# Black Duck alternatives: what AI models name instead, November 2026

Gane Index, November 2026 Edition. 202 of the 252 answers in the 1 category where Black Duck holds a standing named it neither first nor as an alternative; these are the first choices those answers made. Page: https://www.gane.ai/index/it/vendors/black-duck/alternatives

## Named instead, most often (every category and segment added)

- Snyk Open Source: 51
- Trivy: 37
- OWASP Dependency-Check: 15
- OWASP Dependency-Track: 12
- GitHub Dependabot: 11
- Mend.io – Mend SCA: 8

## Software composition analysis

**Small business**: 83 of 84 answers did not name Black Duck (Black Duck is #14 of 14 at 0%).

- Snyk Open Source: first choice in 35 of those 83
- Trivy: first choice in 17 of those 83
- OWASP Dependency-Check: first choice in 10 of those 83
- GitHub Dependabot: first choice in 7 of those 83
- OSV-Scanner: first choice in 5 of those 83
- Aikido Security: first choice in 2 of those 83
- FOSSA: first choice in 1 of those 83
- GitHub Dependency Graph & Dependabot: first choice in 1 of those 83

**Mid-market**: 69 of 84 answers did not name Black Duck (Black Duck is #11 of 19 at 0%).

- Trivy: first choice in 17 of those 69
- Snyk Open Source: first choice in 16 of those 69
- OWASP Dependency-Check: first choice in 5 of those 69
- GitHub Dependabot: first choice in 4 of those 69
- Mend.io – Mend SCA: first choice in 4 of those 69
- OWASP Dependency-Track: first choice in 3 of those 69
- Aikido Security: first choice in 1 of those 69

**Enterprise**: 50 of 84 answers did not name Black Duck (Black Duck is #2 of 14 at 17%).

- OWASP Dependency-Track: first choice in 9 of those 50
- Sonatype Lifecycle: first choice in 5 of those 50
- Mend.io – Mend SCA: first choice in 4 of those 50
- OSV-Scanner: first choice in 3 of those 50
- Trivy: first choice in 3 of those 50
- GitHub Advanced Security: first choice in 1 of those 50
- JFrog Xray: first choice in 1 of those 50
- Mend AppSec: first choice in 1 of those 50

Published under CC BY 4.0. The output is the models' output; nothing here is a recommendation by the index.