# Black Duck: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 36 judge labels across 4 categories by 14 of 14 models. Page: https://www.gane.ai/index/it/vendors/black-duck

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Software composition analysis](https://www.gane.ai/index/it/developer/software-composition-analysis/index.md) | 0% | 12 | 27% | 30 |
| [Secure code training](https://www.gane.ai/index/it/developer/secure-code-training/index.md) | 0% | 104 | 100% | 3 |
| [Static application security testing](https://www.gane.ai/index/it/developer/static-application-security-testing/index.md) | 0% | 50 | 50% | 2 |
| [Application security posture management](https://www.gane.ai/index/it/developer/application-security-posture-management/index.md) | 0% | 36 | 0% | 1 |

## What the models said for it

- "Choose Black Duck if compliance, license risk, and enterprise governance are top priorities." (GPT-5.4 mini, SCA)
- "Choose Black Duck or Sonatype if your priority is enterprise legal compliance, strict policy enforcement, and audit readiness." (Gemini 3.5 Flash, SCA)
- "Offers a full lifecycle application security solution, with a focus on policy compliance and enterprise integration." (Mistral Small, ASPM)
- "Another Forrester leader, strong in deep license detection ... often seen as heavier to implement than Snyk" (Grok 4.20, SCA)

## And against it

- "What to Avoid - Black Duck (Synopsys) and Mend.io: Powerful but historically complex to configure and priced for enterprise" (Kimi K2, SCA)
- "Avoid broader platforms like HackerRank ... or pure eLearning (Synopsys, Cybrary)" (Grok 4.20, Secure code training)
- "Better fit for small or budget-limited teams than commercial tools like Snyk, Mend, Black Duck, or JFrog, which are typically feature-rich but paid." (GPT-5.4 mini, SCA)
- "license compliance depth does not automatically mean superior malware detection, exploitability analysis, or runtime prioritization" (Perplexity Sonar, SCA)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 1 | 1 | 2 |
| GPT-5.4 mini | 1 | 0 | 0 | 1 | 2 |
| Gemini 3.5 Flash | 0 | 1 | 0 | 0 | 1 |
| Perplexity Sonar | 0 | 1 | 0 | 1 | 2 |
| Grok 4.20 | 0 | 2 | 3 | 3 | 8 |
| Mistral Small | 0 | 2 | 1 | 1 | 4 |
| DeepSeek V4 Flash | 0 | 1 | 1 | 1 | 3 |
| Llama 4 Maverick | 0 | 0 | 1 | 1 | 2 |
| Qwen 3.7 Flash | 0 | 2 | 0 | 1 | 3 |
| Kimi K2 | 0 | 2 | 0 | 2 | 4 |
| GLM 4.7 FlashX | 0 | 1 | 0 | 0 | 1 |
| MiniMax M2.5 | 0 | 1 | 1 | 0 | 2 |
| GPT-6 Luna | 0 | 1 | 0 | 0 | 1 |
| Muse Glimmer 30B | 0 | 1 | 0 | 0 | 1 |

## Sources returned with these answers

The sites and pages cited by the answers that named Black Duck, from 114 of the 125 answers that named it (only the models that return a source list).

### Domains cited

- g2.com: 49
- sonatype.com: 44
- checkmarx.com: 42
- res.cloudinary.com: 38
- mend.io: 34
- linuxfoundation.org: 33
- safeguard.sh: 33
- securityboulevard.com: 30
- blackduck.com: 29 (its own site)
- gane.ai/index: 27

### Pages cited

- https://res.cloudinary.com/snyk/image/upload/v1731508416/website-pdfs/The-Forrester-Wave-Software-Composition-Analysis-Software-Q4-2024.pdf: 38
- https://sonatype.com/compare/best-sca-tools: 38
- https://linuxfoundation.org/hubfs/Reports/An-Open-Guide-To-Evaluating-Software-Composition-Analysis-Tools_V2.pdf: 33
- https://dupple.com/learn/best-software-composition-analysis-tools: 26
- https://mend.io/blog/best-software-composition-analysis-sca-tools-top-solutions: 26
- https://raven.io/blog/best-software-composition-analysis-tools: 26
- https://blog.jetbrains.com/qodana/2025/09/best-software-composition-analysis-tools: 25
- https://checkmarx.com/learn/sca/sca-tools-key-capabilities-11-tools-to-watch-in-2026: 19

## In its own words

What Black Duck's own pages state, read 2026-09-28. Stated by the vendor, not checked by the index.

- Positioning: Black Duck delivers True Scale Application Security — SAST, SCA, DAST, and AI-powered AppSec — to help security and development teams detect vulnerabilities, manage open source license risk, and secure the software supply chain. (https://blackduck.com/)
- For: security and development teams (https://blackduck.com/)
- Customers named: FPT Software

## What it publishes

Every page blackduck.com exposes, read 2026-09-29: 2296 addresses. By kind, pages and the last 90 days:

- blog: 843 pages, 11 in the last 90 days, latest 2026-09-23
- case study: 32 pages, 2 in the last 90 days, latest 2026-09-25
- webinar or virtual event: 3 pages, 2 in the last 90 days, latest 2026-09-22
- report or ebook: 204 pages, 2 in the last 90 days, latest 2026-08-07
- comparison: 12 pages, 0 in the last 90 days, latest 2026-03-03
- template or tool: 4 pages, 0 in the last 90 days, latest 2020-04-21
- glossary or explainer: 69 pages, 0 in the last 90 days, latest 2026-05-08
- podcast or video: 6 pages, 0 in the last 90 days, latest 2024-02-21
- Recent: 2026-09-25 case study: Securing ai generated code static analysis https://www.blackduck.com/resources/case-studies/securing-ai-generated-code-static-analysis.html
- Recent: 2026-09-23 blog: Top 10 free hacking tools for penetration testers https://www.blackduck.com/blog/top-10-free-hacking-tools-for-penetration-testers.html
- Recent: 2026-09-23 blog: Polaris september 2026 update https://www.blackduck.com/blog/polaris-september-2026-update.html
- Recent: 2026-09-22 webinar or virtual event: Are you ready cra reporting https://www.blackduck.com/resources/webinars/are-you-ready-cra-reporting.html
- Recent: 2026-09-22 webinar or virtual event: Thankyou https://www.blackduck.com/resources/webinars/are-you-ready-cra-reporting/thankyou.html
- Recent: 2026-09-21 blog: Hidden costs ai security programs https://www.blackduck.com/blog/hidden-costs-ai-security-programs.html

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.