AI Indexes
IT AI Index
October 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index › Developer platform › ASPM › Small business › October 2026 Edition

Application security posture management for small business buyers

Asked as “ASPM platform”, and as “application security posture management tool”, on behalf of a small B2B company. 52 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each. Added to the October 2026 Edition on October 4, 2026; its answers are read by the distilled judge (ai-indexes-judge-qwen3-14b-run3), not the claude-opus-5 judge of the earlier categories: how the two compare.
Standing · first-choice share
71%
Clear leader
71Aikido Security19Snyk04Conviso Platform06others

71% of first choices, clear leader.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Aikido Security71%2%63endorsed leader
02Snyk19%11%35accepted challenger
03Conviso Platform4%8%13accepted challenger
04DefectDojo2%11%19accepted challenger
Show the eight products at 0%, ordered by negative rate
11Apiiro0%85%13criticized challenger
09Veracode Risk Manager0%80%10criticized challenger
12ArmorCode0%74%23criticized challenger
10Checkmarx One0%71%14criticized challenger
08Legit Security0%64%11criticized challenger
07Cycode ASPM0%52%21criticized challenger
06Snyk AppRisk0%18%11accepted challenger
05Jit0%11%27accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
All twenty-one head-to-head pages: the top seven products, each against each

One product takes 71% of first choices here, so the chart would put eleven markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Six products carry a negative rate above 25% in this category.

What they warned about

Eight of fourteen models held their first choice under the paraphrase. Grok 4.1 Fast, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5 and GPT-6 Luna changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
ArmorCode
74%
17 of 23 labels negative · 9 of 14 models · 9 hard negative
“pure-play ASPM tools (like ArmorCode or Apiiro) are designed for large enterprises ... they are not recommended for small businesses” Gemini 3.5 Flash, paraphrase prompt
Veracode Risk Manager
80%
8 of 10 labels negative · 8 of 14 models · 4 hard negative
“Avoid: Enterprise-Focused Legacy Monoliths ... **Checkmarx & Veracode** ... **Why to Avoid:**” Qwen 3.7 Flash, negative prompt
Checkmarx One
71%
10 of 14 labels negative · 7 of 14 models · 7 hard negative
“Platforms to avoid or approach with caution: Checkmarx One, Veracode, Synopsys: Often cited as enterprise-heavy with complex setups” Grok 4.1 Fast, negative prompt
Apiiro
85%
11 of 13 labels negative · 6 of 14 models · 7 hard negative
“pure-play ASPM tools (like ArmorCode or Apiiro) are designed for large enterprises ... they are not recommended for small businesses” Gemini 3.5 Flash, paraphrase prompt

What they cite

Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

79 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 1113 links across 139 sites, every framing counted. Ranked by the number of answers carrying the site or page. None of the 252 answers across every segment cited this index's own page for the category.

51 answers · 79 citations · 12 models
vendor site · Cycode48 answers · 52 citations · 12 models
vendor site · Aikido39 answers · 56 citations · 12 models
38 answers · 58 citations · 12 models
vendor site · G233 answers · 66 citations · 12 models
vendor site · SourceForge31 answers · 42 citations · 10 models
vendor site · Orca29 answers · 36 citations · 12 models
vendor site · Checkmarx29 answers · 34 citations · 11 models
27 answers · 28 citations · 11 models
vendor site · Invicti26 answers · 29 citations · 10 models
vendor site · Guideflow26 answers · 27 citations · 11 models
vendor site · Plexicus23 answers · 23 citations · 10 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

Search against answers

Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “aspm platform”, “aspm platforms”, “best aspm platform”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
Company and productsShareOwn site citedName searches, GoogleAI search demand, est.Organic visitsPaid search a month, est.Google ads, last 30 daysBest Google position
Aikido aikido.dev
Aikido Security 71%
71%3422,400516,442 company$936120
Snyk snyk.io
Snyk 19%, Snyk AppRisk 0%
19%14312,10058161,651606
Conviso Platform4%100
DefectDojo defectdojo.com2%5288096031
GitHub's built-in security overview2%
Microsoft Defender microsoft.com
Microsoft Defender for Cloud 2%
2%56918,1003,525145,358,109 company$12,455103
Jit jit.io0%6733,1006,4505,093
Semgrep semgrep.dev0%1948,1001913,46143
GitHub parent site
GitHub Advanced Security 0%, GitHub Dependabot 0%
0%1111,500,00031,479
Plexicus ASPM plexicus.ai0%10

