# Grype: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 21 judge labels across 5 categories by 10 of 14 models. Page: https://www.gane.ai/index/it/vendors/grype

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Software composition analysis](https://www.gane.ai/index/it/developer/software-composition-analysis/index.md) | 0% | 18 | 10% | 10 |
| [Container and Kubernetes security](https://www.gane.ai/index/it/cloud/container-and-kubernetes-security/index.md) | 0% | 29 | 29% | 7 |
| [Application security posture management](https://www.gane.ai/index/it/developer/application-security-posture-management/index.md) | 0% | 31 | 0% | 2 |
| [Artifact and container registries](https://www.gane.ai/index/it/developer/artifact-and-container-registries/index.md) | 0% | 53 | 0% | 1 |
| [Vulnerability management platforms](https://www.gane.ai/index/it/security/vulnerability-management-platforms/index.md) | 0% | 56 | 0% | 1 |

## What the models said for it

- "Modern open-source alternatives like Trivy, Grype, or Kubescape have largely replaced them." (Gemini 3.5 Flash, Container security)
- "Better alternative: Look for tools (commercial or open source like Trivy, Grype, or Snyk)" (Gemini 3.5 Flash, SCA)
- "Excellent accuracy, minimal false positives, and strong on container/image scanning." (Grok 4.20, SCA)
- "A fast, lightweight CLI vulnerability scanner for container images and filesystems" (Gemini 3.5 Flash, SCA)

## And against it

- "useful for image and dependency findings, but they do not by themselves detect runtime attacks, enforce admission policy, or provide incident response" (Perplexity Sonar, Container security)
- "Unconfigured Basic Scanners (e.g., Default Trivy/Grype setups): The Risk: ... You must avoid these tools if you haven't set up policy-as-code" (Qwen 3.7 Flash, Container security)
- "free deployments often leave monitoring, triage, reporting, and governance to your team" (Perplexity Sonar, SCA)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 1 | 0 | 1 |
| GPT-5.4 mini | 0 | 0 | 0 | 0 | 0 |
| Gemini 3.5 Flash | 0 | 3 | 2 | 0 | 5 |
| Perplexity Sonar | 0 | 0 | 0 | 2 | 2 |
| Grok 4.20 | 0 | 2 | 1 | 0 | 3 |
| Mistral Small | 0 | 0 | 0 | 0 | 0 |
| DeepSeek V4 Flash | 0 | 0 | 2 | 0 | 2 |
| Llama 4 Maverick | 0 | 0 | 0 | 0 | 0 |
| Qwen 3.7 Flash | 0 | 2 | 0 | 1 | 3 |
| Kimi K2 | 0 | 1 | 0 | 0 | 1 |
| GLM 4.7 FlashX | 0 | 0 | 1 | 0 | 1 |
| MiniMax M2.5 | 0 | 2 | 0 | 0 | 2 |
| GPT-6 Luna | 0 | 0 | 0 | 0 | 0 |
| Muse Glimmer 30B | 0 | 1 | 0 | 0 | 1 |

## Sources returned with these answers

The sites and pages cited by the answers that named Grype, from 48 of the 54 answers that named it (only the models that return a source list).

### Domains cited

- github.com: 25
- safeguard.sh: 20
- appsecsanta.com: 10
- checkmarx.com: 10
- chainguard.dev: 9
- g2.com: 9
- guideflow.com: 9
- trivy.dev: 9
- upwind.io: 9
- bestdevops.com: 8

### Pages cited

- https://trivy.dev/: 9
- https://upwind.io/glossary/10-best-software-composition-analysis-tools-for-sca: 8
- https://bestdevops.com/top-10-dependency-vulnerability-scanners-features-pros-cons-comparison: 7
- https://chainguard.dev/supply-chain-security-101/container-security-tools-a-buyers-guide: 7
- https://dupple.com/learn/best-software-composition-analysis-tools: 7
- https://safeguard.sh/resources/blog/free-alternatives-to-commercial-sca-scanners: 7
- https://appsecsanta.com/sca-tools: 6
- https://github.com/ancoleman/ai-design-components/blob/main/skills/managing-vulnerabilities/references/tool-selection.md: 6

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.