# Static application security testing: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "SAST tool" and as "static code security scanner", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/developer/static-application-security-testing/2026-09

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/developer/static-application-security-testing/index.md

**Standing:** Semgrep AppSec Platform leads with 47% of first choices; verdict clear leader. 45 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Semgrep AppSec Platform](https://www.gane.ai/index/it/vendors/semgrep-appsec-platform/index.md) | 47% | 0% | 56 |
| 2 | [SonarQube](https://www.gane.ai/index/it/vendors/sonarqube/index.md) | 22% | 10% | 48 |
| 3 | [Snyk Code](https://www.gane.ai/index/it/vendors/snyk-code/index.md) | 13% | 6% | 36 |
| 5 | [Aikido Security](https://www.gane.ai/index/it/vendors/aikido-security/index.md) | 4% | 0% | 16 |
| 6 | [CodeQL](https://www.gane.ai/index/it/vendors/codeql/index.md) | 2% | 8% | 26 |
| 8 | [Veracode Static Analysis](https://www.gane.ai/index/it/vendors/veracode-static-analysis/index.md) | 2% | 40% | 35 |
| 9 | [GitHub Advanced Security](https://www.gane.ai/index/it/vendors/github-advanced-security/index.md) | 0% | 7% | 14 |
| 10 | [gosec](https://www.gane.ai/index/it/vendors/gosec/index.md) | 0% | 0% | 10 |
| 13 | [Bandit](https://www.gane.ai/index/it/vendors/bandit/index.md) | 0% | 18% | 11 |
| 41 | [Checkmarx One](https://www.gane.ai/index/it/vendors/checkmarx-one/index.md) | 0% | 48% | 46 |
| 44 | [OpenText Fortify](https://www.gane.ai/index/it/vendors/opentext-fortify/index.md) | 0% | 52% | 23 |

Rank is by share of first choices among all 44 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Snyk Code; alternatives Checkmarx One, GitHub Advanced Security, Veracode Static Analysis
- Gemini 3.5 Flash: Aikido Security; alternatives GitHub Advanced Security, GitLab SAST, Semgrep AppSec Platform, Snyk
- Perplexity Sonar: CodeAnt AI; alternatives Aikido Security, Semgrep AppSec Platform
- Grok 4.20: Semgrep AppSec Platform; alternatives Snyk Code, SonarQube
- Mistral Small: Semgrep AppSec Platform; alternatives CodeAnt AI, SonarQube
- DeepSeek V4 Flash: Semgrep AppSec Platform; alternatives Checkmarx One, GitHub Advanced Security, Snyk Code, SonarQube
- Llama 4 Maverick: Snyk Code; alternatives SonarQube
- Qwen 3.7 Flash: Snyk, SonarQube; alternatives GitHub Advanced Security, GitLab SAST
- Kimi K2: Semgrep AppSec Platform, Snyk Code; alternatives SonarQube
- GLM 4.7 FlashX: Snyk Code; alternatives CodeAnt AI, Semgrep AppSec Platform, SonarQube
- MiniMax M2.5: Snyk Code, SonarQube; alternatives Checkmarx One, Semgrep AppSec Platform

## Sources the answers cite

63 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- zeropath.com: 35 answers, 37 citations
- appsecsanta.com: 34 answers, 46 citations
- corgea.com: 34 answers, 38 citations
- dev.to: 30 answers, 47 citations
- endorlabs.com: 24 answers, 35 citations
- augmentcode.com: 24 answers, 27 citations
- pixee.ai: 24 answers, 25 citations
- ox.security: 23 answers, 24 citations

Pages named in the most answers:

- https://zeropath.com/blog/best-sast-tools (34 answers)
- https://corgea.com/learn/best-sast-tools (31 answers)
- https://appsecsanta.com/sast-tools (24 answers)
- https://dev.to/rahulxsingh/i-reviewed-32-sast-tools-the-ones-worth-using-283e (24 answers)
- https://ox.security/blog/static-application-security-sast-tools (23 answers)
- https://endorlabs.com/learn/best-sast-tools (21 answers)
- https://pixee.ai/blog/best-sast-tools-2026 (19 answers)
- https://checkmarx.com/learn/sast/open-source-vs-premium-sast-tools (14 answers)
- https://augmentcode.com/tools/best-ai-sast-tools (13 answers)
- https://dev.to/rahulxsingh/11-best-sast-tools-in-2026-static-application-security-testing-compared-4ajo (13 answers)

## Warned against

- Checkmarx One: 22 of 46 labels negative. "Tools to Avoid on a Tight Budget ... Checkmarx One / Fortify / Vercode: These are enterprise-grade tools" (Qwen 3.7 Flash, budget prompt)
- Veracode Static Analysis: 14 of 35 labels negative. "Avoid legacy, binary-upload scanners... historically pioneered by tools like Veracode)... a major friction point for modern, fast-paced DevSecOps teams." (Gemini 3.5 Flash, negative prompt)
- OpenText Fortify: 12 of 23 labels negative. "High-cost, legacy platforms (like OpenText Fortify or older on-premise setups of Checkmarx)... Avoid legacy, binary-upload scanners and heavyweight on-premise engines." (Gemini 3.5 Flash, negative prompt)
- SonarQube: 5 of 48 labels negative. "SonarQube: High false positive rates out-of-the-box (40-82% ...) ... Tune heavily or pair with security-specific tools." (Grok 4.20, negative prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.