# Software composition analysis: what AI models recommend, October 2026

Gane Index, October 2026 Edition. Asked as "software composition analysis tool" and as "open source dependency vulnerability scanner", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/developer/software-composition-analysis/2026-10

This is the permanent record of the October 2026 Edition, published October 1, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/developer/software-composition-analysis/index.md

**Standing:** Trivy leads with 31% of first choices; verdict contested. 51 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Trivy](https://www.gane.ai/index/it/vendors/trivy/index.md) | 31% | 11% | 27 |
| 2 | [Snyk Open Source](https://www.gane.ai/index/it/vendors/snyk-open-source/index.md) | 16% | 16% | 55 |
| 3 | [Mend.io – Mend SCA](https://www.gane.ai/index/it/vendors/mend-io-mend-sca/index.md) | 14% | 19% | 37 |
| 4 | [OWASP Dependency-Track](https://www.gane.ai/index/it/vendors/owasp-dependency-track/index.md) | 8% | 0% | 21 |
| 5 | [OWASP Dependency-Check](https://www.gane.ai/index/it/vendors/owasp-dependency-check/index.md) | 8% | 23% | 35 |
| 6 | [GitHub Dependabot](https://www.gane.ai/index/it/vendors/github-dependabot/index.md) | 8% | 18% | 17 |
| 7 | [Sonatype Lifecycle](https://www.gane.ai/index/it/vendors/sonatype-lifecycle/index.md) | 2% | 9% | 32 |
| 8 | [GitHub Advanced Security](https://www.gane.ai/index/it/vendors/github-advanced-security/index.md) | 2% | 6% | 18 |
| 9 | [OSV-Scanner](https://www.gane.ai/index/it/vendors/osv-scanner/index.md) | 2% | 0% | 12 |
| 10 | [Socket](https://www.gane.ai/index/it/vendors/socket/index.md) | 2% | 0% | 12 |
| 15 | [Grype](https://www.gane.ai/index/it/vendors/grype/index.md) | 0% | 0% | 16 |
| 16 | [Endor Labs](https://www.gane.ai/index/it/vendors/endor-labs/index.md) | 0% | 0% | 14 |

Rank is by share of first choices among all 51 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Mend.io – Mend SCA; alternatives Black Duck, Endor Labs, FOSSA, Snyk Open Source
- GPT-5.4 mini: Snyk Open Source; alternatives FOSSA, OWASP Dependency-Check, OWASP Dependency-Track
- Gemini 3.5 Flash: Aikido Security; alternatives Endor Labs, Mend.io – Mend SCA, Snyk Open Source
- Perplexity Sonar: Mend.io – Mend SCA; alternatives Black Duck, Snyk Open Source, Sonatype Lifecycle
- Grok 4.20: Snyk Open Source; alternatives Mend.io – Mend SCA, Sonatype Lifecycle
- Mistral Small: Mend.io – Mend SCA; alternatives GitHub Advanced Security, Insignary Clarity
- DeepSeek V4 Flash: Snyk Open Source; alternatives Mend.io – Mend SCA, Sonatype Lifecycle
- Llama 4 Maverick: Mend.io – Mend SCA
- Qwen 3.7 Flash: Mend.io – Mend SCA; alternatives GitHub Advanced Security, Snyk Open Source
- Kimi K2: Mend.io – Mend SCA, Snyk Open Source; alternatives GitHub Advanced Security, GitHub Dependabot, Sonatype Lifecycle, Trivy
- GLM 4.7 FlashX: GitHub Advanced Security, Snyk Open Source; alternatives Black Duck, Endor Labs, FOSSA, Mend.io – Mend SCA
- MiniMax M2.5: Snyk Open Source, Sonatype Lifecycle; alternatives Black Duck, FOSSA, GitHub Advanced Security
- GPT-6 Luna: Snyk Open Source; alternatives GitHub's built-in supply-chain tools, Mend.io – Mend SCA, Sonatype Lifecycle
- Muse Glimmer 30B: Mend.io – Mend SCA; alternatives Snyk Open Source, Sonatype Lifecycle

