What do Mend.io and SplxAI sell?

Mend.io sells Mend AI, Mend Renovate, Mend SCA, Mend SAST, DAST and 1 more. SplxAI sells Agentic Radar.

Are Mend.io and SplxAI in the same category?

They share Static application security testing and AI model and agent security. Mend.io's primary category is Software composition analysis and SplxAI's is AI model and agent security.

Who owns Mend.io and SplxAI?

SplxAI is owned by Zscaler, since 2025.

Who are Mend.io and SplxAI sold to?

Mend.io states that it enables developers and security professionals to write secure code and utilize secure components. From its own pages, the company sells mainly to enterprises, saying the platform is built for enterprise scalability.

Vendor comparison · 2 companies

Mend.io vs SplxAI

Mend.io sells enterprise AI security and application security software, and secures the full chain from open source dependencies and AI models to container images. SplxAI, which uses the name SPLX, sells scalable red teaming, real-time threat protection, and automated AI compliance and governance for AI systems. CISO Tribune files both under Static application security testing and AI model and agent security. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

Mend.io
SplxAI

Add a company

Mend.io vs SplxAI: Products, Customers and Funding Compared
What it sells
	Mend.ioMend.io sells enterprise AI security and application security software, and secures the full chain from open source dependencies and AI models to container images.mend.io	SplxAISplxAI, which uses the name SPLX, sells scalable red teaming, real-time threat protection, and automated AI compliance and governance for AI systems.splx.ai
What it sells	Mend AI^[1][3][4]Secures the AI layer with component discovery, system prompt hardening, automated red teaming, and in-app runtime guardrails. Mend Renovate^[1][2][4][5]Creates and manages pull requests automatically across a codebase. Mend SCA^[2][4]Protects repositories and CI/CD pipelines from malicious code packages and exploitable vulnerabilities. Mend SAST^[4]Included in Mend AppSec and feeds reachability-aware intelligence into agentic development tools. DAST^[1][4]An expansion option for Mend AppSec. API Security^[1][4]An expansion option for Mend AppSec.	Agentic Radar^[1][5]An open-source security scanner for agentic AI.
Categories
Categories	Software composition analysis (primary category) Static application security testing Dynamic application security testing AI model and agent security	AI model and agent security (primary category) AI governance AI firewalls and guardrails Static application security testing
Headquarters
Headquarters	Not stated on its pages	Not stated on its pages
Founded
Founded	Not stated on its pages	2023^[2]
Ownership and funding
Ownership and funding	Not stated on its pages	Owned by Zscaler since 2025^[3]
Named customers
Named customers	Not stated on its pages	Not stated on its pages
Recent news
Recent news	Not stated on its pages	Not stated on its pages
G2 and Gartner Peer Insights
G2 and Gartner Peer Insights	G2: listed, seen November 10, 2026^[12] Gartner Peer Insights: Not stated on its pages	G2: Not stated on its pages Gartner Peer Insights: Not stated on its pages
Who it fits
Who it fits	Mend.io states that it enables developers and security professionals to write secure code and utilize secure components. Mend.io directs its SBOM and AI-BOM output to security and compliance teams. Mend AI is sold as an add-on to Mend AppSec or as a standalone product.	From its own pages, the company sells mainly to enterprises, saying the platform is built for enterprise scalability. Its asset management messaging speaks to organisations that want visibility and control over the AI assets used in the organisation. Its runtime messaging addresses teams with AI systems in production. Its governance messaging speaks to teams working with global AI security frameworks and internal risk policies.
Last verified
Last verified	November 4, 2026	September 30, 2026

Where they overlap

Mend.io and SplxAI are both filed under Static application security testing and AI model and agent security.

Where they differ, field by field

Mend.io's primary category is Software composition analysis; SplxAI's is AI model and agent security.
Mend.io is also filed under Dynamic application security testing. SplxAI is also filed under AI governance and AI firewalls and guardrails.
Mend.io lists Mend AI, Mend Renovate, Mend SCA, Mend SAST, DAST and 1 more. SplxAI lists Agentic Radar.
SplxAI was founded in 2023.
SplxAI is owned by Zscaler, since 2025.

