# Software composition analysis: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "software composition analysis tool" and as "open source dependency vulnerability scanner", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/developer/software-composition-analysis/2026-09

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/developer/software-composition-analysis/index.md

**Standing:** Trivy leads with 40% of first choices; verdict contested. 43 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Trivy](https://www.gane.ai/index/it/vendors/trivy/index.md) | 40% | 3% | 30 |
| 2 | [Snyk Open Source](https://www.gane.ai/index/it/vendors/snyk-open-source/index.md) | 16% | 15% | 47 |
| 3 | [Mend.io – Mend SCA](https://www.gane.ai/index/it/vendors/mend-io-mend-sca/index.md) | 14% | 15% | 34 |
| 4 | [OWASP Dependency-Check](https://www.gane.ai/index/it/vendors/owasp-dependency-check/index.md) | 14% | 38% | 32 |
| 7 | [OWASP Dependency-Track](https://www.gane.ai/index/it/vendors/owasp-dependency-track/index.md) | 2% | 0% | 11 |
| 10 | [Endor Labs](https://www.gane.ai/index/it/vendors/endor-labs/index.md) | 0% | 0% | 19 |
| 11 | [Black Duck](https://www.gane.ai/index/it/vendors/black-duck/index.md) | 0% | 18% | 34 |
| 12 | [Sonatype Lifecycle](https://www.gane.ai/index/it/vendors/sonatype-lifecycle/index.md) | 0% | 19% | 31 |
| 13 | [FOSSA](https://www.gane.ai/index/it/vendors/fossa/index.md) | 0% | 0% | 18 |
| 14 | [Grype](https://www.gane.ai/index/it/vendors/grype/index.md) | 0% | 7% | 14 |
| 15 | [OSV-Scanner](https://www.gane.ai/index/it/vendors/osv-scanner/index.md) | 0% | 0% | 13 |
| 17 | [GitHub Advanced Security](https://www.gane.ai/index/it/vendors/github-advanced-security/index.md) | 0% | 15% | 13 |

Rank is by share of first choices among all 46 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Mend.io – Mend SCA, Snyk Open Source; alternatives Black Duck, GitHub Advanced Security, Sonatype Lifecycle
- Gemini 3.5 Flash: Aikido Security; alternatives Mend.io – Mend SCA, Semgrep Supply Chain, Snyk Open Source
- Perplexity Sonar: Mend.io – Mend SCA; alternatives Black Duck, Endor Labs, Snyk Open Source, Sonatype Lifecycle
- Grok 4.20: Snyk Open Source; alternatives Aikido Security, Black Duck, Mend.io – Mend SCA, SOOS
- Mistral Small: Mend.io – Mend SCA; alternatives OX Security, Sonatype Lifecycle
- DeepSeek V4 Flash: Snyk Open Source; alternatives Mend.io – Mend SCA, Sonatype Lifecycle
- Llama 4 Maverick: Mend.io – Mend SCA; alternatives Sonatype Lifecycle
- Qwen 3.7 Flash: Mend.io – Mend SCA; alternatives Renovate, Snyk Open Source
- Kimi K2: Snyk Open Source; alternatives Mend.io – Mend SCA, Sonatype Lifecycle
- GLM 4.7 FlashX: Mend.io – Mend SCA; alternatives Black Duck, Snyk Open Source, Sonatype Lifecycle
- MiniMax M2.5: Snyk Open Source; alternatives Black Duck, GitLab Dependency Scanning, Mend.io – Mend SCA

## Sources the answers cite

63 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- endorlabs.com: 46 answers, 81 citations
- ox.security: 27 answers, 28 citations
- guideflow.com: 27 answers, 27 citations
- safeguard.sh: 26 answers, 56 citations
- appsecsanta.com: 24 answers, 44 citations
- toolradar.com: 24 answers, 24 citations
- aikido.dev: 23 answers, 29 citations
- cycode.com: 19 answers, 20 citations

Pages named in the most answers:

- https://endorlabs.com/learn/best-sca-tools-05b7a (43 answers)
- https://endorlabs.com/learn/best-sca-tools (28 answers)
- https://ox.security/blog/software-composition-analysis-and-sca-tools (27 answers)
- https://toolradar.com/blog/best-software-composition-analysis-tools (23 answers)
- https://guideflow.com/blog/software-composition-analysis-tools (22 answers)
- https://dupple.com/learn/best-software-composition-analysis-tools (17 answers)
- https://expertinsights.com/application-security/the-top-software-composition-analysis-tools (17 answers)
- https://appsecsanta.com/sca-tools/open-source-sca-tools (16 answers)
- https://appsecsanta.com/sca-tools (15 answers)
- https://pixee.ai/blog/best-sca-tools-2026 (13 answers)

## Warned against

- OWASP Dependency-Check: 12 of 32 labels negative. "You should actively avoid using the traditional OWASP Dependency-Check" (Qwen 3.7 Flash, paraphrase prompt)
- Snyk Open Source: 7 of 47 labels negative. "The industry heavyweight with top-tier developer UX, strong remediation suggestions, and a wide ecosystem, though it can be highly expensive." (Gemini 3.5 Flash, scale prompt)
- Black Duck: 6 of 34 labels negative. "like older versions of Black Duck or Sonatype Nexus IQ) can be slow to install, heavy on resources, or difficult to configure at scale" (Qwen 3.7 Flash, negative prompt)
- Mend.io – Mend SCA: 5 of 34 labels negative. "reachability) works well for Java/JavaScript but poorly for Python, Go... Internal benchmarks claim "+46% better" remediation but lack external validation." (Kimi K2, negative prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.