Gane Index

All indexesEvery index and its categories GTMMarketing, sales, customer and revenue operations software ITSecurity, IT operations, cloud, developer and data software HRHR, payroll, recruiting, performance and learning software FinanceAccounting, planning, spend, billing and treasury software

Claim your listing

Index › IT › Developer platform › SCA › Enterprise · November 2026 Edition

Software composition analysis for enterprise buyers

Name: AI model recommendations for software composition analysis for enterprise buyers, November 2026 Edition
Creator: Gane
Published: 2026-11-01
License: https://creativecommons.org/licenses/by/4.0/

Asked as “software composition analysis tool”, and as “open source dependency vulnerability scanner”, on behalf of an enterprise B2B company. 54 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.

Standing · first-choice share

30%

Sonatype Lifecycle

Contested · Black Duck 17%

30Sonatype Lifecycle17Black Duck17OWASP Dependency-Track37others

30% of first choices, contested.

Since October 2026↗new leaderNew leader since October 2026: Sonatype Lifecycle (30%) replaces Black Duck (23% then, 17% now), 13 points clear, past the 11-point floor.Sonatype Lifecycle leads at 30%, replacing Black Duck, which led at 23% and stands at 17% now: 13 points clear, past the floor.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

Small business

Snyk Open Source38%Contested▼−1Since October 2026: 39% → 38%, −1 point. Inside the 11-point floor: within noise.Standing →Mid-market

Snyk Open Source34%Contested↗new leaderNew leader since October 2026: Snyk Open Source (34%) replaces Trivy (31% then, 34% now), 0 points clear, inside the 11-point floor.Standing →Enterprise

Sonatype Lifecycle30%Contested↗new leaderNew leader since October 2026: Sonatype Lifecycle (30%) replaces Black Duck (23% then, 17% now), 13 points clear, past the 11-point floor.This page

The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for an enterprise B2B company. Ordered by share.

ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026

Sonatype Lifecycle9%46accepted challenger▲+9Since October 2026: 21% → 30%, +9 points. Inside the 11-point floor: within noise.21% → 30%

Black Duck16%49accepted challenger▼−6Since October 2026: 23% → 17%, −6 points. Inside the 11-point floor: within noise.23% → 17%

OWASP Dependency-Track15%20accepted challenger▲+12Since October 2026: 5% → 17%, +12 points. Past the 11-point floor: movement.5% → 17%

Mend.io – Mend SCA16%49accepted challenger▼−7Since October 2026: 14% → 7%, −7 points. Inside the 11-point floor: within noise.14% → 7%

Snyk Open Source31%55criticized challenger▲+2Since October 2026: 5% → 7%, +2 points. Inside the 11-point floor: within noise.5% → 7%

Trivy17%18accepted challenger▼−3Since October 2026: 9% → 6%, −3 points. Inside the 11-point floor: within noise.9% → 6%

JFrog Xray14%22accepted challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%

Aikido Security0%10accepted challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%

GitHub Advanced Security40%10criticized challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%

OWASP Dependency-Check52%21criticized challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%

Show the four products at 0%, ordered by negative rate

Checkmarx SCA15%26accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%

FOSSA14%14accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%

Veracode SCA6%17accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%

Endor Labs4%23accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%

The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured

Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.

For buyers

Build your shortlist

Head to head

Snyk Open Source vs Trivy Snyk Open Source vs OWASP Dependency-Check Snyk Open Source vs GitHub Dependabot

Head-to-head pages are published for mid-market buyers, so these open on mid-market figures, not enterprise.

All fifteen head-to-head pages: the top six products, each against each

Snyk Open Source vs Mend.io – Mend SCA Snyk Open Source vs OWASP Dependency-Track Trivy vs OWASP Dependency-Check Trivy vs GitHub Dependabot Trivy vs Mend.io – Mend SCA Trivy vs OWASP Dependency-Track OWASP Dependency-Check vs GitHub Dependabot OWASP Dependency-Check vs Mend.io – Mend SCA OWASP Dependency-Check vs OWASP Dependency-Track GitHub Dependabot vs Mend.io – Mend SCA GitHub Dependabot vs OWASP Dependency-Track Mend.io – Mend SCA vs OWASP Dependency-Track

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default

Negative label rate →

Accepted challengerEndorsed leader

0%First-choice share → · lines at 30% share and 25% negative40%

Key

Sonatype Lifecycle30%

Black Duck17%

OWASP Dependency-Track17%

Mend.io – Mend SCA7%

Snyk Open Source7%

Trivy6%

JFrog Xray2%

Aikido Security2%

GitHub Advanced Security2%

OWASP Dependency-Check2%

Endor Labs0%

Checkmarx SCA0%

Veracode SCA0%

FOSSA0%

What they warned about

Zero of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.20, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.