What it sells: Mend.io

What Mend AI does^[1][3][4]: Mend AI includes AI red teaming to simulate threats like prompt injection and data exfiltration. Mend AI gives visibility into AI components in a codebase, with automated red teaming and runtime guardrails that enforce policy in production. Mend AI can be purchased as an add-on to Mend AppSec or as a standalone product.
What Mend Renovate does^[1][2][4][5]: Mend Renovate Enterprise automates open-source dependency updates and provides Merge Confidence ratings and workflows. Mend Renovate Enterprise is a component of Mend AppSec and can be purchased as a standalone product.
What Mend SCA does^[2][4]: Mend SCA detects malicious packages, including protestware and packages designed to steal data or inject malicious code. Mend SCA supports policy enforcement to stop that risk earlier in development. Mend SCA is included in Mend AppSec.
What Mend SAST does^[4]: Mend SAST is included in Mend AppSec. Mend SAST and Mend SCA feed reachability-aware intelligence into agentic development tools.
What DAST does^[1][4]: DAST is an add-on or expansion option for Mend AppSec. Mend AppSec can be expanded with Mend AI Premium, DAST, API Security, and EOL (End of Life) Support for open source projects.
What API Security does^[1][4]: API Security is an add-on or expansion option for Mend AppSec. Mend AppSec can be expanded with Mend AI Premium, DAST, API Security, and EOL (End of Life) Support for open source projects.

Questions about Mend.io and SplxAI

What do Mend.io and SplxAI sell?: Mend.io sells Mend AI, Mend Renovate, Mend SCA, Mend SAST, DAST and 1 more. SplxAI sells Agentic Radar.
Are Mend.io and SplxAI in the same category?: They share Static application security testing and AI model and agent security. Mend.io's primary category is Software composition analysis and SplxAI's is AI model and agent security.
When were Mend.io and SplxAI founded?: SplxAI was founded in 2023.
Who owns Mend.io and SplxAI?: SplxAI is owned by Zscaler, since 2025.
Who are Mend.io and SplxAI sold to?: Mend.io states that it enables developers and security professionals to write secure code and utilize secure components. From its own pages, the company sells mainly to enterprises, saying the platform is built for enterprise scalability.

About Mend.io

Mend.io sells enterprise AI security and application security software, and secures the full chain from open source dependencies and AI models to container images.^{[1][2][3][4][7]}

Mend.io states that AI components, open source dependencies, and production agents have introduced risk that traditional developer security tools were not built to find, test, or govern. Mend.io states that a prompt change, model update, or new input path can introduce vulnerabilities that were not present in the last AI security scan. Mend.io states that the EU AI Act, Executive Order 14028, and the Cyber Resilience Act require verifiable technical evidence that software and AI systems have been inventoried, tested, and secured.^[3]

Mend AppSec secures the code layer, covering source code, open-source dependencies, containers, and AI-generated code. Mend AppSec covers open source risk, proprietary code scanning, and AI visibility in a single workflow. Mend SAST and Mend SCA are both included in Mend AppSec and feed reachability-aware intelligence into agentic development tools. Mend AppSec integrates with AI coding assistants like Cursor, Windsurf, and Copilot to scan code as it is generated, before the code reaches the codebase. Mend AppSec maps dependencies, prioritizes exploitable vulnerabilities, and catches malicious packages and secrets before they reach production. Mend AppSec identifies vulnerable and malicious dependencies and extends coverage into the containers.^{[2][3][4][11]}

Mend SCA protects repositories, CI/CD pipelines, and beyond from malicious code packages and exploitable vulnerabilities. Mend SCA detects malicious packages, including protestware and packages designed to steal data or inject malicious code, and supports policy enforcement to stop that risk earlier in development. Mend.io states that its database supports over 200 programming languages. Mend.io aggregates vulnerabilities from the NVD, dozens of security advisories, and popular open source projects issue trackers.^[2][4]

Mend AI secures the AI layer itself with AI component discovery and risk insights, system prompt hardening with AIWE scoring, automated red teaming, and in-app runtime guardrails. Mend AI includes AI red teaming to simulate threats like prompt injection and data exfiltration. Mend AI gives visibility into AI components in a codebase, with automated red teaming and runtime guardrails that enforce policy in production. Mend AI can be purchased as an add-on to Mend AppSec or as a standalone product. Mend.io surfaces components in a codebase, including packages, AI models, agents, and system prompts, along with shadow dependencies standard tooling misses. Mend.io provides a continuously updated SBOM/AI-BOM, ready for security and compliance teams. Mend.io describes runtime in-application protection as behavioral controls between users and applications in production that monitor live interactions, enforce policy, and block unsafe behavior as it occurs. Mend.io states that automated attack simulations run against every build before it ships, including injection, data leakage, and AI-specific vectors.^{[1][2][3][4][6]}

