Index › Developer platform › September 2026 Edition

Software composition analysis

Asked as “software composition analysis tool”, and as “open source dependency vulnerability scanner”, on behalf of a mid-market B2B company. 43 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.

Standing

Trivy

Contested

40% of first choices, contested.

ShowinginAll 67 categories in the September 2026 Edition →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

Small business

Trivy36%ContestedStanding →Mid-market

Trivy40%ContestedThis page Enterprise

Black Duck19%ContestedStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.

ProductFirst-choice shareNegative rateLabelsQuadrant

Trivy3%30endorsed leader

Snyk Open Source15%47accepted challenger

Mend.io15%34accepted challenger

OWASP Dependency-Check38%32criticized challenger

OWASP Dependency-Track0%11accepted challenger

Show the eight products at 0%, ordered by negative rate

Sonatype Lifecycle19%31accepted challenger

Black Duck18%34accepted challenger

GitHub Advanced Security17%12accepted challenger

JFrog Xray8%13accepted challenger

Grype7%14accepted challenger

Endor Labs0%19accepted challenger

FOSSA0%18accepted challenger

OSV-Scanner0%13accepted challenger

Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Head to head

Trivy vs Snyk Open Source Trivy vs Mend.io Snyk Open Source vs Mend.io

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default

Negative label rate →

Accepted challengerEndorsed leader

0%First-choice share → · lines at 30% share and 25% negative50%

Key

Trivy40%

Snyk Open Source16%

Mend.io14%

OWASP Dependency-Check14%

OWASP Dependency-Track2%

Endor Labs0%

Black Duck0%

Sonatype Lifecycle0%

FOSSA0%

Grype0%

OSV-Scanner0%

JFrog Xray0%

GitHub Advanced Security0%

02What they warned about

Zero of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.

OWASP Dependency-Check

38%

12 of 32 labels negative · 7 of 12 models · 2 hard negative

“You should actively **avoid** using the traditional OWASP Dependency-Check” Qwen 3.7 Flash, paraphrase prompt

Snyk Open Source

15%

7 of 47 labels negative · 7 of 12 models

“The industry heavyweight with top-tier developer UX, strong remediation suggestions, and a wide ecosystem, though it can be highly expensive.” Gemini 3.5 Flash, scale prompt

Black Duck

18%

6 of 34 labels negative · 5 of 12 models

“like older versions of Black Duck or Sonatype Nexus IQ) can be slow to install, heavy on resources, or difficult to configure at scale” Qwen 3.7 Flash, negative prompt

Mend.io

15%

5 of 34 labels negative · 5 of 12 models

“reachability) works well for Java/JavaScript but poorly for Python, Go... Internal benchmarks claim "+46% better" remediation but lack external validation.” Kimi K2, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

63 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 799 links across 175 sites, every framing counted. Ranked by the number of answers carrying the site or page.

endorlabs.com

vendor site · Endor Labs41 answers · 71 citations · 10 models

guideflow.com

vendor site · Guideflow25 answers · 25 citations · 8 models

ox.security

24 answers · 25 citations · 8 models

toolradar.com

24 answers · 24 citations · 9 models

safeguard.sh

vendor site · Safeguard22 answers · 52 citations · 7 models

appsecsanta.com

21 answers · 37 citations · 9 models

aikido.dev

vendor site · Aikido21 answers · 23 citations · 10 models

cycode.com

vendor site · Cycode17 answers · 17 citations · 8 models

dupple.com

17 answers · 17 citations · 9 models

expertinsights.com

vendor site · Expert Insights17 answers · 17 citations · 7 models

sonatype.com

vendor site · Sonatype15 answers · 28 citations · 8 models

mend.io

vendor site · Mend14 answers · 18 citations · 10 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

endorlabs.com/learn/best-sca-tools-05b7a

40 answers · 10 models

endorlabs.com/learn/best-sca-tools

27 answers · 9 models

ox.security/blog/software-composition-analysis-and-sca-tools

24 answers · 8 models

toolradar.com/blog/best-software-composition-analysis-tools

23 answers · 9 models

guideflow.com/blog/software-composition-analysis-tools

21 answers · 8 models

dupple.com/learn/best-software-composition-analysis-tools

17 answers · 9 models

expertinsights.com/application-security/the-top-software-composition-analys…

17 answers · 7 models

appsecsanta.com/sca-tools/open-source-sca-tools

15 answers · 9 models

appsecsanta.com/sca-tools

13 answers · 6 models

sonatype.com/compare/best-sca-tools

13 answers · 7 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.

