Zeeshan R., a software engineer at OZ, writes, “The best thing is that as the developers work on separate tasks, all of the code goes there and the other team members don't have to wait on each other to finish. We can all work on our code in tandem.”

    Mend is a software composition analysis tool that secures what developers create. The solution provides automated reduction of software attack surface, reduces developer burdens, and accelerates app delivery. Mend provides open-source analysis with its in-house and other multiple sources of software vulnerabilities. In addition, the solution offers license and policy violations alerts, has great pipeline integration, and, since it is a SaaS (software as a service), it doesn’t require you to physically maintain servers or data centers for any implementation. Not only does Mend reduce enterprise application security risk, it also helps developers meet deadlines faster.

    Mend Features

    Mend has many valuable key features. Some of the most useful ones include:

    • Vulnerability analysis
    • Automated remediation
    • Seamless integration
    • Business prioritization
    • Limitless scalability
    • Intuitive interface
    • Language support
    • Integration
    • Continuous monitoring
    • Remediation suggestions
    • Customization

    Mend Benefits

    There are many benefits to implementing Mend. Some of the biggest advantages the solution offers include:

    • Easy to use: The Mend platform is very user friendly and easy to set up.
    • Third-party libraries: The solution eases the process of keeping track of all the used third-party dependencies within a product. It not only scans for the pure occurrence (also transitively) but also takes care of licenses and vulnerabilities.
    • Static code analysis: With Mend’s static code analysis, you can quickly identify security weaknesses in custom code across desktop, web, and mobile applications.
    • Broad support: Mend provides 27 different programming languages and various programming frameworks.
    • Easy integration: Mend makes integration very easy with existing DevOps environments and CI/CD pipelines so developers don’t need to manually configure or trigger the scan.
    • Ultra-fast scanning engine: The solution’s scanning engine generates results up to ten times faster than legacy SAST solutions.
    • Unified developer experience: Mend has a unified developer experience inside the code repository that shows side-by-side security alerts and remediation suggestions for custom code and open-source code.

    Reviews from Real Users

    Below are some reviews and helpful feedback written by PeerSpot users currently using the Mend solution.

    Jeffrey H., System Manager of Cloud Engineering at Common Spirit, says, “Finding vulnerabilities is pretty easy. Mend (formerly WhiteSource) does a great job of that and we had quite a few when we first put this in place. Mend does a very good job of finding the open-source, checking the versions, and making sure they're secure. They notify us of critical high, medium, and low impacts, and if anything is wrong. We find the product very easy to use and we use it as a core part of our strategy for scanning product code moving toward release.”

    PeerSpot reviewer Ben D., Head of Software Engineering at a legal firm, mentions, “The way WhiteSource scans the code is great. It’s easy to identify and remediate open source vulnerabilities using this solution. WhiteSource helped reduce our mean time to resolution since we adopted the product. In terms of integration, it's pretty easy.”

    An IT Service Manager at a wholesaler/distributor comments, “Mend provides threat detection and an excellent UI in a highly stable solution, with outstanding technical support.”

    Another reviewer, Kevin D., Intramural OfficialIntramural at Northeastern University, states, "The vulnerability analysis is the best aspect of the solution."

    Offer
    Keep your software secure

    Application security starts with secure code. Find out more about the benefits of using Veracode to keep your software secure throughout the development lifecycle.

    Learn more about GitLab
    Learn more about Mend
    Sample Customers
    State of Missouri, Rekner
    Siemens, University of Washington, Equinix, Paessler AG, CNCF, Ticketmaster, CERN, Vaadin
    Microsoft, Autodesk, NCR, Forgerock, The Home Depot, Bosch, IBM, GE digital, KPMG, LivePerson, Jack Henry and Associates
    Top Industries
    REVIEWERS
    Financial Services Firm30%
    Computer Software Company14%
    Insurance Company9%
    Comms Service Provider7%
    VISITORS READING REVIEWS
    Computer Software Company19%
    Financial Services Firm16%
    Comms Service Provider8%
    Manufacturing Company7%
    REVIEWERS
    Computer Software Company21%
    Financial Services Firm13%
    Manufacturing Company13%
    Retailer13%
    VISITORS READING REVIEWS
    Computer Software Company16%
    Financial Services Firm11%
    Educational Organization10%
    Comms Service Provider9%
    REVIEWERS
    Computer Software Company33%
    Financial Services Firm11%
    Wholesaler/Distributor6%
    University6%
    VISITORS READING REVIEWS
    Computer Software Company22%
    Financial Services Firm13%
    Manufacturing Company8%
    Comms Service Provider7%
    Company Size
    REVIEWERS
    Small Business26%
    Midsize Enterprise22%
    Large Enterprise52%
    VISITORS READING REVIEWS
    Small Business17%
    Midsize Enterprise12%
    Large Enterprise71%
    REVIEWERS
    Small Business46%
    Midsize Enterprise7%
    Large Enterprise47%
    VISITORS READING REVIEWS
    Small Business18%
    Midsize Enterprise19%
    Large Enterprise63%
    REVIEWERS
    Small Business35%
    Midsize Enterprise8%
    Large Enterprise58%
    VISITORS READING REVIEWS
    Small Business19%
    Midsize Enterprise14%
    Large Enterprise68%
    Buyer's Guide
    GitLab vs. Mend
    March 2023
    Find out what your peers are saying about GitLab vs. Mend and other solutions. Updated: March 2023.
    687,947 professionals have used our research since 2012.

    GitLab is ranked 3rd in Application Security Tools with 50 reviews while Mend is ranked 4th in Application Security Tools with 13 reviews. GitLab is rated 8.4, while Mend is rated 8.2. The top reviewer of GitLab writes "Powerful, mature, and easy to set up and manage". On the other hand, the top reviewer of Mend writes "Easy to use, great for finding vulnerabilities, and simple to set up". GitLab is most compared with Microsoft Azure DevOps, TeamCity, AWS CodePipeline, Tekton and Polarion ALM, whereas Mend is most compared with SonarQube, Black Duck, Snyk and Checkmarx. See our GitLab vs. Mend report.

    See our list of best Application Security Tools vendors and best Software Composition Analysis (SCA) vendors.

    We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.