Mend Renovate creates and manages pull requests automatically across a codebase, with Smart Merge Control to prevent bad updates from shipping. Mend Renovate Enterprise automates open-source dependency updates. Mend Renovate Enterprise automatically creates pull requests for new package versions and provides Merge Confidence ratings and workflows. Mend Renovate Enterprise is a component of Mend AppSec and can be purchased as a standalone product. Mend AppSec can be expanded with Mend AI Premium, DAST, API Security, and EOL (End of Life) Support for open source projects. Mend Renovate keeps dependencies continuously current while Mend AppSec identifies vulnerable and malicious dependencies.^[1][4][5]

The Mend Platform enables users to generate and export a Software Bill of Materials report that specifies the libraries, code packages, and other third-party components used in applications. In the Mend Platform, the CycloneDX standard is embedded with Vulnerability Exploitability eXchange (VEX) data. Mend API 3.0 is a REST-compliant API that enables the automation of workflows. Service users in the Mend Platform are programmatic (machine) users that can communicate with Mend via the APIs with no access to the GUI. The Mend CLI requires a login once for each environment where it runs, which authenticates the user to work in a single organization.^[4][6][8][9]

Mend.io is headquartered in Israel with operations spanning the EU, US, and worldwide. Mend.io has an integrated information security management system incorporating controls for ISO 27001, ISO 27017, and ISO 27701, and these controls are reviewed externally every year. Mend.io's controls are evaluated by Schellman, a firm specializing in annual compliance assessments across various industries. Mend.io states compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws in the US to which it is subject. Mend.io has partnered with TrustArc as its Dispute Resolution Service Provider for unresolved privacy concerns. Mend.io prices per Contributing Developer. Mend.io's AppSec coverage includes SCA, SAST, secrets detection, and reachability.^[1][4]

Mend.io on the record

About SplxAI

SplxAI, which uses the name SPLX, sells scalable red teaming, real-time threat protection, and automated AI compliance and governance for AI systems. SPLX delivers security tooling for red teaming, runtime security, governance and remediation to build, deploy and scale AI systems. SPLX helps global enterprises secure AI systems end-to-end. SPLX describes security teams as lacking the tools to continuously map, monitor, or validate dynamic LLM behavior and vulnerabilities.^{[4][5][7][9][11]}

SPLX builds an AI-BOM, uncovers vulnerabilities, and helps users stay aligned with compliance frameworks. SPLX detects LLMs used across an organization and shows benchmark scores for each. SPLX lets users approve or block usage of the LLMs it detects. SPLX scans code repos to visualize every agent, tool, and MCP server in AI workflows. SPLX discovers MCP servers in an environment and scans for exploitable vulnerabilities in orchestration layers. SPLX connects to cloud platforms, code repos, ML and AI platforms for a unified inventory of AI assets in an organization.^[5][8]

SPLX runs automated red teaming that continuously uncovers vulnerabilities in AI systems. SPLX red teaming runs high-scale vulnerability assessments and simulates domain-specific attacks on AI systems from build to runtime. SPLX red teaming tests malicious prompts from adversarial and regular user personas. SPLX red teaming covers prompt injections, off-topic, hallucinations, and social engineering. SPLX lets users create custom AI assessments to test for specific risk scenarios and security criteria. SPLX lets users upload predefined datasets tailored to their threat models for red teaming. SPLX red teaming simulates attack scenarios with different input types for multi-modal AI assistants. The SplxAI platform integrates into the CI/CD pipeline.^{[1][4][5][7][9]}

SPLX generates hardened system prompts and applies targeted remediation steps based on red teaming insights. SPLX hardens a system prompt and applies dynamic remediation strategies. SPLX enforces input and output guardrails during live deployments to detect malicious behavior, prevent prompt injections, and stop sensitive data leakage in real time. SPLX lets users define off-topic rules and risk boundaries through natural language. SPLX provides detailed logs of blocked prompts and flagged outputs. SPLX scans LLM logs to detect jailbreaks, prompt injections, and malicious queries in near real time. SPLX lets users select risk scanners and upload LLM logs for threat discovery.^{[1][4][5][7][10][12]}

