Software composition analysis for enterprise buyers
Asked as “software composition analysis tool”, and as “open source dependency vulnerability scanner”, on behalf of an enterprise B2B company. 56 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
23%
Contested · Sonatype Lifecycle 21%
23Black Duck21Sonatype Lifecycle14Mend.io41others
23% of first choices, contested.
Since September 2026↗new leaderNew leader since September 2026: Sonatype Lifecycle (22%) replaces Black Duck (19% then, 22% now), 0 points clear, inside the 11-point floor.Sonatype Lifecycle leads at 22%, replacing Black Duck, which led at 19% and stands at 22% now: 0 points clear, inside the floor, so the swap reads as unsettled.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Snyk Open Source39%Contested↗new leaderNew leader since September 2026: Snyk Open Source (41%) replaces Trivy (36% then, 15% now), 26 points clear, past the 11-point floor.Standing →Mid-market
Trivy31%Contested▼−5Since September 2026: 40% → 34%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →Enterprise
Black Duck23%Contested↗new leaderNew leader since September 2026: Sonatype Lifecycle (22%) replaces Black Duck (19% then, 22% now), 0 points clear, inside the 11-point floor.This page
Snyk Open Source39%Contested↗new leaderNew leader since September 2026: Snyk Open Source (41%) replaces Trivy (36% then, 15% now), 26 points clear, past the 11-point floor.Standing →Mid-marketTrivy31%Contested▼−5Since September 2026: 40% → 34%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →EnterpriseBlack Duck23%Contested↗new leaderNew leader since September 2026: Sonatype Lifecycle (22%) replaces Black Duck (19% then, 22% now), 0 points clear, inside the 11-point floor.This pageThe standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince September 2026
01Black Duck23%18%60accepted challenger▲+3Since September 2026: 19% → 22%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.19% → 22%
Black Duck23%18%60accepted challenger▲+3Since September 2026: 19% → 22%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.19% → 22%02
Sonatype Lifecycle21%9%45accepted challenger▲+3Since September 2026: 19% → 22%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.19% → 22%
Sonatype Lifecycle21%9%45accepted challenger▲+3Since September 2026: 19% → 22%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.19% → 22%03
Mend.io14%25%48criticized challenger▲+5Since September 2026: 10% → 14%, +5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.10% → 14%
Mend.io14%25%48criticized challenger▲+5Since September 2026: 10% → 14%, +5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.10% → 14%04Trivy9%20%15accepted challenger▲+1Since September 2026: 7% → 8%, +1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.7% → 8%
Trivy9%20%15accepted challenger▲+1Since September 2026: 7% → 8%, +1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.7% → 8%05Snyk Open Source5%32%60criticized challenger▼−3Since September 2026: 10% → 6%, −3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.10% → 6%
Snyk Open Source5%32%60criticized challenger▼−3Since September 2026: 10% → 6%, −3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.10% → 6%06
OWASP Dependency-Track5%0%11accepted challenger▼−8Since September 2026: 14% → 6%, −8 points. Inside the 11-point floor: within noise. Read over the models both editions asked.14% → 6%
OWASP Dependency-Track5%0%11accepted challenger▼−8Since September 2026: 14% → 6%, −8 points. Inside the 11-point floor: within noise. Read over the models both editions asked.14% → 6%07
JFrog Xray4%12%17accepted challenger=heldSince September 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 2%
JFrog Xray4%12%17accepted challenger=heldSince September 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 2%08
Aikido Security4%0%10accepted challenger▼−10Since September 2026: 14% → 4%, −10 points. Inside the 11-point floor: within noise. Read over the models both editions asked.14% → 4%
Aikido Security4%0%10accepted challenger▼−10Since September 2026: 14% → 4%, −10 points. Inside the 11-point floor: within noise. Read over the models both editions asked.14% → 4%09
GitHub Advanced Security4%30%20criticized challenger▲+4Since September 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 4%
GitHub Advanced Security4%30%20criticized challenger▲+4Since September 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 4%10
OWASP Dependency-Check4%63%19criticized challenger▼−1Since September 2026: 5% → 4%, −1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.5% → 4%
OWASP Dependency-Check4%63%19criticized challenger▼−1Since September 2026: 5% → 4%, −1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.5% → 4%Show the four products at 0%, ordered by negative rate
14
