The awkward question arrived when a software company was being sold. What open source components were inside its product? Rami Sass, then leading engineering at Eurekify, had helped build the software. Producing its ingredient list turned out to be another job altogether. An acquisition has many opportunities to make a person nervous. Discovering how much of your own product you cannot readily account for is a particularly efficient one.
The inventory became part of the due diligence work. Packages had to be tracked down, their licenses understood, their dependencies untangled. Sass later recalled spending a month on the exercise. The transaction went through. The experience stayed with him.
That is a useful place to begin his story: with a competent engineering team confronting an administrative request that exposed a technical blind spot. The code worked. Explaining everything inside it was harder.
An engineer before the corner office
Before there was a company called Mend.io, there was a career spent making enterprise software behave. Sass led development efforts at Eurekify and subsequently at CA, the company that acquired it. He also founded Testology. He holds a BA and an MSc in computer science and studied at the Hebrew University of Jerusalem.
These are useful coordinates for understanding his later business. His background includes the engineering and product management work that sits between an algorithm and something a customer can actually install. Security management and compliance were already familiar territory. The inventory problem arrived inside that working life, rather than as an abstract market opportunity.
In 2011, he founded WhiteSource with Azi Cohen and Ron Rymon. Their proposition grew from the earlier difficulty: automate the work surrounding open source use. It was a business built around a task that software teams needed done, and that their existing habits had made surprisingly troublesome.
“I'm basically a software engineer by training and history.”
Rami Sass, 2021
The guests your code brings along
Open source made a productive bargain available to software developers. Instead of writing every function themselves, they could use components other people had already built. The complication was that a component could depend on another component. An application accumulated relationships as well as code. The guest had brought guests.
WhiteSource set out to make that borrowed material visible and manageable. Its work connected an inventory of components with information about vulnerabilities and licenses. For the people shipping software, the practical question was which borrowed pieces required attention, and what to do about them.
Sass has resisted the easy conclusion that a language with many reported vulnerabilities should therefore be abandoned. Asked about WhiteSource research into programming languages in 2019, he argued for continuing to choose the language suited to the product while tracking components and applying fixes. A large count needed context, including how widely a language was used. The point was to manage the exposure, rather than turn a table of reported flaws into a beauty contest for programming languages.
That is a less dramatic message than banning the offending ingredient. It is also a more useful one for someone with software to ship on Friday.
A business grows around the inventory
The problem proved large enough to support a company across several countries. In 2017, WhiteSource raised a $10 million Series B led by 83North, with Microsoft Ventures participating. Microsoft had already been a partner. The investment connected the young business to a company whose own developers and enterprise customers had ample reason to care about software dependencies.
In 2021 came a $75 million Series D led by Pitango Growth, alongside existing investors. These are company financing figures, a measure of the resources available to expand the business. They also mark how far the original inventory problem had travelled from a single acquisition exercise.
By then, the pitch was moving beyond an alert about a risky component. Prioritization and prevention were becoming part of the work. A list can establish that trouble exists. Someone still has to decide what deserves the next hour of an engineer's time.
- 2011Know the componentsWhiteSource is founded.
- 2022Help fix the codeWhiteSource becomes Mend.
- 2025Secure the AI layerSass becomes GM of Mend AI.
A shorter name, a longer to-do list
WhiteSource became Mend in May 2022. The shorter name carried a more demanding promise: help people fix the software. Under Sass, the company had expanded through acquisitions, including Diffend in 2021 and the static analysis businesses Xanitizer and DefenseCode in 2022. Its scope now included proprietary code alongside open source components.
The rebrand gave that expansion a plain English verb. Mend is what you do after finding the tear. It also creates a fairly unforgiving standard for a security product. Customers can reasonably ask whether anything has actually been repaired.
Sass's argument was that detection alone left too much work with development teams. Automated remediation could put suggested fixes into their existing workflow. He also connected the name to the relationship between development and security: two groups with overlapping interests and plenty of opportunities to irritate each other.
