The meeting had all the ingredients of a successful software acquisition: an interested buyer, a company worth buying, and a roomful of people who would rather discuss almost anything except the spreadsheet of open-source components hidden inside the code. Ron Rymon had built Eurekify to help large organizations understand who could access what. Now, during its sale to CA, the makers had to understand precisely what they themselves had used.
The audit was not a philosophical exercise. Every library needed a name. Every license needed an explanation. Rymon later recalled weeks of work and very long nights, with negotiations by day and the open-source report after hours. A process meant to reduce the buyer's risk had created an extravagant new risk: everyone involved might expire from boredom before the deal closed.
Eurekify was acquired in 2008. The misery should have ended there. Instead, Rymon kept it. He and two colleagues from the company, Rami Sass and Azi Cohen, eventually made the ordeal the founding problem for WhiteSource. Their question was simple enough to be rude: why did finding open-source code, licenses, and vulnerabilities require a method so spectacularly unsuited to the way software was now being built?
“Building products that provide value to customers are the key to everything I do.”Ron Rymon
Before the company, the laboratory
The founder who asked that question had arrived by an uncommon route. Rymon began in software development, then left commercial work for roughly a decade in academia. At the University of Pennsylvania he studied artificial intelligence and machine learning, earning a doctorate in computer science in 1993. His research with Bonnie Webber and John Clarke examined “progressive horizon planning”: how a system can act, learn what happened, and revise the next portion of its plan instead of pretending it can foresee the entire world.
That is a useful idea for an entrepreneur, even if it was not written as startup advice. Make a plan far enough ahead to move. Observe. Correct. Rymon went on to the University of Pittsburgh faculty and published work on machine learning and logical rules. He later taught network and computer security at the Interdisciplinary Center in Herzliya, now Reichman University. The academic chapter gave him more than a credential. It trained an appetite for problems whose complexity could be formalized, then made practical.
Eurekify was the first large translation. It took role mining - the difficult business of finding patterns in users, permissions, and enterprise resources - and made it a product. The public patent record bears Rymon's name on methods for grouping roles by shared resource use. CA bought the company, and Rymon later served as a vice president of strategy there. He had crossed from theory to product, then from product to a much larger organization. The troublesome audit supplied the seed for another crossing.
A scanner that respected the clock
WhiteSource began in 2011, just as agile development and DevOps were turning software into a continuous activity. Legacy scanning projects still behaved like ceremonial inspections. They could take weeks before producing a useful result. Rymon argued that scanning snippets was inaccurate, expensive, and wasteful - a method capable of spending one hundred times the necessary energy while stopping development in its tracks.
The early company faced a sales problem disguised as a technical disagreement. Customers had learned to recognize the old method as the category itself. Telling them the category was wrong did not automatically loosen a budget. So the founders made evaluation fast. A prospect could deploy the product and see results in minutes. The demonstration did the difficult work of the argument.
The patents attached to the work reveal what “fast” had to contain. One method identifies an open-source library from a characteristic of source code without receiving the source entity itself. A later patent moves from known components to the finer-grained pieces that are actually reachable, then checks those pieces for stored vulnerabilities. Privacy, identification, and priority sit in the same mechanism. The distinction is important: a dependency somewhere in an application is not automatically a dependency an attacker can reach. Security teams drowning in alerts do not need a longer list. They need help deciding which item deserves the next hour.
This was not merely clever selling. It expressed Rymon's preferred measure of success. He has said he counts the customers using products he contributed to as his most important metric. Usage is an unforgiving accountant. It cares whether the installation works, whether the result arrives in time, and whether a developer can return to developing. A brilliant detection engine that nobody can tolerate remains an expensive opinion.
By 2018, WhiteSource had raised a $35 million round. In 2021 it raised $75 million more, bringing reported funding to $121.2 million. The company said its customer count had increased fivefold in three years while revenue rose 800 percent. Funding is an imperfect proxy for usefulness, but the growth suggested that the original annoyance was not peculiar to one acquisition. It was a structural feature of modern software.
Reported cumulative funding
The taller bar is capital, not applause. It bought room to expand from open-source inventory toward broader application security.
The repeatable part of a repeat founder
WhiteSource was not Rymon's only second act. He founded LetMobile, which used a secure gateway to protect enterprise email and content without forcing people into an alien mobile workspace. LANDESK acquired it in 2014. He also co-founded TestCraft, a codeless, Selenium-based test-automation company designed to let less technical team members create and maintain web tests. Perforce acquired that business in 2020.
The products live in different drawers of the enterprise cabinet - identity, mobility, software composition, testing - but the same hand keeps opening them. Each takes specialist labor and asks whether software can make it accessible, continuous, and less intrusive. Rymon is especially fond of the earliest stage, when vision and technology must be assembled and the product is still an argument about what ought to exist.
His habits are practical. He has described beginning the day by catching up on what happened on the other side of the globe, then choosing two or three targets. Ideally, each is a key opportunity or blocker for one of his companies. The system lacks decorative complexity. A short list is harder to hide inside.
“I often count the number of customers that use products that I contributed to as my most important success metric.”Ron Rymon
His account of hiring is equally revealing. First, he asks whether he would enjoy working with the person. Life, in his formulation, is too short for the alternative. Trustworthiness comes next. Intelligence matters, perhaps too much: he has admitted that he can overrate smart people who are not productive. This is less a management doctrine than the honest inventory of someone who has spent enough years in companies to know that brilliance can be a dazzling substitute for motion.
Rymon also seeks extra opinions even when he believes he knows the answer. He credits the computer scientist Bonnie Webber and the entrepreneur Roni Einav as important mentors, while saying he continues to learn from co-founders and partners. Conviction gets better publicity in startup culture. Listening is often more useful, especially when the company has mistaken a familiar practice for a natural law.
From WhiteSource to Mend
The company eventually outgrew the name WhiteSource. Rebranded as Mend.io in 2022, it widened from software-composition analysis into static analysis, dependency automation, container and cloud-native security, and the broader work of application security. In late 2023 it acquired Atom Security, the fifth acquisition in three years, to deepen cloud-native risk assessment and reduce irrelevant findings.
Mend's current language extends again, this time toward AI applications: red teaming, system-prompt hardening, runtime guardrails, AI bills of materials, and security for generated code. Rymon's title is now co-founder and board member rather than day-to-day chief executive. The institutional question, however, still rhymes with the original one. How can a company find consequential risk amid a quantity of code and alerts that no person can sensibly inspect by hand?
There is a temptation to make a founder's career look inevitable once the rounds are raised and the acquisitions announced. Rymon's own description is less tidy. Entrepreneurship, he says, delivers multiple successes and failures in the same 24 hours. His recurring failure has been explaining new technology and persuading the first customers to use it. His solution has not been a grand theory of persuasion. It has been to make the value quicker to encounter.
The best clue to his aspirations is also his simplest advice: “Do what you like and like what you do.” For Rymon, that seems to mean staying near the moment when an unpleasant, technical chore becomes an interesting product question. The audit is over. The useful annoyance remains.