ModelDirect“What is the best software composition analysis tool for a mid-market B2B company?”Paraphrase“Which open source dependency vulnerability scanner would you recommend to a mid-sized B2B company?”Comparative“What are the top software composition analysis tools and how do they differ?”Budget-constrained“What is the best software composition analysis tool for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a software composition analysis tool. What should we look at?”Negative“Which software composition analysis tools should I avoid or be cautious about?”

Claude Haiku 4.5no first choiceOWASP Dependency-CheckChanged

Two alternatives

OWASP Dependency-Track, Trivy

no first choiceOSS Review Toolkit, OWASP Dependency-Check

Two alternatives

DeepSCA, Snyk Open Source

no first choiceagainst: GitHub Advanced Security, JFrog Xray

GPT-5.4 miniMend.io, Snyk Open Source

Three alternatives

Black Duck, GitHub Advanced Security, Sonatype Lifecycle

OWASP Dependency-CheckChanged

Three alternatives

Grype, OWASP Dependency-Track, Trivy

Snyk Open Source

Five alternatives

Black Duck, GitHub Advanced Security / dependency review, Mend.io, Sonatype Lifecycle, Trivy

Dependabot + Dependency Review

One alternative

OWASP Dependency-Check

against: Mend.io, Snyk Open Source, Sonatype Lifecycleno first choicenothing named

Gemini 3.5 FlashAikido Security

Three alternatives

Mend.io, Semgrep Supply Chain, Snyk Open Source

TrivyChanged

Two alternatives

GitHub Dependabot, OSV-Scanner

against: OWASP Dependency-CheckSnyk Open Source

Four alternatives

Black Duck, Endor Labs, Socket, Sonatype Lifecycle

GitHub Dependabot, Trivy

Four alternatives

Aikido Security, FOSSA, Grype + Syft, Snyk Open Source

against: OWASP Dependency-CheckAikido Security, Cycode

Four alternatives

Black Duck, Endor Labs, GitHub Advanced Security, Mend.io

against: Snyk Open Sourceagainst: OWASP Dependency-Check

Perplexity SonarMend.io

Four alternatives

Black Duck, Endor Labs, Snyk Open Source, Sonatype Lifecycle

TrivyChanged

One alternative

OWASP Dependency-Check

no first choiceTrivy

One alternative

Semgrep Supply Chain

against: GitHub Advanced Security + Dependabot, Snyk Open Sourceno first choiceagainst: OWASP Dependency-Check, Retire.js, Safety, bundler-audit

Grok 4.1 FastSnyk Open Source

Five alternatives

Aikido Security, Black Duck, Mend.io, SOOS, Sonatype Lifecycle

TrivyChanged

Four alternatives

Grype, OSV-Scanner, OWASP Dependency-Check, OWASP Dependency-Track

Sonatype Lifecycle

Two alternatives

Black Duck, Snyk Open Source

Trivy

Two alternatives

GitHub Dependabot, Snyk Open Source

against: Grype, OWASP Dependency-Check, Semgrep, SocketSnyk Open Source

Four alternatives

Black Duck, Endor Labs, Mend.io, Sonatype Lifecycle

against: Black Duck, Mend.io, Snyk Open Source, Sonatype Lifecycle, Trivy

Mistral SmallMend.io

Two alternatives

OX Security, Sonatype Lifecycle

OWASP Dependency-CheckChanged

Two alternatives

Grype, Trivy

Endor Labs

Nine alternatives

Black Duck, Cycode, FOSSA, GitLab Dependency Scanning, Mend.io, Semgrep Supply Chain, Snyk Open Source, Sonatype Lifecycle, Wiz Code

against: SonarQubeOWASP Dependency-Track, Trivy

Two alternatives

Snyk Open Source, Socket

no first choiceagainst: Black Duck, Sonatype Lifecycle

DeepSeek V4 FlashSnyk Open Source

Two alternatives

Mend.io, Sonatype Lifecycle

TrivyChanged

Four alternatives

GitHub Dependabot, Grype, OSV-Scanner, OWASP Dependency-Track

against: OWASP Dependency-CheckSnyk Open Source

Eight alternatives

Black Duck, Endor Labs, Grype, JFrog Xray, Socket, Sonatype Lifecycle, Syft, Trivy

against: OWASP Dependency-CheckSnyk Open Source, Trivy

Three alternatives

FOSSA, OWASP Dependency-Track, Socket

against: OWASP Dependency-Checkno first choiceagainst: Black Duck, Mend.io, OWASP Dependency-Check, Retire.js, Snyk Open Source, Sonatype Lifecycle, Tenable Legacy Container Security's SCA feature

