# OWASP Dependency-Check: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 38 judge labels across 2 categories by 14 of 14 models. Page: https://www.gane.ai/index/it/vendors/owasp-dependency-check

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Software composition analysis](https://www.gane.ai/index/it/developer/software-composition-analysis/index.md) | 10% | 3 | 51% | 37 |
| [Static application security testing](https://www.gane.ai/index/it/developer/static-application-security-testing/index.md) | 0% | 39 | 0% | 1 |

## What the models said for it

- "For budget-conscious teams or open-source projects, OWASP Dependency-Check is recommended" (Claude Haiku 4.5, SCA)
- "Primary SCA: OWASP Dependency-Check (free, comprehensive scanning)" (Kimi K2, SCA)
- "I'd suggest OWASP Dependency-Check as your primary tool" (Claude Haiku 4.5, SCA)
- "Scenario: Zero budget | Top pick: OWASP Dependency-Check" (Muse Glimmer 30B, SCA)

## And against it

- "generally not recommended for modern pipelines due to high false-positive rates and slow build times" (Gemini 3.5 Flash, SCA)
- "OWASP Dependency-Check as your sole scanner: It's an actively maintained project, not one I'd dismiss. But its approach relies in part on matching components to vulnerability records" (GPT-6 Luna, SCA)
- "it is commonly used with caution because it is CPE and metadata driven, has historically high false-positive rates, lacks built-in reachability / exploitability prioritization" (Muse Glimmer 30B, SCA)
- "High false positive rate (research shows 88.8% of findings are false positives for vulnerabilities covered by code-centric approaches)" (GLM 4.7 FlashX, SCA)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 2 | 0 | 1 | 1 | 4 |
| GPT-5.4 mini | 0 | 2 | 0 | 0 | 2 |
| Gemini 3.5 Flash | 0 | 0 | 1 | 3 | 4 |
| Perplexity Sonar | 0 | 0 | 1 | 3 | 4 |
| Grok 4.20 | 1 | 0 | 1 | 3 | 5 |
| Mistral Small | 0 | 1 | 0 | 0 | 1 |
| DeepSeek V4 Flash | 0 | 1 | 0 | 2 | 3 |
| Llama 4 Maverick | 0 | 0 | 1 | 0 | 1 |
| Qwen 3.7 Flash | 0 | 0 | 0 | 1 | 1 |
| Kimi K2 | 1 | 1 | 0 | 1 | 3 |
| GLM 4.7 FlashX | 0 | 1 | 0 | 1 | 2 |
| MiniMax M2.5 | 0 | 1 | 0 | 2 | 3 |
| GPT-6 Luna | 0 | 0 | 1 | 1 | 2 |
| Muse Glimmer 30B | 1 | 1 | 0 | 1 | 3 |

## Sources returned with these answers

The sites and pages cited by the answers that named OWASP Dependency-Check, from 95 of the 106 answers that named it (only the models that return a source list).

### Domains cited

- github.com: 38
- safeguard.sh: 36
- upwind.io: 32
- checkmarx.com: 30
- linuxfoundation.org: 28
- appsecsanta.com: 23
- blog.jetbrains.com: 23
- guideflow.com: 23
- g2.com: 22
- dupple.com: 21

### Pages cited

- https://upwind.io/glossary/10-best-software-composition-analysis-tools-for-sca: 31
- https://linuxfoundation.org/hubfs/Reports/An-Open-Guide-To-Evaluating-Software-Composition-Analysis-Tools_V2.pdf: 28
- https://checkmarx.com/learn/sca/sca-tools-key-capabilities-11-tools-to-watch-in-2026: 24
- https://blog.jetbrains.com/qodana/2025/09/best-software-composition-analysis-tools: 23
- https://dupple.com/learn/best-software-composition-analysis-tools: 21
- https://res.cloudinary.com/snyk/image/upload/v1731508416/website-pdfs/The-Forrester-Wave-Software-Composition-Analysis-Software-Q4-2024.pdf: 21
- https://endorlabs.com/learn/best-sca-tools-05b7a: 16
- https://appsecsanta.com/sca-tools: 15

## In its own words

What OWASP Dependency-Check's own pages state, read 2026-10-05. Stated by the vendor, not checked by the index.

- Positioning: Dependency-Check is a Software Composition Analysis (SCA) tool suite that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. (https://owasp.org/projects/dependency-check)

## What it publishes

Every page owasp.org exposes, read 2026-09-29: 893 addresses. By kind, pages and the last 90 days:

- blog: 86 pages, 0 in the last 90 days, latest 2025-08-05
- webinar or virtual event: 7 pages, 0 in the last 90 days, latest 2026-05-13
- conference or event: 35 pages, 0 in the last 90 days, latest 2025-11-14
- template or tool: 3 pages, 0 in the last 90 days, latest 2024-05-08
- glossary or explainer: 1 pages, 0 in the last 90 days, latest undated
- podcast or video: 4 pages, 0 in the last 90 days, latest undated
- news or press: 18 pages, 0 in the last 90 days, latest 2024-11-20
- Recent: 2026-05-13 webinar or virtual event: Gen ai project application security risk virtual summit https://genai.owasp.org/event/gen-ai-project-application-security-risk-virtual-summit
- Recent: 2025-11-14 conference or event: Genai security project agentic ai summit europe https://genai.owasp.org/event/genai-security-project-agentic-ai-summit-europe
- Recent: 2025-08-30 conference or event: Genai security project uae summit hackathon https://genai.owasp.org/event/genai-security-project-uae-summit-hackathon
- Recent: 2025-08-28 conference or event: Owasp 2025 global appsec usa washington dc https://genai.owasp.org/event/owasp-2025-global-appsec-usa-washington-dc
- Recent: 2025-08-27 webinar or virtual event: Gen ai application security risk virtual conference https://genai.owasp.org/event/gen-ai-application-security-risk-virtual-conference
- Recent: 2025-08-06 webinar or virtual event: Owasp genai agentic security top 10 global kick off livestream https://genai.owasp.org/event/owasp-genai-agentic-security-top-10-global-kick-off-livestream

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.