# Software composition analysis: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "software composition analysis tool" and as "open source dependency vulnerability scanner", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/developer/software-composition-analysis

**Standing:** Snyk Open Source (tied with Trivy) leads with 34% of first choices; verdict contested. 50 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Snyk Open Source](https://www.gane.ai/index/it/vendors/snyk-open-source/index.md) | 34% | 12% | 60 |
| 2 | [Trivy](https://www.gane.ai/index/it/vendors/trivy/index.md) | 34% | 3% | 35 |
| 3 | [OWASP Dependency-Check](https://www.gane.ai/index/it/vendors/owasp-dependency-check/index.md) | 10% | 51% | 37 |
| 4 | [GitHub Dependabot](https://www.gane.ai/index/it/vendors/github-dependabot/index.md) | 8% | 24% | 25 |
| 5 | [Mend.io – Mend SCA](https://www.gane.ai/index/it/vendors/mend-io-mend-sca/index.md) | 6% | 15% | 41 |
| 6 | [OWASP Dependency-Track](https://www.gane.ai/index/it/vendors/owasp-dependency-track/index.md) | 6% | 5% | 21 |
| 8 | [Sonatype Lifecycle](https://www.gane.ai/index/it/vendors/sonatype-lifecycle/index.md) | 0% | 16% | 25 |
| 9 | [FOSSA](https://www.gane.ai/index/it/vendors/fossa/index.md) | 0% | 5% | 21 |
| 10 | [OSV-Scanner](https://www.gane.ai/index/it/vendors/osv-scanner/index.md) | 0% | 7% | 14 |
| 11 | [Socket](https://www.gane.ai/index/it/vendors/socket/index.md) | 0% | 0% | 13 |
| 12 | [Black Duck](https://www.gane.ai/index/it/vendors/black-duck/index.md) | 0% | 27% | 30 |
| 13 | [Endor Labs](https://www.gane.ai/index/it/vendors/endor-labs/index.md) | 0% | 0% | 13 |

Rank is by share of first choices among all 60 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Mend.io – Mend SCA; alternatives Aikido Security, Snyk Open Source
- GPT-5.4 mini: Snyk Open Source; alternatives Mend.io – Mend SCA, OWASP Dependency-Check, OWASP Dependency-Track, Semgrep
- Gemini 3.5 Flash: Snyk Open Source; alternatives GitHub Advanced Security, Mend.io – Mend SCA, Semgrep Supply Chain, Socket
- Perplexity Sonar: Mend.io – Mend SCA; alternatives Endor Labs, Snyk Open Source
- Grok 4.20: Snyk Open Source; alternatives Black Duck, Mend.io – Mend SCA, Sonatype Lifecycle
- Mistral Small: Snyk Open Source; alternatives FOSSA, Trivy
- DeepSeek V4 Flash: Snyk Open Source; alternatives Mend.io – Mend SCA, Sonatype Lifecycle
- Llama 4 Maverick: Snyk Open Source; alternatives Endor Labs, FOSSA, Safeguard SCA, Semgrep Supply Chain
- Qwen 3.7 Flash: Snyk Open Source; alternatives Black Duck, Mend.io – Mend SCA, Safeguard SCA, Trivy
- Kimi K2: Aikido Security, Snyk Open Source; alternatives FOSSA, GitHub Advanced Security
- GLM 4.7 FlashX: Snyk Open Source; alternatives Mend.io – Mend SCA
- MiniMax M2.5: Mend.io – Mend SCA, Snyk Open Source; alternatives Sonatype Lifecycle
- GPT-6 Luna: Snyk Open Source; alternatives GitHub Code Security, GitHub Dependabot, Mend.io – Mend SCA, Sonatype Lifecycle
- Muse Glimmer 30B: Snyk Open Source; alternatives Black Duck, Mend.io – Mend SCA, Sonatype Lifecycle