## Sources the answers cite

79 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- guideflow.com: 42 answers, 44 citations
- sonatype.com: 34 answers, 48 citations
- endorlabs.com: 32 answers, 45 citations
- mend.io: 28 answers, 34 citations
- checkmarx.com: 28 answers, 30 citations
- safeguard.sh: 27 answers, 43 citations
- dupple.com: 25 answers, 25 citations
- appsecsanta.com: 24 answers, 32 citations

Pages named in the most answers:

- https://guideflow.com/blog/software-composition-analysis-tools (38 answers)
- https://sonatype.com/compare/best-sca-tools (33 answers)
- https://endorlabs.com/learn/best-sca-tools-05b7a (28 answers)
- https://dupple.com/learn/best-software-composition-analysis-tools (25 answers)
- https://checkmarx.com/learn/sca/sca-tools-key-capabilities-11-tools-to-watch-in-2026 (24 answers)
- https://expertinsights.com/application-security/the-top-software-composition-analysis-tools (23 answers)
- https://ox.security/blog/software-composition-analysis-and-sca-tools (18 answers)
- https://raven.io/blog/best-software-composition-analysis-tools (18 answers)
- https://mend.io/blog/best-software-composition-analysis-sca-tools-top-solutions (16 answers)
- https://appsecsanta.com/sca-tools (14 answers)

## Warned against

- Snyk Open Source: 9 of 55 labels negative. "enterprise buyers often cite "unpredictable ballooning costs"... some procurement models recommend avoiding it if strict cost-prediction budgets are required" (Qwen 3.7 Flash, negative prompt)
- Black Duck: 12 of 38 labels negative. "Tools/Approaches to Be Cautious About ... Black Duck (Synopsys) ... Slow scanning ... Complicated pricing" (Kimi K2, negative prompt)
- Mend.io – Mend SCA: 7 of 37 labels negative. "This is the tool that surfaces most frequently in negative developer feedback" (DeepSeek V4 Flash, negative prompt)
- OWASP Dependency-Check: 8 of 35 labels negative. "useful as a free scanner, but I'd avoid treating its results as definitive ... can produce both false positives and false negatives" (GPT-6 Luna, negative prompt)

## Movement since September 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Trivy at 34%.

- Trivy: 40% to 34%, −6. Inside the floor by 5 points · rank 1 of 43, unchanged.
- OWASP Dependency-Check: 14% to 9%, −5. Inside the floor by 6 points · rank 4 of 43, unchanged.
- OWASP Dependency-Track: 2% to 7%, +5. Inside the floor by 6 points · rank 7 → 5 of 43.
- Sonatype Lifecycle: 0% to 2%, +2. Inside the floor by 9 points · rank 12 → 7 of 43.
- GitHub Advanced Security: 0% to 2%, +2. Inside the floor by 9 points · rank 17 → 8 of 43.
- OSV-Scanner: 0% to 2%, +2. Inside the floor by 9 points · rank 15 → 9 of 43.
- Snyk Open Source: 16% to 16%, ±0. Inside the floor by 11 points · rank 2 of 43, unchanged.
- Mend.io – Mend SCA: 14% to 14%, ±0. Inside the floor by 11 points · rank 3 of 43, unchanged.
- GitHub Dependabot: 5% to 5%, ±0. Inside the floor by 11 points · rank 5 → 6 of 43.
- Endor Labs: 0% to 0%, ±0. Inside the floor by 11 points · rank 10 → 14 of 43.
- FOSSA: 0% to 0%, ±0. Inside the floor by 11 points · rank 13 → 15 of 43.
- Grype: 0% to 0%, ±0. Inside the floor by 11 points · rank 14 → 16 of 43.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, October 2026 Edition, www.gane.ai/index/it.