Snyk Open Source

31%

17 of 55 labels negative · 11 of 14 models · 2 hard negative

“What to Avoid - Per-developer tools (Snyk, Mend, Sonatype): Costs can surprise you” GLM 4.7 FlashX, budget prompt

OWASP Dependency-Check

52%

11 of 21 labels negative · 8 of 14 models · 3 hard negative

“Why avoid or be cautious: High noise from CPE ... shouldn't rely on it alone due to scalability and accuracy gaps” Grok 4.20, negative prompt

Black Duck

16%

8 of 49 labels negative · 6 of 14 models · 3 hard negative

“Dumb" Static SCA Tools (e.g., Older versions of Black Duck... Why Avoid: ... will generate "noise” Qwen 3.7 Flash, negative prompt

Mend.io – Mend SCA

16%

8 of 49 labels negative · 6 of 14 models · 2 hard negative

“What to Avoid - Per-developer tools (Snyk, Mend, Sonatype): Costs can surprise you” GLM 4.7 FlashX, budget prompt

What they cite

Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.

Sites the answers cite

79 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 1082 links across 248 sites, every framing counted. Ranked by the number of answers carrying the site or page. 42 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.

sonatype.com

vendor site · Sonatype35 answers · 59 citations · 13 models

mend.io

vendor site · Mend27 answers · 42 citations · 13 models

safeguard.sh

vendor site · Safeguard25 answers · 33 citations · 11 models

securityboulevard.com

25 answers · 27 citations · 10 models

github.com

vendor site · GitHub24 answers · 38 citations · 12 models

linuxfoundation.org

24 answers · 36 citations · 10 models

checkmarx.com

vendor site · Checkmarx24 answers · 33 citations · 13 models

g2.com

vendor site · G221 answers · 28 citations · 9 models

res.cloudinary.com

vendor site · Cloudinary21 answers · 21 citations · 9 models

raven.io

20 answers · 20 citations · 11 models

aikido.dev

vendor site · Aikido19 answers · 25 citations · 11 models

guideflow.com

vendor site · Guideflow19 answers · 20 citations · 7 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

sonatype.com/compare/best-sca-tools

28 answers · 12 models

res.cloudinary.com/snyk/image/upload/v1731508416/website-pdfs/The-Forrester…

21 answers · 9 models

linuxfoundation.org/hubfs/Reports/An-Open-Guide-To-Evaluating-Software-Comp…

20 answers · 10 models

raven.io/blog/best-software-composition-analysis-tools

20 answers · 11 models

mend.io/blog/best-software-composition-analysis-sca-tools-top-solutions

18 answers · 10 models

g2.com/categories/software-composition-analysis/enterprise

15 answers · 7 models

guideflow.com/blog/software-composition-analysis-tools

15 answers · 6 models

securityboulevard.com/2026/01/best-software-composition-analysis-for-enterp…

15 answers · 7 models

upwind.io/glossary/10-best-software-composition-analysis-tools-for-sca

14 answers · 10 models

checkmarx.com/learn/sca/sca-tools-key-capabilities-11-tools-to-watch-in-2026

13 answers · 10 models

Search against answers

Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best software composition analysis tool”, “software composition analysis tool”, “software composition analysis tools”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.

Company and products	Share	Own site cited	Name searches, Google	AI search demand, est.	Organic visits	Paid search a month, est.	Google ads, last 30 days	Best Google position
Sonatype sonatype.com Sonatype Lifecycle 30%, Sonatype Nexus IQ 0%	30%	121	90	1	71,814 company	$1,879	7	8
OWASP Dependency-Track owasp.org OWASP Dependency-Track 17%, OWASP Dependency-Check 2%	19%	95	720	10	365,222			3
Black Duck blackduck.com	17%	114	33,100	3,087	76,259		73	3
Mend.io – Mend SCA mend.io	7%	106			15,059		7
Snyk snyk.io Snyk Open Source 7%	7%	157	12,100	581	61,651 company		60
Trivy trivy.dev	6%	248	5,400	182	3,093
OSV-Scanner osv.dev	6%	37	390	22	749
JFrog jfrog.com JFrog Xray 2%, JFrog 0%	2%	42	590	37	38,697	$37	120
Aikido aikido.dev Aikido Security 2%	2%	326	2,400	51	6,442 company	$936	120
ProGet	2%		590	18

Google's top ten for the three searches hold 22 sites; 1 of them are among the sites the models cited here (sonatype.com). The first result for “best software composition analysis tool” is endorlabs.com.

