Mend.io Integrates with Microsoft Defender for Cloud to Deliver Runtime-Aware Open Source Vulnerability Prioritization

TEL AVIV, Israel and BOSTON, MA, April 29, 2025—Mend.io, a leader in application security, today announced a new integration with Microsoft Defender for Cloud, empowering organizations to more effectively prioritize and remediate open source vulnerabilities in their cloud-native environments.

This integration brings Mend.io’s industry-leading Software Composition Analysis (SCA) and reachability analysis directly into Microsoft Cloud-Native Application Protection Platform (CNAPP). Security and DevOps teams can now identify which vulnerabilities are truly exploitable and understand their impact across the runtime environment—all without leaving the Microsoft Defender for Cloud console.

“Modern cloud environments demand security solutions that can operate with precision and context,” said Rami Sass, Mend.io’s CEO and Co-founder. “By integrating Mend.io’s reachability analysis into Microsoft Defender for Cloud, we’re delivering the runtime-aware intelligence teams need to accurately assess exploitability and prioritize remediation efforts at scale.”

Key Capabilities of the Integration:

• Exploitability-Based Prioritization: Mend.io’s reachability data highlights which vulnerabilities are reachable in production, filtering out false positives and surfacing what truly matters.
• Enhanced Attack Path Visualization: Reachable dependencies are visualized within Defender for Cloud’s attack path graph, offering a clear view of how threats can traverse the application stack.
• Seamless Visibility Across the SDLC: Vulnerabilities can be traced from open source libraries to containers and Kubernetes pods—bridging the gap between development and runtime.

As the use of open source software in cloud environments grows, security teams face increasing pressure to move faster without sacrificing accuracy. This integration helps cut through the noise by embedding actionable insights directly into existing workflows, reducing response time and improving collaboration between security, DevOps, and development teams.