Llama 4 MaverickMend.io

One alternative

Sonatype Lifecycle

no first choiceChangedno first choiceTrivy

Four alternatives

OWASP Dependency-Check, Semgrep, Snyk Open Source, Socket

no first choicenothing named

Qwen 3.7 FlashMend.io

Two alternatives

Renovate, Snyk Open Source

against: Sonatype LifecycleTrivyChanged

One alternative

OSV-Scanner

against: OWASP Dependency-CheckSnyk Open Source

Four alternatives

Black Duck, GitHub Advanced Security (GHAS) / Dependabot, Mend.io, Sonatype Lifecycle

OWASP Dependency-Check, Trivy

Three alternatives

FOSSA, SOOS, Snyk Open Source

against: Black Duck, Mend.iono first choice

Three alternatives

JFrog, Snyk Open Source, Sonatype Lifecycle

against: Black Duck, Sonatype Lifecycle

Kimi K2Snyk Open Source

Two alternatives

Mend.io, Sonatype Lifecycle

TrivyChanged

One alternative

Grype + Syft

against: OWASP Dependency-CheckSnyk Open Source

Six alternatives

Black Duck, FOSSA, GitHub Advanced Security, JFrog Xray, Mend.io, Sonatype Lifecycle

Trivy

Four alternatives

Grype, OSV-Scanner, OWASP Dependency-Check, Syft

no first choiceagainst: Black Duck, Mend.io, Snyk Open Source

GLM 4.7 FlashXMend.io

Three alternatives

Black Duck, Snyk Open Source, Sonatype Lifecycle

OWASP Dependency-CheckChanged

Four alternatives

Grype, OSV-Scanner, Syft, Trivy

Snyk Open Source

Six alternatives

Aikido Security, Black Duck, Endor Labs, Mend.io, OWASP Dependency-Check, Sonatype Lifecycle

against: GitHub Advanced SecurityTrivy

Two alternatives

GitHub Dependabot, OWASP Dependency-Check

no first choiceagainst: OWASP Dependency-Check, Snyk Open Source

MiniMax M2.5Snyk Open Source

Three alternatives

Black Duck, GitLab Dependency Scanning, Mend.io

TrivyChanged

Three alternatives

Grype, OSV-Scanner, OWASP Dependency-Check

Endor Labs, Snyk Open Source

Six alternatives

Black Duck, Checkmarx SCA, FOSSA, Mend.io, Semgrep Supply Chain, Sonatype Lifecycle

Trivy

Three alternatives

Black Duck, OWASP Dependency-Track, Snyk Open Source

no first choicenothing named

Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record

Seventy-two rows: every prompt, every model, every answer.