How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.

ShowHide

ModelDirect“What is the best software composition analysis tool for an enterprise B2B company?”Paraphrase“Which open source dependency vulnerability scanner would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade software composition analysis tools and how do they differ?”Budget-constrained“What is the best software composition analysis tool for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a software composition analysis tool. What should we look at?”Negative“Which software composition analysis tools should a large enterprise avoid or be cautious about?”

Claude Haiku 4.5Black Duck

Five alternatives

Checkmarx One, Mend.io – Mend SCA, Snyk Open Source, Sonatype Nexus IQ, Veracode SCA

TrivyChanged

Two alternatives

OWASP Dependency-Check, OWASP Dependency-Track

Black Duck

Six alternatives

Checkmarx SCA, Endor Labs, FOSSA, JFrog Xray, Snyk Open Source, Sonatype Lifecycle

Sonatype Lifecycle

Two alternatives

Black Duck, Mend.io – Mend SCA

against: Snyk Open Sourceno first choiceagainst: Checkmarx SCA, JFrog Xray, SonarQube

GPT-5.4 miniBlack Duck

Four alternatives

Checkmarx SCA, Mend.io – Mend SCA, Snyk Open Source, Veracode SCA

OWASP Dependency-TrackChanged

One alternative

OWASP Dependency-Check

against: Snyk Open SourceSonatype Lifecycle

Five alternatives

Black Duck, JFrog Xray, Mend.io – Mend SCA, Snyk Open Source, Veracode SCA

Sonatype Lifecycleagainst: Checkmarx SCA, Snyk Open Source, Veracode SCAno first choicenothing named

Gemini 3.5 FlashSnyk Open Source

Five alternatives

Aikido Security, Black Duck, Endor Labs, Mend.io – Mend SCA, Sonatype Lifecycle

OWASP Dependency-Track, TrivyChanged

Two alternatives

Anchore Grype, Syft

against: OWASP Dependency-CheckSnyk Open Source

Four alternatives

Black Duck, JFrog Xray, Mend.io – Mend SCA, Sonatype Lifecycle

JFrog Xray

Four alternatives

FOSSA, OWASP Dependency-Track, Sonatype Lifecycle, Veracode SCA

against: GitHub Advanced Security, Mend.io – Mend SCA, Snyk Open Sourceno first choiceagainst: OWASP Dependency-Check, OWASP Dependency-Track, bundler-audit, cargo audit, npm audit, pip-audit

Perplexity SonarSonatype Lifecycle

Four alternatives

Black Duck, Endor Labs, Mend.io – Mend SCA, Snyk Open Source

OWASP Dependency-TrackChanged

Two alternatives

OSV-Scanner, Trivy

against: OWASP Dependency-CheckSnyk Open Source

Nine alternatives

Black Duck, Checkmarx SCA, Endor Labs, FOSSA, JFrog Xray, Mend.io – Mend SCA, OWASP Dependency-Track, Sonatype Lifecycle, Veracode SCA

Sonatype Lifecycle

Two alternatives

Black Duck, Mend.io – Mend SCA

against: Snyk Open Sourceno first choiceagainst: Endor Labs, JFrog Xray, Mend.io – Mend SCA, OWASP Dependency-Track, Semgrep, Snyk Open Source, Socket, Sonatype Lifecycle, Trivy

Grok 4.20Black Duck, Sonatype Lifecycle

Three alternatives

GitHub Advanced Security, JFrog, Snyk Open Source

OWASP Dependency-TrackChanged

Three alternatives

Grype, OWASP Dependency-Check, Trivy

against: GitHub Dependabot, OSV-Scanner, npm auditMend.io – Mend SCA, Snyk Open Source, Sonatype Lifecycle

Two alternatives

Black Duck, Veracode Software Composition Analysis

against: GitHub Advanced Security, GitLab Dependency ScanningSonatype Lifecycle

One alternative

Black Duck

against: Mend.io – Mend SCA, OWASP Dependency-Check, Snyk Open SourceSonatype Lifecycle

