# Software composition analysis for enterprise buyers: what AI models recommend, October 2026

Gane Index, October 2026 Edition. Asked as "software composition analysis tool" and as "open source dependency vulnerability scanner", six framings each, to fourteen models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/developer/software-composition-analysis/2026-10/enterprise

This is the permanent record of the October 2026 Edition, published October 1, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/developer/software-composition-analysis/enterprise/index.md

**Standing:** Black Duck leads with 23% of first choices; verdict contested. 56 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Black Duck](https://www.gane.ai/index/it/vendors/black-duck/index.md) | 23% | 18% | 60 |
| 2 | [Sonatype Lifecycle](https://www.gane.ai/index/it/vendors/sonatype-lifecycle/index.md) | 21% | 9% | 45 |
| 3 | [Mend.io – Mend SCA](https://www.gane.ai/index/it/vendors/mend-io-mend-sca/index.md) | 14% | 24% | 49 |
| 4 | [Trivy](https://www.gane.ai/index/it/vendors/trivy/index.md) | 9% | 20% | 15 |
| 5 | [Snyk Open Source](https://www.gane.ai/index/it/vendors/snyk-open-source/index.md) | 5% | 32% | 60 |
| 6 | [OWASP Dependency-Track](https://www.gane.ai/index/it/vendors/owasp-dependency-track/index.md) | 5% | 0% | 11 |
| 7 | [JFrog Xray](https://www.gane.ai/index/it/vendors/jfrog-xray/index.md) | 4% | 12% | 17 |
| 8 | [Aikido Security](https://www.gane.ai/index/it/vendors/aikido-security/index.md) | 4% | 0% | 10 |
| 10 | [GitHub Advanced Security](https://www.gane.ai/index/it/vendors/github-advanced-security/index.md) | 4% | 30% | 20 |
| 11 | [OWASP Dependency-Check](https://www.gane.ai/index/it/vendors/owasp-dependency-check/index.md) | 4% | 63% | 19 |
| 14 | [Endor Labs](https://www.gane.ai/index/it/vendors/endor-labs/index.md) | 0% | 0% | 10 |
| 15 | [Checkmarx SCA](https://www.gane.ai/index/it/vendors/checkmarx-sca/index.md) | 0% | 18% | 17 |

Rank is by share of first choices among all 55 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Mend.io – Mend SCA; alternatives Black Duck, Snyk Open Source, Sonatype Lifecycle
- GPT-5.4 mini: Mend.io – Mend SCA; alternatives Black Duck, Snyk Open Source, Veracode SCA
- Gemini 3.5 Flash: Snyk Open Source; alternatives Black Duck, Endor Labs, FOSSA, GitHub Advanced Security
- Perplexity Sonar: Black Duck; alternatives Checkmarx SCA, Snyk Open Source, Sonatype Lifecycle
- Grok 4.20: Black Duck, Sonatype Lifecycle; alternatives Checkmarx SCA, JFrog Xray, Mend.io – Mend SCA, Snyk Open Source
- Mistral Small: Black Duck; alternatives GitHub Advanced Security, Snyk Open Source
- DeepSeek V4 Flash: Sonatype Lifecycle; alternatives Black Duck, Snyk Open Source
- Llama 4 Maverick: Black Duck, Mend.io – Mend SCA, Sonatype Lifecycle
- Qwen 3.7 Flash: Sonatype Lifecycle; alternatives Black Duck, Mend.io – Mend SCA, Snyk Open Source
- Kimi K2: Black Duck, Sonatype Lifecycle; alternatives Mend.io – Mend SCA, Snyk Open Source
- GLM 4.7 FlashX: Black Duck, Sonatype Lifecycle; alternatives Mend.io – Mend SCA, Snyk Open Source
- MiniMax M2.5: Black Duck, Sonatype Lifecycle; alternatives Checkmarx SCA, Mend.io – Mend SCA, OpenText Fortify
- GPT-6 Luna: Sonatype Lifecycle; alternatives Black Duck, JFrog Xray, Snyk Open Source
- Muse Glimmer 30B: Black Duck; alternatives Mend.io – Mend SCA, Snyk Open Source, Sonatype Lifecycle