Prompt	Model	Version string	Time (UTC)	Searched	Sources	Latency
Direct recommendation	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 14:08	no	0	5 s
Direct recommendation	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 14:02	yes	5	10 s
Direct recommendation	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 10:23	yes	22	27 s
Direct recommendation	Perplexity Sonar	`sonar`	2026-09-17 09:59	yes	20	3 s
Direct recommendation	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 12:20	yes	35	17 s
Direct recommendation	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:13	yes	5	4 s
Direct recommendation	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 13:45	yes	17	20 s
Direct recommendation	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 14:04	yes	5	2 s
Direct recommendation	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 13:07	yes	24	89 s
Direct recommendation	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 13:45	yes	9	29 s
Direct recommendation	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 11:25	yes	29	79 s
Direct recommendation	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 13:36	no	0	45 s
Paraphrase	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 10:52	yes	17	9 s
Paraphrase	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 10:48	yes	3	7 s
Paraphrase	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 13:59	yes	11	22 s
Paraphrase	Perplexity Sonar	`sonar`	2026-09-17 13:46	yes	20	5 s
Paraphrase	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 11:44	yes	28	14 s
Paraphrase	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 11:51	yes	5	3 s
Paraphrase	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 13:06	yes	9	18 s
Paraphrase	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 11:21	yes	5	3 s
Paraphrase	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 12:50	yes	5	31 s
Paraphrase	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 12:26	yes	12	41 s
Paraphrase	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 11:33	yes	10	93 s
Paraphrase	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 11:35	yes	9	59 s
Comparative	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:47	yes	10	7 s
Comparative	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 13:52	yes	9	14 s
Comparative	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 11:02	yes	19	31 s
Comparative	Perplexity Sonar	`sonar`	2026-09-17 11:24	yes	20	7 s
Comparative	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 12:55	yes	27	17 s
Comparative	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 14:14	yes	5	9 s
Comparative	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-09-17 13:08	yes	22	51 s
Comparative	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:15	yes	5	3 s
Comparative	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 13:31	no	0	43 s
Comparative	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 12:54	yes	12	46 s
Comparative	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 09:41	yes	24	119 s
Comparative	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 12:42	yes	5	11 s
Budget constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 11:08	yes	9	7 s
Budget constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 13:04	yes	2	4 s
Budget constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 13:07	yes	9	24 s
Budget constrained	Perplexity Sonar	`sonar`	2026-09-17 12:43	yes	20	5 s
Budget constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 12:23	yes	32	17 s
Budget constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 11:59	yes	5	5 s
Budget constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 11:08	yes	8	12 s
Budget constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 10:45	yes	5	3 s
Budget constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 12:51	yes	9	23 s
Budget constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 12:28	yes	9	23 s
Budget constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 12:31	yes	21	63 s
Budget constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 10:41	yes	14	36 s
Scale constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 14:08	no	0	5 s
Scale constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 11:23	no	0	7 s
Scale constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 13:41	yes	7	256 s
Scale constrained	Perplexity Sonar	`sonar`	2026-09-17 14:05	yes	20	8 s
Scale constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:39	yes	13	13 s
Scale constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:39	no	0	8 s
Scale constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 13:58	yes	18	24 s
Scale constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 13:50	yes	5	4 s
Scale constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 10:12	no	0	47 s
Scale constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 10:42	yes	10	27 s
Scale constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 10:48	yes	15	90 s
Scale constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 14:09	no	0	14 s
Negative framing	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 10:12	yes	17	8 s
Negative framing	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 14:00	yes	6	8 s
Negative framing	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 13:19	yes	25	23 s
Negative framing	Perplexity Sonar	`sonar`	2026-09-17 11:08	yes	20	6 s
Negative framing	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 11:39	yes	36	18 s
Negative framing	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 10:23	yes	5	5 s
Negative framing	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 09:38	yes	29	21 s
Negative framing	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:25	yes	5	2 s
Negative framing	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 10:18	yes	5	25 s
Negative framing	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 10:10	yes	24	45 s
Negative framing	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 09:25	yes	26	111 s
Negative framing	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 13:13	no	0	14 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings

Aikido read as Aikido Security

GitLab read as GitLab Dependency Scanning

GitLab (Dependency Scanning) read as GitLab Dependency Scanning

GitLab Ultimate read as GitLab Dependency Scanning

Mend read as Mend.io

Mend (formerly WhiteSource) read as Mend.io

Snyk read as Snyk Open Source

Snyk (Free Tier) read as Snyk Open Source

Snyk (commercial) read as Snyk Open Source

Snyk Free Tier read as Snyk Open Source

Snyk Team read as Snyk Open Source

Sonatype read as Sonatype Lifecycle

Sonatype (Lifecycle & Nexus) read as Sonatype Lifecycle

Sonatype (Nexus Intelligence) read as Sonatype Lifecycle

Unresolved, counted raw

CDXgen

DeepSCA

Dependabot + Dependency Review

FossID

GitHub Advanced Security / dependency review

Plexicus

Tenable Legacy Container Security's SCA feature

Wiz Code

npm audit / pip‑audit

Discontinued, still offered

No shut-down product was recommended here.

Software composition analysis

By buyer segment

01The standing

Recommended versus criticized

02What they warned about

03What they cite

Sites the answers cite

Pages the answers cite

04How they answered

05The record

Normalization in this category

Also in developer platform