By December 2022, he was writing about a Mend SCA integration with Amazon CodeCatalyst. Vulnerability information could appear within the development environment itself, including information about direct and transitive dependencies. This is the kind of detail that makes the strategy tangible. A tool has a better chance of influencing a decision when it appears where the decision is being made.
Who owns the problem on Monday morning?
Sass's account of security has room for the ordinary pressures of work. Engineers have features to finish and bugs to fix. Security managers have risks to reduce. Legal teams have licensing and contractual obligations to consider. Giving everyone the same warning does little to settle who should act first.
In his 2021 conversation with Matias Madou, he described the importance of prioritization when an upgrade might break existing software. A component can contain a vulnerability without an application calling the vulnerable function. Understanding that distinction helps teams decide which changes are urgent. It makes security a question of consequences and sequencing, rather than a competition to produce the longest report.
His later writing carried the responsibility question upward. In April 2023, he published an argument about application security ownership. In June 2024, he wrote about making it a board priority. The titles alone show the widening audience: this was a conversation for the people governing a business as well as the people building its software.
Meanwhile, the product packaging changed. Sass described the September 2024 move to a unified platform covering several security functions under one price. His complaint was familiar to anyone who has assembled enterprise software: buying separate tools creates another integration job. The person selling help with dependencies was now arguing against creating a fresh dependency problem in the purchasing process.
There is also a Nintendo Switch
Away from the corporate vocabulary, Sass can sound pleasantly unceremonious about how he arrived here. Asked in 2020 how WhiteSource began, he answered: “It's mostly by accident, I think.” That modest description leaves room for the awkward work that followed a fortunate idea.
He also volunteered a domestic detail: his family enjoyed Overcooked! 2 on a Nintendo Switch. He played with his children. The game involves a shared kitchen, competing demands and the need to get things out on time. Any resemblance to a software release meeting is available for the reader to enjoy.
His public writing has a similarly playful edge. On LinkedIn, he has poked fun at the many incompatible meanings packed into the phrase AI security. He has also described the changing engineering job through the prospect of supervising autonomous agents. The humor serves an explanatory purpose. A slippery phrase becomes easier to examine once someone admits how slippery it sounds.
The founder takes a different desk
In December 2025, Mend.io announced a leadership transition. Azi Cohen, its co-founder and president, became CEO. Sass moved into the role of general manager for Mend AI. He remained inside the company he had helped start, with a more concentrated assignment.
It is a consequential turn in a founder's career. A long tenure as CEO can become the entire public description of a person. Here the work continued under a different title, focused on a product area whose questions were still being worked out. The announcement described Sass and Cohen working closely through the change.
A February 2026 update put numbers around the setting: Mend.io reported 20 percent annual revenue growth, 25 percent growth in new customer logos and adoption of Mend AI by 15 percent of its installed customer base. Those were the company's figures at that point, rather than a forecast of where the AI business would end up.
revenue growth
customer logos
adoption of Mend AI
Sass's stated ambition was to secure human-written and AI-generated code while managing embedded AI components. The original concern about software ingredients had acquired a new class of ingredient, capable of behaving in unfamiliar ways.
When an ingredient starts making decisions
His 2026 discussions with Amanda Glassner at RSAC brought the new assignment into focus. Conventional application security had grown accustomed to code that could be inspected and tested against relatively stable expectations. AI complicates those expectations. The same input can produce different outputs. An agent can act with permissions whose consequences its owner has underestimated. A model's internal workings are difficult to examine using the tools built for ordinary source code.
These were the practical differences Sass highlighted in a discussion published by Mend.io in May. The concern was about how applications behave once models and agents become part of them. Knowing an AI component is present is a beginning; understanding what it can do requires further work.
In a companion conversation, he returned to collaboration with developers and DevOps, and to configuration choices made while building a system. The new technology had brought him back to familiar organizational ground. Security decisions made early can shape what becomes possible later.
There is a continuity in that career, despite the new name on the company and the new title on his desk. Sass keeps returning to the moment when a useful shortcut becomes someone else's responsibility. A borrowed library saves effort. An AI agent performs work. Each deserves questions before it is trusted inside a product. Years after the acquisition audit, the ingredient list is still worth reading. Some of the ingredients can now read it back.