# Static application security testing: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "SAST tool" and as "static code security scanner", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/developer/static-application-security-testing

**Standing:** Semgrep AppSec Platform leads with 71% of first choices; verdict clear leader. 45 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Semgrep AppSec Platform](https://www.gane.ai/index/it/vendors/semgrep-appsec-platform/index.md) | 71% | 1% | 69 |
| 2 | [SonarQube](https://www.gane.ai/index/it/vendors/sonarqube/index.md) | 11% | 16% | 67 |
| 3 | [Aikido Security](https://www.gane.ai/index/it/vendors/aikido-security/index.md) | 7% | 18% | 11 |
| 4 | [Snyk Code](https://www.gane.ai/index/it/vendors/snyk-code/index.md) | 4% | 6% | 50 |
| 6 | [GitHub Advanced Security](https://www.gane.ai/index/it/vendors/github-advanced-security/index.md) | 2% | 0% | 24 |
| 7 | [CodeQL](https://www.gane.ai/index/it/vendors/codeql/index.md) | 0% | 12% | 25 |
| 8 | [GitLab SAST](https://www.gane.ai/index/it/vendors/gitlab-sast/index.md) | 0% | 8% | 12 |
| 10 | [Bandit](https://www.gane.ai/index/it/vendors/bandit/index.md) | 0% | 15% | 13 |
| 11 | [Checkmarx One](https://www.gane.ai/index/it/vendors/checkmarx-one/index.md) | 0% | 41% | 44 |
| 52 | [Veracode Static Analysis](https://www.gane.ai/index/it/vendors/veracode-static-analysis/index.md) | 0% | 47% | 34 |
| 76 | [OpenText Fortify](https://www.gane.ai/index/it/vendors/opentext-fortify/index.md) | 0% | 59% | 22 |

Rank is by share of first choices among all 76 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Snyk, SonarQube; alternatives Mend SAST, Semgrep AppSec Platform
- GPT-5.4 mini: GitHub Advanced Security; alternatives Checkmarx One
- Gemini 3.5 Flash: Snyk Code; alternatives GitHub Advanced Security, Semgrep AppSec Platform, SonarQube
- Perplexity Sonar: Semgrep AppSec Platform; alternatives CodeQL, Snyk Code, SonarQube
- Grok 4.20: Semgrep AppSec Platform; alternatives Aikido Security, CodeAnt AI, GitLab SAST, Snyk Code
- Mistral Small: Aikido Security, Semgrep AppSec Platform; alternatives SonarQube
- DeepSeek V4 Flash: Semgrep AppSec Platform; alternatives Snyk Code, SonarQube
- Llama 4 Maverick: Semgrep AppSec Platform; alternatives Aikido Security, Snyk Code, SonarQube, ZeroPath
- Qwen 3.7 Flash: Semgrep AppSec Platform; alternatives GitHub Advanced Security, GitLab SAST, Mend SAST, SonarQube
- Kimi K2: Semgrep AppSec Platform; alternatives Aikido Security, Snyk Code, SonarQube
- GLM 4.7 FlashX: Snyk Code, SonarQube; alternatives Checkmarx One, GitLab SAST, Semgrep AppSec Platform
- MiniMax M2.5: Semgrep AppSec Platform; alternatives Snyk Code, SonarQube
- GPT-6 Luna: Semgrep AppSec Platform; alternatives GitHub Code Security, Snyk Code
- Muse Glimmer 30B: Aikido Security; alternatives Semgrep AppSec Platform, Snyk Code, SonarQube

## Sources the answers cite

69 of 84 answers came back with a source list, from 13 of 14 models. Sites named in the most answers:

- safeguard.sh: 28 answers, 48 citations
- dev.to: 25 answers, 32 citations
- checkmarx.com: 23 answers, 31 citations
- appsecsanta.com: 23 answers, 30 citations
- github.com: 18 answers, 35 citations
- dl.acm.org: 16 answers, 34 citations
- expertinsights.com: 13 answers, 14 citations
- gane.ai/index: 13 answers, 13 citations

Pages named in the most answers:

- https://checkmarx.com/learn/sast/open-source-vs-premium-sast-tools (18 answers)
- https://dev.to/rahulxsingh/i-reviewed-32-sast-tools-the-ones-worth-using-283e (18 answers)
- https://appsecsanta.com/sast-tools (15 answers)
- https://deepsource.com/resources/static-analysis-tools (11 answers)
- https://gane.ai/index/it/developer/static-application-security-testing (11 answers)
- https://upwind.io/glossary/best-sast-tools-static-code-scanners-compared (11 answers)
- https://corgea.com/learn/best-sast-tools (10 answers)
- https://sourcegraph.com/blog/sast-tools (10 answers)
- https://dl.acm.org/doi/fullHtml/10.1145/3674805.3690750 (9 answers)
- https://fluidattacks.com/blog/top-10-sast-tools (9 answers)

## Warned against

- Checkmarx One: 18 of 44 labels negative. "For very constrained setups, avoid commercial tools like Checkmarx, Veracode, or Snyk's full SAST" (Grok 4.20, budget prompt)
- Veracode Static Analysis: 16 of 34 labels negative. "avoid commercial tools like Checkmarx, Veracode, or Snyk's full SAST" (Grok 4.20, budget prompt)
- OpenText Fortify: 13 of 22 labels negative. "Legacy enterprise SAST tools (like Micro Focus Fortify or Checkmarx CxSAST) often fail in modern mid-market environments due to high noise, heavy management overhead, and steep pricing." (Gemini 3.5 Flash, direct prompt)
- SonarQube: 11 of 67 labels negative. "Not a true SAST tool... Inadequate for compliance (PCI-DSS, SOC 2)" (Kimi K2, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Semgrep AppSec Platform at 71%.

- Semgrep AppSec Platform: 36% to 71%, +35. Cleared the floor by 24 points · rank 1 of 76, unchanged.
- SonarQube: 22% to 11%, −11. Cleared the floor by 0 points · rank 2 of 76, unchanged.
- Snyk Code: 14% to 4%, −10. Inside the floor by 1 point · rank 3 → 4 of 76.
- Aikido Security: 2% to 7%, +5. Inside the floor by 6 points · rank 8 → 3 of 76.
- Snyk: 8% to 4%, −4. Inside the floor by 7 points · rank 4 → 5 of 76.
- CodeQL: 4% to 0%, −4. Inside the floor by 7 points · rank 5 → 7 of 76.
- Checkmarx One: 2% to 0%, −2. Inside the floor by 9 points · rank 13 → 11 of 76.
- Veracode Static Analysis: 2% to 0%, −2. Inside the floor by 9 points · rank 7 → 52 of 76.
- GitHub Advanced Security: 2% to 2%, ±0. Inside the floor by 11 points · rank 6 of 76, unchanged.
- GitLab SAST: 0% to 0%, ±0. Inside the floor by 11 points · rank 15 → 8 of 76.
- Bandit: 0% to 0%, ±0. Inside the floor by 11 points · rank 14 → 10 of 76.
- OpenText Fortify: 0% to 0%, ±0. Inside the floor by 11 points · rank 20 → 76 of 76.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.