Five alternatives

Black Duck, Checkmarx SCA, JFrog Xray, Mend.io – Mend SCA, Snyk Open Source

against: GitHub Advanced Security, GitLab Dependency Scanningagainst: Black Duck, Grype, Mend.io – Mend SCA, OWASP Dependency-Check, Snyk Open Source, Syft

Mistral SmallMend.io – Mend SCA, Sonatype Lifecycle

One alternative

Snyk Open Source

OWASP Dependency-CheckChanged

Two alternatives

OSV-Scanner, Trivy

Snyk Open Source

Nine alternatives

Aikido Security, Black Duck, Checkmarx SCA, Endor Labs, FOSSA, JFrog Xray, Mend.io – Mend SCA, Semgrep Supply Chain, Sonatype Nexus Platform

Mend.io – Mend SCA, Sonatype Lifecycleagainst: Black DuckBlack Duck, Snyk Open Source

One alternative

GitHub Advanced Security

against: Checkmarx SCA, FOSSAnothing named

DeepSeek V4 FlashSnyk Open Source, Sonatype Lifecycle

Two alternatives

Black Duck, JFrog Xray

against: Mend.io – Mend SCAOWASP Dependency-TrackChanged

Two alternatives

OWASP Dependency-Check, Trivy

against: GrypeSnyk Open Source, Sonatype Lifecycle

Six alternatives

Black Duck, Checkmarx SCA, Cycode, JFrog Xray, Mend.io – Mend SCA, Wiz Code

Mend.io – Mend SCA

One alternative

Aikido Security

against: Black Duck, Snyk Open Source, Sonatype LifecycleBlack Duck

Three alternatives

JFrog Xray, Mend.io – Mend SCA, Sonatype Lifecycle

against: Snyk Open Sourceagainst: Anchore Grype, Black Duck, GitLab Dependency Scanning, JFrog Xray, OWASP Dependency-Check, Snyk Open Source, Sonatype Lifecycle, Syft, Trivy

Llama 4 Maverickno first choiceOSV-ScannerChangedno first choiceno first choiceno first choicenothing named

Qwen 3.7 FlashSonatype Lifecycle

Two alternatives

Black Duck, Snyk Open Source

TrivyChanged

One alternative

OWASP Dependency-Check

no first choiceMend.io – Mend SCA

One alternative

Sonatype Guide / Nexus Lifecycle

against: Black Duck, Snyk Open SourceBlack Duck, Snyk Open Source

Three alternatives

Endor Labs, Mend.io – Mend SCA, Sonatype Lifecycle

against: Black Duck, Go Vet, OWASP Dependency-Check, Snyk Open Source, Yarn Audit, npm audit

Kimi K2Sonatype Lifecycle

Two alternatives

Black Duck, Snyk Open Source

against: Mend.io – Mend SCAOWASP Dependency-TrackChanged

One alternative

Trivy

against: OWASP Dependency-CheckSnyk Open Source

Four alternatives

Black Duck, JFrog Xray, Mend.io – Mend SCA, Sonatype Lifecycle

against: Checkmarx SCABlack Duck

Two alternatives

Contrast Security, JFrog Xray

against: Mend.io – Mend SCA, Snyk Open Source, Sonatype Lifecycleno first choiceagainst: OWASP Dependency-Check, Semgrep

GLM 4.7 FlashXSonatype Lifecycle

Four alternatives

Black Duck, JFrog Xray, Mend.io – Mend SCA, Snyk Open Source

OSV-Scanner, OWASP Dependency-TrackChanged

Three alternatives

Grype, OWASP Dependency-Check, Trivy

Sonatype Lifecycle

Five alternatives

Black Duck, Checkmarx CxSCA, JFrog Xray, Snyk Open Source, SonarSource

GitHub Advanced Security

Three alternatives

OWASP Dependency-Track, Pixee Security, SonarQube

against: Black Duck, Mend.io – Mend SCA, Snyk Open Source, Sonatype Guideno first choicenothing named