Google's top ten for the three searches hold 23 sites; 8 of them are among the sites the models cited here (checkmarx.com, cycode.com, expertinsights.com, g2.com, gartner.com, invicti.com, orca.security, sourceforge.net). The first result for “aspm platform” is gartner.com.

How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHide
ModelDirect“What is the best ASPM platform for a small B2B company?”Paraphrase“Which application security posture management tool would you recommend to a small business that sells to other businesses?”Comparative“What are the top ASPM platforms for a small team and how do they differ?”Budget-constrained“What is the best ASPM platform for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a ASPM platform. What should we look at?”Negative“Which ASPM platforms should a small business avoid or be cautious about?”
Claude Haiku 4.5Aikido Security
Four alternativesDefectDojo, Faraday, Jit, Snyk
Aikido SecurityHeld
One alternativeXygeni
Aikido Security
Two alternativesJit, Snyk AppRisk
Aikido Security, Snyk
Two alternativesArnica, DefectDojo
no first choiceagainst: Cycode ASPM, Invicti ASPM, OX ASPM
GPT-5.4 miniSnyk
One alternativeAikido Security
SnykHeld
Three alternativesCheckmarx ASPM, Checkmarx One, Veracode Risk Manager
Checkmarx ASPM
Four alternativesCycode ASPM, Invicti ASPM, Legit Security ASPM, OX ASPM
Microsoft Defender for Cloud
One alternativeArmorCode
no first choicenothing named
Gemini 3.5 FlashAikido Security
Two alternativesDefectDojo, Jit
against: Apiiro, ArmorCode, CrowdStrike Falcon ASPM, Legit Security
Aikido SecurityHeld
Two alternativesDefectDojo, Jit
against: Apiiro, ArmorCode, Snyk
Aikido Security
Three alternativesDefectDojo, Jit, Kondukto
against: Apiiro, ArmorCode, Legit Security
Aikido Security, DefectDojo
One alternativeJit.io
against: Apiiro, ArmorCode, Cycode ASPM
Aikido Security
Three alternativesDefectDojo, Jit, Snyk
against: Apiiro, ArmorCode, Cycode ASPM, Legit Security
against: Apiiro, ArmorCode, Checkmarx One, Cycode ASPM, DefectDojo, Legit Security, Veracode Risk Manager
Perplexity SonarAikido Security
One alternativeJit
against: Cycode ASPM, Veracode Risk Manager, Wiz
Aikido SecurityHeld
Two alternativesOpenText, Veracode Risk Manager
Aikido Security
Two alternativesInvicti ASPM, Jit
against: ArmorCode, Cycode ASPM
Aikido Security
Two alternativesJit, Snyk
no first choiceagainst: Apiiro, CrowdStrike Falcon Cloud Security, Cycode ASPM, Qualys
Grok 4.1 FastAikido Security, Snyk
Three alternativesDefectDojo, Jit, Strobes ASPM
Aikido SecurityChanged
Two alternativesConviso Platform, Snyk
Aikido Security
Four alternativesConviso Platform, Jit, Plexicus ASPM, Snyk
Conviso Platform
One alternativeDefectDojo
against: ArmorCode, CrowdStrike, Strobes ASPM
no first choiceagainst: Apiiro, ArmorCode, Black Duck, Checkmarx One, Cycode ASPM, OX Security, Snyk, Veracode Risk Manager
Mistral SmallAikido SecurityAikido SecurityHeldAikido Security
Two alternativesOX Security, Snyk
Aikido Securityno first choicenothing named
DeepSeek V4 FlashAikido Security
Two alternativesJit, Snyk AppRisk
Aikido SecurityHeld
Two alternativesCycode ASPM, Jit
against: Checkmarx One, Snyk, Veracode Risk Manager
Aikido Security, Jit
One alternativeSnyk
against: ArmorCode, Cycode ASPM
Aikido Security
Two alternativesScanDog, Snyk
Aikido Security, Conviso Platform
Four alternativesCheckmarx One, DefectDojo, Snyk, Snyk AppRisk
against: ArmorCode, Cycode ASPM, Legit, OX Security
against: Apiiro, ArmorCode, Cortex Xpanse, Jit, Kondukto, Legit Security, Prisma Cloud, Strobes ASPM
Llama 4 MaverickAikido SecurityAikido SecurityHeld
Four alternativesArmorCode, Cycode ASPM, Jit, Snyk AppRisk
Aikido Security
Two alternativesConviso Platform, Legit Security
Aikido Securityno first choicenothing named
Qwen 3.7 FlashAikido Security
One alternativeSnyk
against: ArmorCode, Checkmarx One, Dynatrace, Tenable
SnykChanged
One alternativeJit
Aikido Security
Three alternativesCider Security, Cycode ASPM, Snyk
Snyk
Five alternativesGitHub Dependabot, Mend.io, Semgrep, SonarQube, Trivy
no first choiceagainst: Aikido Security, Checkmarx One, Jit, Veracode Risk Manager
Kimi K2Snyk
One alternativeJit
against: ArmorCode, OX Security
Aikido SecurityChanged
Three alternativesConviso Platform, Jit, Snyk AppRisk
