# Nikto: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 8 judge labels across 2 categories by 7 of 14 models. Page: https://www.gane.ai/index/it/vendors/nikto

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Dynamic application security testing](https://www.gane.ai/index/it/developer/dynamic-application-security-testing/index.md) | 0% | 62 | 43% | 7 |
| [Vulnerability management platforms](https://www.gane.ai/index/it/security/vulnerability-management-platforms/index.md) | 0% | 88 | 100% | 1 |

## What the models said for it

- "The best free DAST tools in 2026 are ZAP, Nuclei, Nikto, and Wapiti" (Claude Haiku 4.5, DAST)
- "Runner-Up: Nikto (Free, Open-Source)" (DeepSeek V4 Flash, DAST)

## And against it

- "It's outdated for modern web apps/APIs (high false positives...). Use only as a quick initial check, not a primary DAST solution." (Grok 4.20, DAST)
- "An old HTTP server scanner that is largely outdated and yields high false positives. Use only for legacy systems." (Qwen 3.7 Flash, Vuln management)
- "Nikto is a legacy, template-based web server fuzzer, not an application-level DAST tool... cannot crawl modern client-side application logic" (Gemini 3.5 Flash, DAST)
- "tends to report configuration issues and has limited detection compared to more modern scanners; not a primary DAST choice" (GLM 4.7 FlashX, DAST)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 1 | 0 | 0 | 1 |
| GPT-5.4 mini | 0 | 0 | 0 | 0 | 0 |
| Gemini 3.5 Flash | 0 | 0 | 0 | 1 | 1 |
| Perplexity Sonar | 0 | 0 | 0 | 0 | 0 |
| Grok 4.20 | 0 | 0 | 1 | 1 | 2 |
| Mistral Small | 0 | 0 | 0 | 0 | 0 |
| DeepSeek V4 Flash | 0 | 1 | 0 | 0 | 1 |
| Llama 4 Maverick | 0 | 0 | 0 | 0 | 0 |
| Qwen 3.7 Flash | 0 | 0 | 0 | 1 | 1 |
| Kimi K2 | 0 | 0 | 0 | 0 | 0 |
| GLM 4.7 FlashX | 0 | 0 | 0 | 1 | 1 |
| MiniMax M2.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-6 Luna | 0 | 0 | 0 | 0 | 0 |
| Muse Glimmer 30B | 0 | 0 | 1 | 0 | 1 |

## Sources returned with these answers

The sites and pages cited by the answers that named Nikto, from 12 of the 14 answers that named it (only the models that return a source list).

### Domains cited

- safeguard.sh: 10
- github.com: 7
- appsecsanta.com: 5
- owasp.github.io: 5
- aimultiple.com: 4
- checkmarx.com: 4
- softwaretestinghelp.com: 4
- escape.tech: 3
- guideflow.com: 3
- microsoft.com: 3

### Pages cited

- https://safeguard.sh/resources/blog/best-dast-tools-for-web-application-security-testing: 5
- https://safeguard.sh/resources/blog/dast-tools-list: 5
- https://appsecsanta.com/dast-tools: 4
- https://owasp.github.io/DevSecOpsGuideline/2-Process/2-4-Test/2-4-2-Dynamic-Application-Security-Testing: 4
- https://softwaretestinghelp.com/dynamic-application-security-testing-dast-software: 4
- https://guideflow.com/blog/dast-tools: 3
- https://microsoft.com/en-us/msrc/blog/2025/01/scaling-dynamic-application-security-testing-dast: 3
- https://support.secureframe.com/en/articles/15111322-open-source-dast-or-sast-tools: 3

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.