# Software composition analysis for small business buyers: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "software composition analysis tool" and as "open source dependency vulnerability scanner", six framings each, to twelve models with search on, on behalf of a small B2B company. Page: https://www.gane.ai/index/it/developer/software-composition-analysis/2026-09/smb

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/developer/software-composition-analysis/smb/index.md

**Standing:** Trivy leads with 36% of first choices; verdict contested. 42 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Trivy](https://www.gane.ai/index/it/vendors/trivy/index.md) | 36% | 2% | 48 |
| 2 | [Snyk Open Source](https://www.gane.ai/index/it/vendors/snyk-open-source/index.md) | 33% | 4% | 50 |
| 3 | [GitHub Dependabot](https://www.gane.ai/index/it/vendors/github-dependabot/index.md) | 5% | 12% | 17 |
| 4 | [OWASP Dependency-Check](https://www.gane.ai/index/it/vendors/owasp-dependency-check/index.md) | 5% | 32% | 31 |
| 6 | [Semgrep Supply Chain](https://www.gane.ai/index/it/vendors/semgrep-supply-chain/index.md) | 2% | 5% | 20 |
| 7 | [OSV-Scanner](https://www.gane.ai/index/it/vendors/osv-scanner/index.md) | 2% | 0% | 11 |
| 12 | [Mend.io – Mend SCA](https://www.gane.ai/index/it/vendors/mend-io-mend-sca/index.md) | 2% | 41% | 22 |
| 13 | [Socket](https://www.gane.ai/index/it/vendors/socket/index.md) | 0% | 0% | 22 |
| 14 | [FOSSA](https://www.gane.ai/index/it/vendors/fossa/index.md) | 0% | 0% | 20 |
| 39 | [Endor Labs](https://www.gane.ai/index/it/vendors/endor-labs/index.md) | 0% | 33% | 12 |
| 45 | [Sonatype Lifecycle](https://www.gane.ai/index/it/vendors/sonatype-lifecycle/index.md) | 0% | 75% | 12 |
| 46 | [Black Duck](https://www.gane.ai/index/it/vendors/black-duck/index.md) | 0% | 80% | 20 |

Rank is by share of first choices among all 46 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: SonarQube; alternatives Libraries.io
- GPT-5.4 mini: Snyk Open Source; alternatives OWASP Dependency-Track, Trivy
- Gemini 3.5 Flash: Aikido Security; alternatives FOSSA, Jit, Semgrep Supply Chain, Snyk Open Source
- Perplexity Sonar: Snyk Open Source; alternatives FOSSA, Mend.io – Mend SCA, Trivy
- Grok 4.20: Snyk Open Source; alternatives GitHub Dependabot, OWASP Dependency-Check, Trivy
- Mistral Small: Snyk Open Source; alternatives Semgrep, Trivy
- DeepSeek V4 Flash: Snyk Open Source; alternatives GitHub Dependabot, Mend.io – Mend SCA, SOOS
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Snyk Open Source; alternatives GitHub Dependabot, Trivy
- Kimi K2: Snyk Open Source; alternatives GitHub Dependabot, Trivy
- GLM 4.7 FlashX: Snyk Open Source; alternatives GitHub Advanced Security, Mend.io – Mend SCA, Semgrep Supply Chain, Socket
- MiniMax M2.5: Snyk Open Source; alternatives FOSSA

## Sources the answers cite

64 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- endorlabs.com: 50 answers, 79 citations
- dupple.com: 32 answers, 32 citations
- toolradar.com: 30 answers, 31 citations
- appsecsanta.com: 28 answers, 54 citations
- guideflow.com: 27 answers, 27 citations
- aikido.dev: 24 answers, 30 citations
- safeguard.sh: 23 answers, 47 citations
- cycode.com: 21 answers, 22 citations

Pages named in the most answers:

- https://endorlabs.com/learn/best-sca-tools-05b7a (45 answers)
- https://dupple.com/learn/best-software-composition-analysis-tools (32 answers)
- https://endorlabs.com/learn/best-sca-tools (31 answers)
- https://toolradar.com/blog/best-software-composition-analysis-tools (29 answers)
- https://guideflow.com/blog/software-composition-analysis-tools (23 answers)
- https://appsecsanta.com/sca-tools/open-source-sca-tools (19 answers)
- https://cycode.com/blog/top-enterprise-sca-tools (19 answers)
- https://ox.security/blog/software-composition-analysis-and-sca-tools (19 answers)
- https://expertinsights.com/application-security/the-top-software-composition-analysis-tools (18 answers)
- https://blog.jetbrains.com/qodana/2025/09/best-software-composition-analysis-tools (17 answers)

## Warned against

- Black Duck: 16 of 20 labels negative. "Black Duck has a high price and minimum licensing requirements that can be prohibitive for small teams or startups." (Claude Haiku 4.5, negative prompt)
- Sonatype Lifecycle: 9 of 12 labels negative. "PeerSpot users call it "high" and "suitable only for enterprises," not small businesses." (Grok 4.20, negative prompt)
- OWASP Dependency-Check: 10 of 31 labels negative. "It generally has a higher false-positive rate and a less modern user interface compared to Trivy or Semgrep." (GLM 4.7 FlashX, budget prompt)
- Mend.io – Mend SCA: 9 of 22 labels negative. "premature and pricey for a small business ... rather than locking into an enterprise contract like Black Duck or Mend prematurely" (DeepSeek V4 Flash, negative prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.