Aikido Security
Two alternativesJit Security, Snyk
Aikido Security
Two alternativesDefectDojo, SOOS
Aikido Security, Snyk
Three alternativesDefectDojo, GitHub Advanced Security, Semgrep
against: Checkmarx One, Orca Security, Palo Alto Networks, Veracode Risk Manager
against: Apiiro, Checkmarx One, Legit Security, Palo Alto Networks Cortex Cloud
GLM 4.7 FlashXAikido Security
One alternativeSnyk
against: Jit
SnykChanged
One alternativeAikido Security
against: DefectDojo
Aikido Security
Three alternativesCycode ASPM, Legit Security, Wiz
Aikido Security
Two alternativesDefectDojo, Sonatype
against: AppDynamics, Checkmarx One, Snyk
no first choiceagainst: Black Duck, Checkmarx One, Conviso Platform, CrowdStrike Falcon Cloud Security, Plexicus ASPM
MiniMax M2.5Aikido Security
Two alternativesSnyk, Xygeni
against: ArmorCode
SnykChanged
Four alternativesCheckmarx One, GitHub Advanced Security, Mend, SonarQube
against: Veracode Risk Manager
Aikido Security
Four alternativesConviso Platform, DefectDojo, Jit, Plexicus ASPM
Aikido Security
Two alternativesConviso Platform, Plexicus ASPM
against: Strobes ASPM
Aikido Security
Two alternativesCycode ASPM, Legit Security
against: Palo Alto Networks
nothing named
GPT-6 LunaAikido Security
Two alternativesGitHub Code Security + Secret Protection, Semgrep
GitHub's built-in security overviewChanged
One alternativeSemgrep
against: Snyk AppRisk
Aikido Security
Three alternativesGitLab, Semgrep, Snyk
Aikido Security
One alternativeSemgrep
no first choiceagainst: ArmorCode, CrowdStrike Falcon ASPM, Ivanti Neurons for ASPM, Nucleus Security, Wiz
Muse Glimmer 30BAikido Security
Two alternativesConviso Platform, ScanDog
Aikido SecurityHeld
Two alternativesDefectDojo, Jit
Aikido Security
Two alternativesJit, Snyk
against: Orca Security, Wiz
Aikido Security
Two alternativesDefectDojo, Jit
Aikido Security
Two alternativesJit, Snyk AppRisk
against: Apiiro, ArmorCode, Checkmarx One, Cycode ASPM, Legit Security, OX Security, Snyk AppRisk, Veracode Risk Manager
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-10-05 00:18yes97 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-05 00:58yes24 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-10-05 00:32yes2126 s
Direct recommendationPerplexity Sonarsonar2026-10-04 22:58yes194 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-10-05 01:05yes2110 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-10-05 00:52yes53 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-05 00:56yes2242 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-05 00:07yes52 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-04 23:05yes833 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-10-05 00:32yes2025 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-05 00:16yes2268 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-04 22:10yes1120 s
Direct recommendationGPT-6 Lunagpt-6-luna2026-10-05 01:35yes425 s
Direct recommendationMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-10-05 00:22yes2430 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-10-04 23:02yes178 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-05 00:52yes34 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-10-05 01:36yes1226 s
ParaphrasePerplexity Sonarsonar2026-10-05 01:10yes163 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-10-04 23:45yes218 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-10-04 23:44yes53 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-05 01:26yes2329 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-04 23:45yes52 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-05 00:03yes528 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-10-04 23:59yes2520 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-05 00:39yes2251 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-04 23:05no042 s
ParaphraseGPT-6 Lunagpt-6-luna2026-10-04 23:47yes315 s
ParaphraseMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-10-05 00:42yes918 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-10-04 22:57yes99 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-05 01:54yes26 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-10-04 23:50yes1725 s
