# DefectDojo: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 30 judge labels across 3 categories by 14 of 14 models. Page: https://www.gane.ai/index/it/vendors/defectdojo

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Application security posture management](https://www.gane.ai/index/it/developer/application-security-posture-management/index.md) | 12% | 2 | 12% | 26 |
| [Vulnerability management platforms](https://www.gane.ai/index/it/security/vulnerability-management-platforms/index.md) | 0% | 40 | 33% | 3 |
| [Static application security testing](https://www.gane.ai/index/it/developer/static-application-security-testing/index.md) | 0% | 23 | 0% | 1 |

## What the models said for it

- "If your budget for software licenses is $0, OWASP DefectDojo is the industry standard for open-source ASPM" (Gemini 3.5 Flash, ASPM)
- "If budget = $0 and you have engineering capacity: DefectDojo or Faraday for self-hosted aggregation." (Muse Glimmer 30B, ASPM)
- "Start with OWASP DefectDojo if you want the lowest-cost way to aggregate findings" (GPT-5.4 mini, ASPM)
- "Top Recommendation: OWASP DefectDojo (Open-Source)" (Grok 4.20, ASPM)

## And against it

- "DefectDojo may be a reasonable findings-management and aggregation choice, but OWASP notes it does not provide native reachability analysis. Be cautious if you expect that capability out of the box" (GPT-6 Luna, ASPM)
- "Primarily an open-source aggregation and vulnerability-workflow hub rather than a full native ASPM platform." (Perplexity Sonar, ASPM)
- "Use cautiously if they lack enterprise support or proven scalability" (Grok 4.20, Vuln management)
- "though it requires internal resources to maintain and configure" (Gemini 3.5 Flash, ASPM)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 1 | 0 | 0 | 1 |
| GPT-5.4 mini | 1 | 0 | 0 | 0 | 1 |
| Gemini 3.5 Flash | 1 | 2 | 0 | 1 | 4 |
| Perplexity Sonar | 0 | 1 | 0 | 1 | 2 |
| Grok 4.20 | 1 | 0 | 2 | 1 | 4 |
| Mistral Small | 0 | 0 | 1 | 0 | 1 |
| DeepSeek V4 Flash | 1 | 1 | 1 | 0 | 3 |
| Llama 4 Maverick | 0 | 1 | 0 | 0 | 1 |
| Qwen 3.7 Flash | 0 | 1 | 0 | 0 | 1 |
| Kimi K2 | 0 | 3 | 0 | 0 | 3 |
| GLM 4.7 FlashX | 1 | 1 | 1 | 0 | 3 |
| MiniMax M2.5 | 0 | 0 | 1 | 0 | 1 |
| GPT-6 Luna | 0 | 0 | 0 | 1 | 1 |
| Muse Glimmer 30B | 1 | 1 | 2 | 0 | 4 |

## Sources returned with these answers

The sites and pages cited by the answers that named DefectDojo, from 78 of the 81 answers that named it (only the models that return a source list).

### Domains cited

- csoonline.com: 44
- g2.com: 44
- appsecsanta.com: 39
- checkmarx.com: 29
- gane.ai/index: 29
- github.com: 28
- ox.security: 27
- cycode.com: 25
- expertinsights.com: 25
- safeguard.sh: 24

### Pages cited

- https://csoonline.com/article/4041891/aspm-buyers-guide-seven-products-to-help-secure-your-applications.html: 44
- https://appsecsanta.com/aspm-tools: 34
- https://expertinsights.com/application-security/the-top-application-security-posture-management-aspm-tools: 25
- https://g2.com/categories/application-security-posture-management-aspm/small-business: 25
- https://ox.security/blog/aspm-tools: 23
- https://checkmarx.com/learn/aspm/best-aspm-tools-5-platforms-to-watch-in-2026: 22
- https://guideflow.com/blog/aspm-software: 22
- https://gbhackers.com/best-aspm-compared: 17

## In its own words

What DefectDojo's own pages state, read 2026-10-05. Stated by the vendor, not checked by the index.

- Positioning: Open Source Vulnerability Management and ASPM (https://defectdojo.com/)
- For: security teams (https://defectdojo.com/)
- Price stated: Pro is now $100 a month plus 15 cents per finding (https://defectdojo.com/)
- Starting price: 100 a month plus 15 cents per finding (https://defectdojo.com/)
- Free plan or trial: Free forever (https://defectdojo.com/)
- Integrations claimed: 500 (https://defectdojo.com/)
- Certifications: SOC 2 Type II, GDPR, EU Cyber Resilience Act
- Customers named: SAS, Pearson

## What it publishes

Every page defectdojo.com exposes, read 2026-09-29: 1268 addresses. By kind, pages and the last 90 days:

- blog: 86 pages, 13 in the last 90 days, latest 2026-09-23
- case study: 2 pages, 0 in the last 90 days, latest undated
- webinar or virtual event: 1 pages, 0 in the last 90 days, latest 2024-12-12
- conference or event: 36 pages, 0 in the last 90 days, latest undated
- report or ebook: 13 pages, 0 in the last 90 days, latest undated
- comparison: 12 pages, 0 in the last 90 days, latest 2026-02-21
- template or tool: 7 pages, 0 in the last 90 days, latest 2026-02-01
- glossary or explainer: 2 pages, 0 in the last 90 days, latest 2026-02-15
- news or press: 15 pages, 0 in the last 90 days, latest 2026-06-24
- Recent: 2026-09-23 blog: Youve been lied to about security https://defectdojo.com/blog/youve-been-lied-to-about-security
- Recent: 2026-09-07 blog: Getting started with defectdojo in 10 minutes or less https://defectdojo.com/blog/getting-started-with-defectdojo-in-10-minutes-or-less
- Recent: 2026-09-01 blog: Your triage work is now an export sboms and vex from defectdojo pro https://defectdojo.com/blog/your-triage-work-is-now-an-export-sboms-and-vex-from-defectdojo-pro
- Recent: 2026-08-27 blog: Sensei cspm fix cloud misconfigurations aws azure gcp https://defectdojo.com/blog/sensei-cspm-fix-cloud-misconfigurations-aws-azure-gcp
- Recent: 2026-08-25 blog: Vulnerability explorer epss kev root cause analysis https://defectdojo.com/blog/vulnerability-explorer-epss-kev-root-cause-analysis
- Recent: 2026-08-20 blog: Threat modeling beta defectdojo https://defectdojo.com/blog/threat-modeling-beta-defectdojo

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.