The SPLX Platform maps an AI risk surface to global and industry-specific frameworks to help identify compliance gaps. SPLX automatically maps test results to AI frameworks to spot gaps and eliminate manual tracking. SPLX lets users set custom governance rules or import JSON policies to enforce internal security standards. SPLX stress-tests open-source and commercial language models with thousands of attacks. SPLX model testing shows how models perform with no prompt, a basic prompt, and a hardened prompt.^{[1][4][5][6][13]}

SPLX offers API integration that allows for connections to any type of endpoint. Agentic Radar is an open-source security scanner for agentic AI. Agentic Radar visualizes workflows, surfaces attack patterns and tool-level vulnerabilities, and provides hardening recommendations for each agent.^[1][4][5]

SPLX says it has put controls in place to meet the compliance needs of highly regulated industries. SPLX describes itself as a remote-first team.^{[1][4][5][6][7][9][10][11][14][15]}

SplxAI on the record

Sources

Mend.io full record

[1]mend.ioMend.io · mend.io · undated page, accessed November 4, 2026 · Tier A
[2]Software Supply Chain Security | Mend.ioMend.io · undated page, accessed November 10, 2026 · Tier A
[3]Mend.io | Application Security and AI Security, UnifiedMend.io · undated page, accessed November 10, 2026 · Tier A
[4]Mend.io Pricing: AppSec, AI Security, and RenovateMend.io · undated page, accessed November 10, 2026 · Tier A
[5]Find Your Integration - MendMend.io · undated page, accessed November 10, 2026 · Tier A
[6]The Dependencies SBOM Report | Mend AppSec Guide | Mend.io DocumentationMend.io Documentation · undated page, accessed November 10, 2026 · Tier A
[7]Getting Started with Mend API 3.0 | Mend AppSec Guide | Mend.io DocumentationMend.io Documentation · undated page, accessed November 10, 2026 · Tier A
[8]Manage Service Users in the Mend Platform | Mend AppSec Guide | Mend.io DocumentationMend.io Documentation · undated page, accessed November 10, 2026 · Tier A
[9]Authenticate your login for the Mend CLI | Mend AppSec Guide | Mend.io DocumentationMend.io Documentation · undated page, accessed November 10, 2026 · Tier A
[10]Mend.io: Trust and Compliance - Secure Data ProtectionMend.io · undated page, accessed November 10, 2026 · Tier A
[11]About Mend.io: Securing Code and AI TogetherMend.io · undated page, accessed November 10, 2026 · Tier A
[12]Mend.io Reviews 2026: Details, Pricing, & FeaturesG2 · undated page, accessed November 10, 2026 · Tier C

SplxAI full record

[1]splx.aiSplxAI · splx.ai · undated page, accessed September 30, 2026 · Tier A
[2]SplxAI Closes $7M Seed Funding Round to Help Organizations Secure Agentic AI SystemsBusiness Wire · businesswire.com · published March 26, 2025 · Tier A
[3]Zscaler acquires splxSplxAI · splx.ai · published November 3, 2025 · Tier A
[4]SPLX Platform | End-to-End Security for the AI LifecycleSPLX · undated page, accessed October 31, 2026 · Tier A
[5]SPLX | End-to-End Security for AISPLX · undated page, accessed October 31, 2026 · Tier A
[6]AI Governance & Compliance | Stay Aligned with AI PoliciesSPLX · undated page, accessed October 31, 2026 · Tier A
[7]Remediation | Harden your LLM system prompts to mitigate risksSPLX · undated page, accessed October 31, 2026 · Tier A
[8]AI Asset Management | Unified Inventory & Security for Enterprise AISPLX · undated page, accessed October 31, 2026 · Tier A
[9]Probe | Automated & Continuous Red Teaming for Conversational AISPLX · undated page, accessed October 31, 2026 · Tier A
[10]AI Runtime Protection | Real-Time AI Threat DetectionSPLX · undated page, accessed October 31, 2026 · Tier A
[11]SplxAI | The future of automated AI Red TeamingSPLX · undated page, accessed November 10, 2026 · Tier A
[12]Monitoring | Analyze LLM Logs to proactively identify malicious user activitySPLX · undated page, accessed November 10, 2026 · Tier A
[13]LLM Benchmarks | Compare and Evaluate the Security of Leading AI ModelsSPLX · undated page, accessed November 10, 2026 · Tier A
[14]Security and TrustSPLX · undated page, accessed November 10, 2026 · Tier A
[15]Pricing & PlansSPLX · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.