# Static application security testing: what AI models recommend, October 2026

Gane Index, October 2026 Edition. Asked as "SAST tool" and as "static code security scanner", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/developer/static-application-security-testing/2026-10

This is the permanent record of the October 2026 Edition, published October 1, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/developer/static-application-security-testing/index.md

**Standing:** Semgrep AppSec Platform leads with 36% of first choices; verdict contested. 50 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Semgrep AppSec Platform](https://www.gane.ai/index/it/vendors/semgrep-appsec-platform/index.md) | 36% | 5% | 63 |
| 2 | [SonarQube](https://www.gane.ai/index/it/vendors/sonarqube/index.md) | 22% | 18% | 62 |
| 3 | [Snyk Code](https://www.gane.ai/index/it/vendors/snyk-code/index.md) | 14% | 2% | 41 |
| 4 | [Snyk](https://www.gane.ai/index/it/vendors/snyk/index.md) | 8% | 9% | 11 |
| 5 | [CodeQL](https://www.gane.ai/index/it/vendors/codeql/index.md) | 4% | 11% | 27 |
| 6 | [GitHub Advanced Security](https://www.gane.ai/index/it/vendors/github-advanced-security/index.md) | 2% | 6% | 17 |
| 7 | [Veracode Static Analysis](https://www.gane.ai/index/it/vendors/veracode-static-analysis/index.md) | 2% | 28% | 39 |
| 13 | [Checkmarx One](https://www.gane.ai/index/it/vendors/checkmarx-one/index.md) | 2% | 45% | 44 |
| 14 | [Bandit](https://www.gane.ai/index/it/vendors/bandit/index.md) | 0% | 13% | 15 |
| 20 | [OpenText Fortify](https://www.gane.ai/index/it/vendors/opentext-fortify/index.md) | 0% | 36% | 25 |

Rank is by share of first choices among all 70 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Semgrep AppSec Platform; alternatives Checkmarx One, Snyk Code, Veracode Static Analysis
- Gemini 3.5 Flash: Aikido Security; alternatives GitHub Advanced Security, GitLab SAST, Semgrep AppSec Platform, Snyk Code
- Perplexity Sonar: Semgrep AppSec Platform; alternatives Checkmarx One, Snyk Code
- Grok 4.20: Snyk Code; alternatives Semgrep AppSec Platform, SonarQube
- Mistral Small: Snyk; alternatives Aikido Security, Semgrep AppSec Platform
- DeepSeek V4 Flash: Snyk Code; alternatives CodeAnt.ai, Semgrep AppSec Platform, SonarQube
- Llama 4 Maverick: Snyk Code
- Qwen 3.7 Flash: SonarQube; alternatives Semgrep AppSec Platform, Snyk Code
- Kimi K2: Semgrep AppSec Platform, Snyk Code; alternatives SonarQube
- GLM 4.7 FlashX: SonarQube; alternatives Checkmarx One, Codacy, DeepSource, GitHub Advanced Security
- MiniMax M2.5: Snyk; alternatives Semgrep AppSec Platform, Veracode Static Analysis
- GPT-6 Luna: Semgrep AppSec Platform; alternatives GitHub Advanced Security, Snyk
- Muse Glimmer 30B: SonarQube; alternatives Semgrep AppSec Platform

## Sources the answers cite

75 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- checkmarx.com: 42 answers, 55 citations
- dev.to: 40 answers, 79 citations
- safeguard.sh: 28 answers, 29 citations
- appsecsanta.com: 27 answers, 32 citations
- aikido.dev: 25 answers, 32 citations
- zeropath.com: 22 answers, 23 citations
- opsera.ai: 21 answers, 21 citations
- augmentcode.com: 20 answers, 23 citations

Pages named in the most answers:

- https://checkmarx.com/learn/sast/open-source-vs-premium-sast-tools (37 answers)
- https://dev.to/rahulxsingh/i-reviewed-32-sast-tools-the-ones-worth-using-283e (25 answers)
- https://zeropath.com/blog/best-sast-tools (21 answers)
- https://opsera.ai/blog/sast-tools (21 answers)
- https://ox.security/blog/static-application-security-sast-tools (17 answers)
- https://community.owasp.org/Source_Code_Analysis_Tools (17 answers)
- https://dev.to/rahulxsingh/11-best-sast-tools-in-2026-static-application-security-testing-compared-4ajo (17 answers)
- https://appsecsanta.com/sast-tools (16 answers)
- https://corgea.com/learn/best-sast-tools (14 answers)
- https://augmentcode.com/tools/best-ai-sast-tools (12 answers)

## Warned against

- Checkmarx One: 20 of 44 labels negative. "What I'd Avoid for Mid-Market: Checkmarx and Veracode are powerful but typically start at $60K–$100K+/year" (Kimi K2, paraphrase prompt)
- SonarQube: 11 of 62 labels negative. "Noisiest out-of-box (40-60%+ FPs on Java/TS; OWASP F1-score ~27% in some evals)... avoid for security-only if you can't invest in config" (Grok 4.20, negative prompt)
- Veracode Static Analysis: 11 of 39 labels negative. "What I'd Avoid for Mid-Market: Checkmarx and Veracode are powerful but typically start at $60K–$100K+/year" (Kimi K2, paraphrase prompt)
- OpenText Fortify: 9 of 25 labels negative. "Fortify is described as heavyweight \u2013 requiring dedicated infrastructure and a team to manage scans and triage." (Muse Glimmer 30B, negative prompt)

## Movement since September 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Semgrep AppSec Platform at 30%.

- Semgrep AppSec Platform: 47% to 30%, −17. Cleared the floor by 6 points · rank 1 of 64, unchanged.
- Snyk Code: 13% to 16%, +3. Inside the floor by 8 points · rank 3 of 64, unchanged.
- CodeQL: 2% to 5%, +3. Inside the floor by 8 points · rank 6 → 5 of 64.
- Snyk: 7% to 9%, +2. Inside the floor by 9 points · rank 4 of 64, unchanged.
- GitHub Advanced Security: 0% to 2%, +2. Inside the floor by 9 points · rank 9 → 6 of 64.
- Aikido Security: 4% to 2%, −2. Inside the floor by 9 points · rank 5 → 8 of 64.
- Checkmarx One: 0% to 2%, +2. Inside the floor by 9 points · rank 41 → 13 of 64.
- SonarQube: 22% to 23%, +1. Inside the floor by 10 points · rank 2 of 64, unchanged.
- Veracode Static Analysis: 2% to 2%, ±0. Inside the floor by 11 points · rank 8 → 7 of 64.
- Bandit: 0% to 0%, ±0. Inside the floor by 11 points · rank 13 → 14 of 64.
- gosec: 0% to 0%, ±0. Inside the floor by 11 points · rank 10 → 16 of 64.
- OpenText Fortify: 0% to 0%, ±0. Inside the floor by 11 points · rank 44 → 19 of 64.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, October 2026 Edition, www.gane.ai/index/it.