MiniMax M2.5Black Duck, Sonatype Lifecycle

Three alternatives

Checkmarx CxSCA, Mend.io – Mend SCA, Snyk Open Source

against: FOSSAOWASP Dependency-TrackChanged

Two alternatives

Grype, Trivy

Snyk Open Source, Sonatype Lifecycle

Four alternatives

Black Duck, Checkmarx SCA, JFrog Xray, Mend.io – Mend SCA

ProGet

Two alternatives

Black Duck, Kiuwan Enterprise

no first choiceagainst: Black Ducknothing named

GPT-6 LunaSonatype Lifecycle

Two alternatives

Black Duck, Snyk Open Source

OSV-ScannerChanged

One alternative

OWASP Dependency-Track

against: Trivyno first choice

Eight alternatives

Black Duck, Checkmarx SCA, FOSSA, JFrog Xray, Mend.io – Mend SCA, Snyk Open Source, Sonatype Lifecycle, Veracode SCA

against: GitHub Advanced Security, GitLab Dependency ScanningMend AppSec

One alternative

GitHub Code Security

no first choice

Four alternatives

FOSSA, Mend.io – Mend SCA, Snyk Open Source, Sonatype Lifecycle

against: GitHub Dependabot, OWASP Dependency-Check, Snyk Open Source, Tenable Legacy Container Security's SCA feature

Muse Glimmer 30BBlack Duck, Sonatype Lifecycle

Two alternatives

Mend.io – Mend SCA, Snyk Open Source

OWASP Dependency-TrackChanged

Two alternatives

OWASP Dependency-Check, Trivy

Black Duck, Sonatype Lifecycle

Five alternatives

FOSSA, GitHub, GitHub Advanced Security Dependabot + Code Security, Mend.io – Mend SCA, Snyk Open Source

Aikido Security

Two alternatives

Black Duck, Sonatype Lifecycle

against: Snyk Open Sourceno first choiceagainst: Anchore Syft + Grype, OWASP Dependency-Check, OWASP Dependency-Track

Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.

Eighty-four rows: every prompt, every model, every answer.

Prompt	Model	Version string	Time (UTC)	Searched	Sources	Latency
Direct recommendation	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 13:17	yes	9	7 s
Direct recommendation	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 19:28	yes	6	5 s
Direct recommendation	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 18:01	yes	10	27 s
Direct recommendation	Perplexity Sonar	`sonar`	2026-11-01 16:40	yes	10	5 s
Direct recommendation	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 16:06	yes	14	16 s
Direct recommendation	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 18:10	yes	5	5 s
Direct recommendation	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 13:25	yes	21	27 s
Direct recommendation	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 14:51	yes	5	4 s
Direct recommendation	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 10:25	yes	15	80 s
Direct recommendation	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 09:26	yes	19	38 s
Direct recommendation	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 10:06	yes	21	51 s
Direct recommendation	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 19:43	yes	5	85 s
Direct recommendation	GPT-6 Luna	`gpt-6-luna`	2026-11-01 13:20	yes	2	19 s
Direct recommendation	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 19:32	yes	15	23 s
Paraphrase	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 15:56	yes	18	10 s
Paraphrase	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 09:27	yes	4	6 s
Paraphrase	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 14:23	no	0	14 s
Paraphrase	Perplexity Sonar	`sonar`	2026-11-01 10:11	yes	10	3 s
Paraphrase	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 18:32	yes	5	10 s
Paraphrase	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 19:33	yes	5	4 s
Paraphrase	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 10:06	yes	22	22 s
Paraphrase	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 09:24	yes	5	2 s
Paraphrase	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 17:58	yes	5	35 s
Paraphrase	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 17:18	yes	25	28 s
Paraphrase	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 11:09	yes	15	21 s
Paraphrase	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 12:42	yes	5	23 s
Paraphrase	GPT-6 Luna	`gpt-6-luna`	2026-11-01 12:35	yes	3	25 s
Paraphrase	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 13:21	yes	21	28 s
Comparative	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 12:06	yes	9	9 s
Comparative	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 10:17	yes	6	9 s
Comparative	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 12:30	yes	12	26 s
Comparative	Perplexity Sonar	`sonar`	2026-11-01 12:20	yes	10	9 s
Comparative	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 17:46	yes	9	14 s
Comparative	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 17:59	yes	5	9 s
Comparative	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 17:34	yes	22	47 s
Comparative	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 16:53	yes	5	3 s
Comparative	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 09:47	yes	25	38 s
Comparative	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 09:35	yes	14	58 s
Comparative	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 15:14	yes	17	68 s
Comparative	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 15:24	yes	19	86 s
Comparative	GPT-6 Luna	`gpt-6-luna`	2026-11-01 19:17	yes	10	39 s
Comparative	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 16:42	yes	23	46 s
Budget constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 11:40	yes	17	9 s
Budget constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 13:23	yes	7	6 s
Budget constrained	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 11:50	yes	16	26 s
Budget constrained	Perplexity Sonar	`sonar`	2026-11-01 12:01	yes	10	4 s
Budget constrained	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 13:46	yes	25	14 s
Budget constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 13:05	yes	5	4 s
Budget constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 12:11	yes	24	25 s
Budget constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 09:11	yes	5	3 s
Budget constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 17:22	yes	25	52 s
Budget constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 13:09	yes	25	112 s
Budget constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 15:50	yes	23	42 s
Budget constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 16:45	yes	24	54 s
Budget constrained	GPT-6 Luna	`gpt-6-luna`	2026-11-01 08:46	yes	2	17 s
Budget constrained	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 15:59	yes	22	35 s
Scale constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 08:57	yes	20	15 s
Scale constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 16:01	no	0	8 s
Scale constrained	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 19:05	no	0	24 s
Scale constrained	Perplexity Sonar	`sonar`	2026-11-01 13:40	yes	10	11 s
Scale constrained	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 17:51	yes	14	16 s
Scale constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 14:44	no	0	9 s
Scale constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 16:37	yes	24	63 s
Scale constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 09:19	yes	5	2 s
Scale constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 14:02	yes	5	37 s
Scale constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 12:22	yes	25	59 s
Scale constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 14:51	yes	25	38 s
Scale constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 08:58	no	0	22 s
Scale constrained	GPT-6 Luna	`gpt-6-luna`	2026-11-01 14:59	yes	5	33 s
Scale constrained	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 11:49	yes	22	24 s
Negative framing	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 10:54	yes	19	10 s
Negative framing	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 12:54	yes	4	5 s
Negative framing	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 13:56	yes	17	30 s
Negative framing	Perplexity Sonar	`sonar`	2026-11-01 10:00	yes	10	6 s
Negative framing	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 17:29	yes	15	16 s
Negative framing	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 09:49	yes	19	14 s
Negative framing	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 09:34	yes	24	44 s
Negative framing	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 15:11	yes	5	3 s
Negative framing	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 16:08	yes	15	43 s
Negative framing	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 11:10	yes	23	31 s
Negative framing	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 19:35	yes	21	240 s
Negative framing	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 08:59	yes	10	98 s
Negative framing	GPT-6 Luna	`gpt-6-luna`	2026-11-01 14:52	yes	5	24 s
Negative framing	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 14:05	yes	24	33 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