## Sources the answers cite

73 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- g2.com: 24 answers, 35 citations
- linuxfoundation.org: 23 answers, 31 citations
- github.com: 21 answers, 39 citations
- sonatype.com: 20 answers, 37 citations
- res.cloudinary.com: 20 answers, 20 citations
- safeguard.sh: 19 answers, 39 citations
- checkmarx.com: 19 answers, 20 citations
- dupple.com: 18 answers, 18 citations

Pages named in the most answers:

- https://res.cloudinary.com/snyk/image/upload/v1731508416/website-pdfs/The-Forrester-Wave-Software-Composition-Analysis-Software-Q4-2024.pdf (20 answers)
- https://dupple.com/learn/best-software-composition-analysis-tools (18 answers)
- https://sonatype.com/compare/best-sca-tools (17 answers)
- https://g2.com/categories/software-composition-analysis (16 answers)
- https://linuxfoundation.org/hubfs/Reports/An-Open-Guide-To-Evaluating-Software-Composition-Analysis-Tools_V2.pdf?hsLang=en (16 answers)
- https://checkmarx.com/learn/sca/sca-tools-key-capabilities-11-tools-to-watch-in-2026 (15 answers)
- https://itechguides.com/best/software-composition-analysis-software (13 answers)
- https://mend.io/blog/best-software-composition-analysis-sca-tools-top-solutions (13 answers)
- https://raven.io/blog/best-software-composition-analysis-tools (13 answers)
- https://upwind.io/glossary/10-best-software-composition-analysis-tools-for-sca (13 answers)

## Warned against

- OWASP Dependency-Check: 19 of 37 labels negative. "generally not recommended for modern pipelines due to high false-positive rates and slow build times" (Gemini 3.5 Flash, paraphrase prompt)
- Black Duck: 8 of 30 labels negative. "What to Avoid - Black Duck (Synopsys) and Mend.io: Powerful but historically complex to configure and priced for enterprise" (Kimi K2, direct prompt)
- Snyk Open Source: 7 of 60 labels negative. "tools including Snyk, GitHub Dependabot, OWASP Dependency-Check, and npm audit all failed to detect vulnerabilities in cloned or shaded components" (MiniMax M2.5, negative prompt)
- GitHub Dependabot: 6 of 25 labels negative. "GitHub Dependabot as your entire SCA program: It can be useful for repositories on GitHub, but check the documented ecosystem and file-format coverage" (GPT-6 Luna, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
New leader: Trivy (31%) to Snyk Open Source (34%). Margin 0 points, within noise.

- Snyk Open Source: 16% to 34%, +18. Cleared the floor by 7 points · rank 2 → 1 of 60.
- Mend.io – Mend SCA: 14% to 6%, −8. Inside the floor by 3 points · rank 3 → 5 of 60.
- Trivy: 31% to 34%, +3. Inside the floor by 8 points · rank 1 → 2 of 60.
- OWASP Dependency-Check: 8% to 10%, +2. Inside the floor by 9 points · rank 5 → 3 of 60.
- OWASP Dependency-Track: 8% to 6%, −2. Inside the floor by 9 points · rank 4 → 6 of 60.
- Sonatype Lifecycle: 2% to 0%, −2. Inside the floor by 9 points · rank 7 → 8 of 60.
- OSV-Scanner: 2% to 0%, −2. Inside the floor by 9 points · rank 9 → 10 of 60.
- Socket: 2% to 0%, −2. Inside the floor by 9 points · rank 10 → 11 of 60.
- GitHub Advanced Security: 2% to 0%, −2. Inside the floor by 9 points · rank 8 → 16 of 60.
- GitHub Dependabot: 8% to 8%, ±0. Inside the floor by 11 points · rank 6 → 4 of 60.
- FOSSA: 0% to 0%, ±0. Inside the floor by 11 points · rank 17 → 9 of 60.
- Black Duck: 0% to 0%, ±0. Inside the floor by 11 points · rank 18 → 12 of 60.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.