Open source license compliance
Automation and policy management are key to taming the management tangle of open source license usage.
Challenges
Navigating the compliance maze
While open source code packages help developers work more efficiently, mitigating license compliance risks is difficult when your code relies on hundreds, or thousands of them.
A complex web of licenses
Each open source license comes with its own terms and conditions, and multiple licenses can be used in a single project. Multiply that by hundreds of applications in use, and you’ve got a management mess.
The speed of change
Open source projects evolve rapidly, and so does their licensing information. If dependencies are not updated in time, staying on top of all the changes is nearly impossible.
Lack of licensing standards
While there are popular open source licenses like Apache, MIT, and BSD, there’s no hard and fast rule for standardization, making it difficult to meet compliance requirements.
Opportunities
The value of automation
Set automatic policies upfront to make sure you’re always compliant with the open source licenses your organization uses.
Eliminate manual processes
Get results at a click of the buttons instead of struggling with time-consuming and error-prone manual processes.
Accurate risk assessment
Automating dependency identification and license tracking provides an accurate and up-to-the minute accurate risk assessment per license.
Policy enforcement
Enforce licensing policies with white listing or black listing open source licenses to establish upfront license compliance ground rules for the dev team.
Legal oversight
Give legal teams visibility and control over open source license usage.
The solution
Stay on top of open source license compliance risks
Mend SCA identifies your open source dependencies and maps them to our license database to determine the risk level of each. At the same time, Mend SCA lets you set and enforce licensing policies to prevent compliance issues before they happen.
Discover Mend SCA
“One of our most indicative KPIs is the amount of time for us to remediate vulnerabilities and also the amount of time developers spend fixing vulnerabilities in our code base, which has reduced significantly. We’re talking about at least 80% reduction in time.”
“When the product you sell is an application you develop, your teams need to be fast, secure and compliant. These three factors often work in opposite directions. Mend provides the opportunity to align these often competing factors, providing Vonage with an advantage in a very competitive marketplace.”
“The biggest value we get out of Mend is the fast feedback loop, which enables our developers to respond rapidly to any vulnerability or license issues. When a vulnerability or a license is disregarded or blocked, and there is a policy violation, they get the feedback directly.”
FAQs
How does Mend.io identify license risk?
Mend SCA identifies the licenses associated with open source dependencies and evaluates their compliance risk, including factors like copyleft, copyright, patent, and linking requirements. Teams can then set and enforce license policies to flag or block components that don’t meet their organization’s requirements.
Can Mend.io enforce licensing policies automatically?
Yes. Define license policies once and automatically flag or block dependencies that violate them (including license allow and deny lists) and Mend SCA enforces them in the development workflow, preventing compliance issues before they happen.
How does Mend.io reduce legal review time for open source licenses?
Mend SCA automatically identifies open source licenses and provides the risk, requirements, and compliance context around each component, so legal can focus on the exceptions, not research every dependency case by case.
See top open source licenses explained for license-by-license detail.
What happens when a developer adds a non-compliant dependency?
Mend SCA flags the policy violation directly in the developer’s workflow with the context to choose a compliant alternative, meaning there is no waiting on a legal review cycle.
Why does Mend.io automate license compliance instead of relying on periodic audits?
Dependencies change faster than audit cycles. Automated scans catch violations at introduction, while continuous policy enforcement prevents them; one Mend.io customer cut open source audits from a week to 15 minutes.
Stop managing alerts.
Start reducing risk.
Join the teams reducing remediation effort by 75%.