ComparativePerplexity Sonarsonar2026-10-05 00:14yes195 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-10-05 01:38yes1710 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-10-04 22:34yes1911 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-04 22:22yes2432 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-04 23:28yes52 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-05 01:06yes1544 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-10-05 00:52yes2025 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-04 23:01yes21179 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-05 01:55yes2427 s
ComparativeGPT-6 Lunagpt-6-luna2026-10-04 23:51yes634 s
ComparativeMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-10-04 22:39yes2336 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-10-05 00:47yes178 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-05 01:23yes25 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-10-05 00:39yes1925 s
Budget constrainedPerplexity Sonarsonar2026-10-05 00:02yes213 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-10-04 22:26yes2210 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-10-04 22:15yes53 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-05 00:05yes2466 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-04 23:23yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-04 23:57no029 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-10-05 00:16yes2433 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-05 01:53yes23135 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-04 22:54yes1323 s
Budget constrainedGPT-6 Lunagpt-6-luna2026-10-05 01:01yes216 s
Budget constrainedMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-10-04 23:35yes2328 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-10-04 23:58yes1710 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-05 01:14no010 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-10-05 00:18yes1026 s
Scale constrainedPerplexity Sonarsonar2026-10-05 00:06yes187 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-10-05 01:28yes159 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-10-05 01:25no08 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-05 01:32yes2247 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-05 01:56yes52 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-05 01:08no024 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-10-04 22:29yes1927 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-05 01:22yes1738 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-05 01:22yes514 s
Scale constrainedGPT-6 Lunagpt-6-luna2026-10-04 23:34yes216 s
Scale constrainedMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-10-04 23:39yes1022 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-10-05 01:44yes98 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-10-05 01:52yes36 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-10-05 00:25yes1625 s
Negative framingPerplexity Sonarsonar2026-10-05 01:30yes204 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-10-05 00:19yes198 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-10-05 00:00yes54 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-10-04 22:36yes2336 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-10-04 23:21yes54 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-10-05 01:06yes18100 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-10-05 01:55yes2228 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-10-04 23:00yes1935 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-10-05 01:36yes1340 s
Negative framingGPT-6 Lunagpt-6-luna2026-10-04 23:56yes217 s
Negative framingMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-10-04 22:56yes1930 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

ShowHide
Category-scoped readings
Aikido read as Aikido Security
Checkmarx read as Checkmarx One
CrowdStrike Falcon read as CrowdStrike Falcon Cloud Security
Cycode read as Cycode ASPM
Invicti read as Invicti ASPM
Orca read as Orca Security
Plexicus read as Plexicus ASPM
Veracode read as Veracode Risk Manager
Unresolved, counted raw
ActiveState
GitHub Code Security + Secret Protection
GitHub's built-in security overview
Jit Security
Legit
Discontinued, still offered
No shut-down product was recommended here.
← API managementApp shielding →