## Sources the answers cite

78 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- guideflow.com: 53 answers, 55 citations
- sonatype.com: 42 answers, 75 citations
- mend.io: 36 answers, 60 citations
- appsecsanta.com: 29 answers, 42 citations
- endorlabs.com: 29 answers, 38 citations
- aikido.dev: 25 answers, 38 citations
- checkmarx.com: 24 answers, 26 citations
- expertinsights.com: 23 answers, 24 citations

Pages named in the most answers:

- https://guideflow.com/blog/software-composition-analysis-tools (49 answers)
- https://sonatype.com/compare/best-sca-tools (38 answers)
- https://endorlabs.com/learn/best-sca-tools-05b7a (24 answers)
- https://expertinsights.com/application-security/the-top-software-composition-analysis-tools (23 answers)
- https://checkmarx.com/learn/sca/sca-tools-key-capabilities-11-tools-to-watch-in-2026 (22 answers)
- https://mend.io/blog/best-software-composition-analysis-for-enterprise (20 answers)
- https://dupple.com/learn/best-software-composition-analysis-tools (17 answers)
- https://mend.io/blog/best-software-composition-analysis-sca-tools-top-solutions (16 answers)
- https://blog.jetbrains.com/qodana/2025/09/best-software-composition-analysis-tools (16 answers)
- https://cycode.com/blog/top-enterprise-sca-tools (16 answers)

## Warned against

- Snyk Open Source: 19 of 60 labels negative. "Avoid per-developer seat models (like Snyk or GitHub Advanced Security), as these can become unpredictable and expensive at scale" (Mistral Small, budget prompt)
- OWASP Dependency-Check: 12 of 19 labels negative. "Basic Repository-Native or Free Tools as your Sole Solution (e.g., OWASP Dependency-Check)... Why to avoid: They do not offer the centralized governance" (Gemini 3.5 Flash, negative prompt)
- Mend.io – Mend SCA: 12 of 49 labels negative. "Verdict: Avoid if your org has many language polyglots and requires deep policy customization." (DeepSeek V4 Flash, negative prompt)
- Black Duck: 11 of 60 labels negative. "Not recommended for your use case ... Quote-only, project/codebase-based pricing that's unpredictable at scale" (DeepSeek V4 Flash, budget prompt)

## Movement since September 2026

Floor: 11 points of share, measured on the calibration repeat.
New leader: Black Duck (19%) to Sonatype Lifecycle (22%). Margin 0 points, within noise.

- Aikido Security: 14% to 4%, −10. Inside the floor by 1 point · rank 3 → 7 of 47.
- OWASP Dependency-Track: 14% to 6%, −8. Inside the floor by 3 points · rank 4 → 6 of 47.
- Mend.io – Mend SCA: 10% to 14%, +4. Inside the floor by 7 points · rank 6 → 3 of 47.
- Snyk Open Source: 10% to 6%, −4. Inside the floor by 7 points · rank 5 of 47, unchanged.
- GitHub Advanced Security: 0% to 4%, +4. Inside the floor by 7 points · rank 18 → 9 of 47.
- Sonatype Lifecycle: 19% to 22%, +3. Inside the floor by 8 points · rank 2 → 1 of 47.
- Black Duck: 19% to 22%, +3. Inside the floor by 8 points · rank 1 → 2 of 47.
- Trivy: 7% to 8%, +1. Inside the floor by 10 points · rank 7 → 4 of 47.
- OWASP Dependency-Check: 5% to 4%, −1. Inside the floor by 10 points · rank 8 → 10 of 47.
- JFrog Xray: 2% to 2%, ±0. Inside the floor by 11 points · rank 9 → 11 of 47.
- Endor Labs: 0% to 0%, ±0. Inside the floor by 11 points · rank 10 → 13 of 47.
- Checkmarx SCA: 0% to 0%, ±0. Inside the floor by 11 points · rank 12 → 14 of 47.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, October 2026 Edition, www.gane.ai/index/it.