# Software composition analysis for enterprise buyers: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "software composition analysis tool" and as "open source dependency vulnerability scanner", six framings each, to twelve models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/developer/software-composition-analysis/2026-09/enterprise

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/developer/software-composition-analysis/enterprise/index.md

**Standing:** Black Duck (tied with Sonatype Lifecycle) leads with 19% of first choices; verdict contested. 42 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Black Duck](https://www.gane.ai/index/it/vendors/black-duck/index.md) | 19% | 6% | 47 |
| 2 | [Sonatype Lifecycle](https://www.gane.ai/index/it/vendors/sonatype-lifecycle/index.md) | 19% | 8% | 40 |
| 3 | [Aikido Security](https://www.gane.ai/index/it/vendors/aikido-security/index.md) | 14% | 0% | 12 |
| 4 | [OWASP Dependency-Track](https://www.gane.ai/index/it/vendors/owasp-dependency-track/index.md) | 14% | 0% | 10 |
| 5 | [Snyk Open Source](https://www.gane.ai/index/it/vendors/snyk-open-source/index.md) | 10% | 19% | 47 |
| 6 | [Mend.io – Mend SCA](https://www.gane.ai/index/it/vendors/mend-io-mend-sca/index.md) | 10% | 17% | 41 |
| 7 | [Trivy](https://www.gane.ai/index/it/vendors/trivy/index.md) | 7% | 0% | 15 |
| 8 | [OWASP Dependency-Check](https://www.gane.ai/index/it/vendors/owasp-dependency-check/index.md) | 5% | 61% | 18 |
| 9 | [JFrog Xray](https://www.gane.ai/index/it/vendors/jfrog-xray/index.md) | 2% | 16% | 19 |
| 10 | [Endor Labs](https://www.gane.ai/index/it/vendors/endor-labs/index.md) | 0% | 5% | 22 |
| 11 | [Veracode SCA](https://www.gane.ai/index/it/vendors/veracode-sca/index.md) | 0% | 7% | 15 |
| 12 | [Checkmarx SCA](https://www.gane.ai/index/it/vendors/checkmarx-sca/index.md) | 0% | 7% | 15 |

Rank is by share of first choices among all 48 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Mend.io – Mend SCA, Sonatype Lifecycle; alternatives Black Duck, Checkmarx SCA, Snyk Open Source
- GPT-5.4 mini: Sonatype Lifecycle; alternatives Black Duck, Palo Alto Networks Cortex Cloud SCA, Snyk Open Source, Veracode SCA
- Gemini 3.5 Flash: Black Duck; alternatives FOSSA, GitHub Advanced Security, GitLab Dependency Scanning, Snyk Open Source
- Perplexity Sonar: Sonatype Lifecycle; alternatives Black Duck, Checkmarx SCA, Mend.io – Mend SCA, Snyk Open Source
- Grok 4.20: Black Duck, Sonatype Lifecycle; alternatives Snyk Open Source
- Mistral Small: Snyk Open Source, Sonatype Lifecycle; alternatives Black Duck, Mend.io – Mend SCA
- DeepSeek V4 Flash: Black Duck, Snyk Open Source; alternatives Endor Labs, Mend.io – Mend SCA, Sonatype Lifecycle
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Mend.io – Mend SCA; alternatives Black Duck, Snyk Open Source, Sonatype Lifecycle
- Kimi K2: Black Duck; alternatives Snyk Open Source, Sonatype Lifecycle
- GLM 4.7 FlashX: Black Duck; alternatives Endor Labs, Mend.io – Mend SCA, Snyk Open Source, Sonatype Lifecycle
- MiniMax M2.5: Black Duck; alternatives Mend.io – Mend SCA, Snyk Open Source

## Sources the answers cite

66 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- endorlabs.com: 45 answers, 66 citations
- guideflow.com: 39 answers, 39 citations
- cycode.com: 36 answers, 41 citations
- safeguard.sh: 28 answers, 53 citations
- mend.io: 25 answers, 31 citations
- ox.security: 24 answers, 26 citations
- aikido.dev: 23 answers, 38 citations
- blackduck.com: 23 answers, 37 citations

Pages named in the most answers:

- https://endorlabs.com/learn/best-sca-tools-05b7a (42 answers)
- https://cycode.com/blog/top-enterprise-sca-tools (31 answers)
- https://guideflow.com/blog/software-composition-analysis-tools (30 answers)
- https://ox.security/blog/software-composition-analysis-and-sca-tools (23 answers)
- https://dupple.com/learn/best-software-composition-analysis-tools (19 answers)
- https://endorlabs.com/learn/best-sca-tools (19 answers)
- https://expertinsights.com/application-security/the-top-software-composition-analysis-tools (19 answers)
- https://sonatype.com/compare/best-sca-tools (18 answers)
- https://toolradar.com/blog/best-software-composition-analysis-tools (18 answers)
- https://dev.to/alexcybersmith/top-enterprise-sca-tools-in-2026-a-developers-comparison-3gnb (13 answers)

## Warned against

- OWASP Dependency-Check: 11 of 18 labels negative. "Avoid as your primary enterprise SCA; use only as a supplementary check for legacy Java-only codebases." (DeepSeek V4 Flash, negative prompt)
- Snyk Open Source: 9 of 47 labels negative. "Avoid tools like Snyk, Socket, or Semgrep if your primary goal is cost prediction" (Qwen 3.7 Flash, budget prompt)
- Mend.io – Mend SCA: 7 of 41 labels negative. "Same scaling problem; thousands of users = unpredictable ballooning costs" (Kimi K2, budget prompt)
- FOSSA: 3 of 16 labels negative. "What to Avoid for Your Use Case ... FOSSA | Per-project or per-developer hybrid" (Kimi K2, budget prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.