# Software composition analysis for small business buyers: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "software composition analysis tool" and as "open source dependency vulnerability scanner", six framings each, to fourteen models with search on, on behalf of a small B2B company. Page: https://www.gane.ai/index/it/developer/software-composition-analysis/2026-11/smb

**Standing:** Snyk Open Source leads with 38% of first choices; verdict contested. 53 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Snyk Open Source](https://www.gane.ai/index/it/vendors/snyk-open-source/index.md) | 38% | 10% | 63 |
| 2 | [Trivy](https://www.gane.ai/index/it/vendors/trivy/index.md) | 26% | 2% | 51 |
| 3 | [OWASP Dependency-Check](https://www.gane.ai/index/it/vendors/owasp-dependency-check/index.md) | 19% | 22% | 45 |
| 4 | [OSV-Scanner](https://www.gane.ai/index/it/vendors/osv-scanner/index.md) | 8% | 6% | 18 |
| 5 | [GitHub Dependabot](https://www.gane.ai/index/it/vendors/github-dependabot/index.md) | 4% | 7% | 29 |
| 6 | [OWASP Dependency-Track](https://www.gane.ai/index/it/vendors/owasp-dependency-track/index.md) | 2% | 8% | 26 |
| 7 | [FOSSA](https://www.gane.ai/index/it/vendors/fossa/index.md) | 2% | 10% | 21 |
| 9 | [Semgrep Supply Chain](https://www.gane.ai/index/it/vendors/semgrep-supply-chain/index.md) | 0% | 0% | 24 |
| 10 | [Socket](https://www.gane.ai/index/it/vendors/socket/index.md) | 0% | 0% | 21 |
| 11 | [Grype](https://www.gane.ai/index/it/vendors/grype/index.md) | 0% | 0% | 11 |
| 15 | [GitHub Advanced Security](https://www.gane.ai/index/it/vendors/github-advanced-security/index.md) | 0% | 30% | 10 |
| 57 | [Mend.io – Mend SCA](https://www.gane.ai/index/it/vendors/mend-io-mend-sca/index.md) | 0% | 53% | 30 |

Rank is by share of first choices among all 60 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Snyk Open Source; alternatives OWASP Dependency-Check, SOOS, Semgrep Supply Chain, WhiteSource Bolt
- GPT-5.4 mini: Snyk Open Source; alternatives Mend.io – Mend SCA, OWASP Dependency-Track, Sonatype Lifecycle
- Gemini 3.5 Flash: Snyk Open Source; alternatives Debricked, GitHub Dependabot, OWASP Dependency-Track, Socket
- Perplexity Sonar: Snyk Open Source; alternatives FOSSA, GitHub Dependabot, OWASP Dependency-Check, Semgrep Supply Chain
- Grok 4.20: Snyk Open Source; alternatives Trivy
- Mistral Small: Snyk Open Source; alternatives FOSSA, Trivy
- DeepSeek V4 Flash: Snyk Open Source; alternatives OWASP Dependency-Check, Trivy
- Llama 4 Maverick: Snyk Open Source; alternatives FOSSA, Safeguard SCA, Semgrep Supply Chain
- Qwen 3.7 Flash: Snyk Open Source; alternatives Mend.io – Mend SCA, Trivy
- Kimi K2: FOSSA; alternatives OWASP Dependency-Check, Semgrep Supply Chain, Snyk Open Source
- GLM 4.7 FlashX: Snyk Open Source; alternatives GitHub Dependabot
- MiniMax M2.5: Snyk Open Source; alternatives Endor Labs, JFrog Xray, Semgrep Supply Chain, Socket
- GPT-6 Luna: Snyk Open Source; alternatives GitHub Dependabot
- Muse Glimmer 30B: Snyk Open Source; alternatives Dependabot alerts/OSV-Scanner, FOSSA, OWASP Dependency-Check, Semgrep Supply Chain

## Sources the answers cite

71 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- blog.jetbrains.com: 27 answers, 27 citations
- dupple.com: 24 answers, 24 citations
- safeguard.sh: 23 answers, 42 citations
- github.com: 20 answers, 41 citations
- upwind.io: 19 answers, 19 citations
- gane.ai/index: 18 answers, 19 citations
- g2.com: 17 answers, 23 citations
- linuxfoundation.org: 17 answers, 21 citations

Pages named in the most answers:

- https://blog.jetbrains.com/qodana/2025/09/best-software-composition-analysis-tools (27 answers)
- https://dupple.com/learn/best-software-composition-analysis-tools (24 answers)
- https://upwind.io/glossary/10-best-software-composition-analysis-tools-for-sca (19 answers)
- https://gane.ai/index/it/developer/software-composition-analysis/smb (18 answers)
- https://res.cloudinary.com/snyk/image/upload/v1731508416/website-pdfs/The-Forrester-Wave-Software-Composition-Analysis-Software-Q4-2024.pdf (17 answers)
- https://itechguides.com/best/software-composition-analysis-software (13 answers)
- https://linuxfoundation.org/hubfs/Reports/An-Open-Guide-To-Evaluating-Software-Composition-Analysis-Tools_V2.pdf?hsLang=en (13 answers)
- https://checkmarx.com/learn/sca/sca-tools-key-capabilities-11-tools-to-watch-in-2026 (12 answers)
- https://snyk.io/plans (12 answers)
- https://softwaresuggest.com/software-composition-analysis-tools (12 answers)

## Warned against

- Black Duck: 22 of 29 labels negative. "Why be cautious: It has consistently shown high negative sentiment among smaller buyers... leading to wasted money on features you will never utilize." (Qwen 3.7 Flash, negative prompt)
- Mend.io – Mend SCA: 16 of 30 labels negative. "Pricing is often per-developer and can escalate quickly into thousands per year, making it unsustainable for small businesses." (Grok 4.20, negative prompt)
- Sonatype Lifecycle: 16 of 24 labels negative. "Heavy Enterprise Suites (High Cost & Operational Friction) Tools: ... Sonatype Nexus Lifecycle" (Gemini 3.5 Flash, negative prompt)
- Veracode SCA: 8 of 9 labels negative. "Heavy Enterprise Suites (High Cost & Operational Friction) ... Veracode SCA" (Gemini 3.5 Flash, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Snyk Open Source at 38%.

- Trivy: 18% to 26%, +8. Inside the floor by 3 points · rank 2 of 60, unchanged.
- OSV-Scanner: 2% to 8%, +6. Inside the floor by 5 points · rank 10 → 4 of 60.
- Aikido Security: 5% to 0%, −5. Inside the floor by 6 points · rank 6 → 12 of 60.
- OWASP Dependency-Check: 15% to 19%, +4. Inside the floor by 7 points · rank 3 of 60, unchanged.
- FOSSA: 5% to 2%, −3. Inside the floor by 8 points · rank 5 → 7 of 60.
- Socket: 2% to 0%, −2. Inside the floor by 9 points · rank 7 → 10 of 60.
- Grype: 2% to 0%, −2. Inside the floor by 9 points · rank 9 → 11 of 60.
- GitHub Advanced Security: 2% to 0%, −2. Inside the floor by 9 points · rank 8 → 15 of 60.
- Sonatype Lifecycle: 2% to 0%, −2. Inside the floor by 9 points · rank 14 → 59 of 60.
- Snyk Open Source: 39% to 38%, −1. Inside the floor by 10 points · rank 1 of 60, unchanged.
- GitHub Dependabot: 5% to 4%, −1. Inside the floor by 10 points · rank 4 → 5 of 60.
- OWASP Dependency-Track: 2% to 2%, ±0. Inside the floor by 11 points · rank 12 → 6 of 60.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.