The origin story of Mend.io begins with the sort of work most people try to forget. Azi Cohen and his partners were selling Eurekify, their identity-governance company, to CA Technologies. The deal was moving through due diligence. Then came the open source questions: Which components lived inside the product? Which licenses applied? What had the team actually shipped?
The answers existed, but extracting them was cumbersome. Cohen, Rami Sass and Ron Rymon spent time clearing components they believed they had already managed. Their company was acquired in 2008. The irritation survived the transaction.
A few years later, in 2011, the three founded WhiteSource, the company now called Mend.io. It automated the dull audit that had ambushed them. This is an unusually honest way for a software company to begin: not with a vision of changing humanity, but with three experienced people asking why a necessary chore remained so ridiculous.
A career built in the seams
Cohen graduated from the Technion in 1988 with an honors degree in information systems engineering. His career since then reads less like a collection of fashionable categories than a tour of enterprise software's unattended seams. He ran Precise Software Israel. He led Aduva, which Sun Microsystems acquired. He co-founded and ran Eurekify, then became vice president of security strategy at CA after the acquisition.
At each stop, the product lived where technical systems met organizational ambiguity. Identity governance asks who may do what. Open source management asks what code is present and what obligations travel with it. Connected-device security asks what is attached to a network and how dangerous it might be. AI application security now asks all of those questions at once, while the codebase is being enlarged by machines.
Cohen's role at WhiteSource was commercial and operational. He led North American activity and global sales, translating a problem hidden deep inside software development into something an enterprise buyer could budget for. The company passed 1,000 customers during his tenure. That number matters because categories do not become categories when a founder names them. They become categories when strangers repeatedly sign contracts.
“The market is at a tipping point - AI-driven development is now the new everyday reality.”Azi Cohen, February 2026
The future arrived wearing an old coat
In 2017, Cohen stepped onto a TEDxRoma stage and opened a talk about the future with a story from Genesis. Jacob presenting himself as Esau, he suggested, was an ancient case of identity theft. The joke carried his larger point: technology changes at a sprint; human motives stroll.
He imagined the cyber battlefield of 2037 as a contest between machines, with automated attackers and defenders spending ever more computing power against each other. Digital vaults would multiply, move and disguise themselves. The private sector would pay a swelling tax merely to protect the value it created. His proposed counterweight was not a cleverer box. It was government, law and public pressure.
The forecast was grand; Cohen's work remained practical. In 2021 he became CEO of CyberMDX, a company protecting connected devices and networks. The move took him from software components to physical equipment with software inside it. He spoke about device-centric risk: identify an asset, understand its vulnerabilities, and organize protection around the thing itself rather than treating the network as an undifferentiated fog.
Forescout acquired CyberMDX in 2022. Cohen emphasized a measured integration of people and culture alongside immediate connections between products, partners and customers. It was an operator's answer: move quickly where the advantage is obvious; be patient where the humans are involved.
Going back, carrying more
Cohen returned to Mend.io as president in 2025. In December, the company appointed him CEO. His co-founder Rami Sass moved to lead Mend AI, while Cohen took responsibility for overall strategy and go-to-market execution. It was continuity with a change of angle: one founder concentrated on the new product line, the other on making the whole company move around it.
Founder returns invite sentimental language. Cohen's looks more useful viewed as a systems problem. He knew the customers and the original wound that created the company. He also came back with experience running a different security business through an acquisition. Institutional memory had acquired fresh mileage.
The market he returned to had changed shape. WhiteSource began by answering what open source sat inside a codebase. Mend.io now covers software composition analysis, static testing, secrets, containers and remediation. Mend AI extends the job again, toward AI-generated code and embedded models whose behavior cannot be understood from a package inventory alone.
In early 2026, the company said Mend AI had reached 15 percent of its installed customer base. Cohen framed the mission as securing traditional applications and AI systems through one platform. Later that year he described the target more vividly: risk lives in the code, in AI-generated code, and in the space between code and the AI layer.
Good security software detects a problem. Useful security software changes what happens one minute later.
The one-minute-after test
For all the changing vocabulary, the strategic question across Cohen's career is remarkably stable. What happens after the tool finds something?
A scanner can produce a red badge. It cannot guarantee that a developer understands whether the flaw is reachable, that an owner is clear, or that a fix fits the release. Security products have often been rewarded for the length of their findings list. Developers experience the same list as noise with a login screen.
Mend.io's declared beliefs make the tension explicit: developers are not the problem; noise is. Compliance should emerge from continuous work rather than return as a manual project. More code is not automatically more valuable. These are product principles, but they are also a critique of how security organizations have purchased software.
AI sharpens the critique. If coding agents increase output, they increase the number of dependencies, decisions and mistakes that must be understood. A security gate bolted to the end becomes less defensible with every acceleration upstream. The answer Cohen is selling is earlier visibility, prioritization and remediation inside the development process, plus controls for the models and behavior now entering applications.
There is ambition in that breadth, and there is risk. Unified platforms are easy to draw and difficult to make coherent. Each layer has its own buyer, workflow and specialist competitors. Cohen's record suggests why Mend.io gave him the assignment: his work has repeatedly involved making a technical obligation legible to a business without sanding away the technical truth.
The founder as translator
Cohen describes himself as an entrepreneur and global sales leader. That pairing is revealing. The popular founder portrait favors the inventor alone with the machine. Enterprise security is a more social trade. Someone must persuade engineers, security teams, procurement officers and executives that the same invisible problem deserves action. Then the product must survive contact with all of them.
Sales, in this setting, is partly an exercise in compression. An engineer may see a dependency tree, a security analyst a vulnerability score, a lawyer a license obligation and a finance chief an unplanned expense. The operator has to make those views meet without pretending they are identical. WhiteSource's early promise of automatic, continuous checks was powerful because it converted an argument into a routine. The software could watch while people kept working.
That emphasis also explains Cohen's longstanding attention to the developer. In a 2019 conversation about application security, he described developers taking a larger role in day-to-day security as the old model of a separate team testing just before release became irrelevant. The observation has aged well. Modern development is continuous; a ceremonial inspection at the end is like checking the brakes after the car has left town.
His public ambition outside his operating roles has been to help young entrepreneurs with exciting technology reach fast growth. He has been an angel investor and a board member in New York's startup community. The advice implicit in his own history would be wonderfully unfashionable: study the tedious part. The ugly spreadsheet, the unresolved ownership question, the audit everyone resents. Friction is often evidence.
There is a second lesson in his route back to Mend.io. Careers need not form a straight ascent to be coherent. Cohen moved from founder to corporate executive, back to founder, over to another CEO post, through an acquisition, into advisory work, and home again. The thread was not a title. It was a repeated kind of problem: important systems becoming too complex for manual judgment alone, while organizations still needed a humanly understandable way to govern them.
Cohen's 2017 stage prophecy pictured a distant computer war. His 2026 job is less cinematic and more consequential: organize the everyday controls before the software ships, while the amount of software keeps rising. The old chore has grown new limbs. The bet is that it can still be made manageable.