Mendix

Mendix builds a low-code platform that turns visual models into enterprise applications - web, mobile, whatever the deployment target. The core abstraction: drag-and-drop interfaces and reusable components replace hand-coded infrastructure, letting business stakeholders and developers ship production software without the traditional translation layer. The platform operates across financial services, manufacturing, retail, and public sector, where the stakes around data handling and access control are non-trivial. For security teams, the threat model is layered. You're not just defending a single runtime - you're securing a platform that generates and hosts applications others build on top of it. That means supply chain risk in components, tenant isolation across multi-tenant deployments, identity and access management for users who may not be security-literate, and the challenge of enforcing policy across a visual abstraction that still compiles to real infrastructure. The global footprint adds regulatory complexity: GDPR, sector-specific compliance in finance and government, and data residency requirements. Culturally, Mendix runs on monthly "Crafting Days" for technical experimentation and emphasizes craftsmanship over shipping velocity - useful signal for security engineers who care about doing things right rather than fast. The company operates globally and positions itself around democratizing software development, which in practice means building guardrails that let less-experienced developers not create vulnerabilities by default.