ShowHide

Category-scoped readings

Aikido read as Aikido Security

Checkmarx read as Checkmarx SCA

GitLab read as GitLab Dependency Scanning

GitLab Ultimate read as GitLab Dependency Scanning

Mend read as Mend.io – Mend SCA

Mend (WhiteSource) read as Mend.io – Mend SCA

Mend (formerly WhiteSource) read as Mend.io – Mend SCA

Mend SCA read as Mend.io – Mend SCA

Mend.io read as Mend.io – Mend SCA

Mend.io (Mend SCA / WhiteSource) read as Mend.io – Mend SCA

Mend.io (formerly WhiteSource) read as Mend.io – Mend SCA

Snyk read as Snyk Open Source

Snyk (Snyk Open Source) read as Snyk Open Source

Sonatype read as Sonatype Lifecycle

Sonatype (Lifecycle + Repository Firewall) read as Sonatype Lifecycle

Sonatype (Nexus Lifecycle) read as Sonatype Lifecycle

Sonatype (Nexus) read as Sonatype Lifecycle

Veracode read as Veracode SCA

WhiteSource (now part of Snyk) read as Mend.io – Mend SCA

Unresolved, counted raw

CRACI

CycloneDX

CycloneDX CLI

Cycode SCA

GitHub Advanced Security Dependabot + Code Security

GitHub's own dependency-graph

Go Vet (Native Audits)

JFrong

Kiuwan Enterprise

Mend AppSec

Pixee Security

Sonatype Guide

Sonatype Guide / Nexus Lifecycle

Sonatype Nexus Platform

Tenable Legacy Container Security's SCA feature

Veracode Software Composition Analysis

cargo audit

pip-audit

Discontinued, still offered

No shut-down product was recommended here.

Software composition analysis for enterprise buyers

By buyer segment

The standing

Recommended versus criticized

What they warned about

What they cite

Sites the answers cite

Pages the answers cite

Search against answers

How they answered

The record

Normalization in this category

Also in developer platform