Veracode SCA0%33%15criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Veracode SCA0%33%15criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%13
FOSSA0%21%19accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
FOSSA0%21%19accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%12
Checkmarx SCA0%18%17accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Checkmarx SCA0%18%17accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%11
Endor Labs0%0%10accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Endor Labs0%0%10accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
All twenty-eight head-to-head pages: the top eight products, each against each
Trivy vs OWASP Dependency-CheckTrivy vs GitHub DependabotTrivy vs Sonatype LifecycleTrivy vs GitHub Advanced SecuritySnyk Open Source vs Mend.ioSnyk Open Source vs OWASP Dependency-TrackSnyk Open Source vs OWASP Dependency-CheckSnyk Open Source vs GitHub DependabotSnyk Open Source vs Sonatype LifecycleSnyk Open Source vs GitHub Advanced SecurityMend.io vs OWASP Dependency-TrackMend.io vs OWASP Dependency-CheckMend.io vs GitHub DependabotMend.io vs Sonatype LifecycleMend.io vs GitHub Advanced SecurityOWASP Dependency-Track vs OWASP Dependency-CheckOWASP Dependency-Track vs GitHub DependabotOWASP Dependency-Track vs Sonatype LifecycleOWASP Dependency-Track vs GitHub Advanced SecurityOWASP Dependency-Check vs GitHub DependabotOWASP Dependency-Check vs Sonatype LifecycleOWASP Dependency-Check vs GitHub Advanced SecurityGitHub Dependabot vs Sonatype LifecycleGitHub Dependabot vs GitHub Advanced SecuritySonatype Lifecycle vs GitHub Advanced Security
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
0102030405060708091011121314Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01Black Duck23%
Black Duck23%02Sonatype Lifecycle21%
Sonatype Lifecycle21%03Mend.io14%
Mend.io14%04Trivy9%
Trivy9%05Snyk Open Source5%
Snyk Open Source5%06OWASP Dependency-Track5%
OWASP Dependency-Track5%07JFrog Xray4%
JFrog Xray4%08Aikido Security4%
Aikido Security4%09GitHub Advanced Security4%
GitHub Advanced Security4%10OWASP Dependency-Check4%
OWASP Dependency-Check4%11Endor Labs0%
Endor Labs0%12Checkmarx SCA0%
Checkmarx SCA0%13FOSSA0%
FOSSA0%14Veracode SCA0%
Veracode SCA0%What they warned about
Zero of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Snyk Open Source32%
19 of 60 labels negative · 12 of 14 models · 3 hard negative
“**Avoid per-developer seat models** (like Snyk or GitHub Advanced Security), as these can become unpredictable and expensive at scale” Mistral Small, budget prompt
OWASP Dependency-Check63%
12 of 19 labels negative · 9 of 14 models · 6 hard negative
“Basic Repository-Native or Free Tools as your Sole Solution (e.g., OWASP Dependency-Check)... Why to avoid: They do not offer the centralized governance” Gemini 3.5 Flash, negative prompt
Mend.io25%
12 of 48 labels negative · 9 of 14 models · 1 hard negative
“**Verdict:** Avoid if your org has many language polyglots and requires deep policy customization.” DeepSeek V4 Flash, negative prompt
Black Duck18%
11 of 60 labels negative · 8 of 14 models · 2 hard negative
“Not recommended for your use case ... Quote-only, project/codebase-based pricing that's unpredictable at scale” DeepSeek V4 Flash, budget prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
78 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 1114 links across 227 sites, every framing counted. Ranked by the number of answers carrying the site or page. 3 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Guideflow53 answers · 55 citations · 11 models
vendor site · Sonatype42 answers · 75 citations · 14 models
vendor site · Mend36 answers · 60 citations · 14 models
29 answers · 42 citations · 10 models
vendor site · Endor Labs29 answers · 38 citations · 11 models
vendor site · Aikido25 answers · 38 citations · 10 models
vendor site · Checkmarx24 answers · 26 citations · 9 models
23 answers · 24 citations · 8 models
vendor site · Black Duck20 answers · 35 citations · 11 models
vendor site · Safeguard19 answers · 23 citations · 10 models
vendor site · Cycode17 answers · 22 citations · 9 models
17 answers · 20 citations · 9 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
49 answers · 11 models
38 answers · 13 models
24 answers · 10 models
23 answers · 8 models
22 answers · 9 models
20 answers · 9 models
17 answers · 9 models
16 answers · 10 models
16 answers · 10 models
16 answers · 9 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best software composition analysis tool”, “software composition analysis tool”, “software composition analysis tools”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Black Duck blackduck.com | 23% | 137 | 33,100 | 3,087 | 76,259 | 73 | 3 | |
| Sonatype sonatype.com Sonatype Lifecycle 21%, Sonatype Nexus IQ 0% | 21% | 121 | 90 | 1 | 71,814 company | $1,879 | 7 | 8 |
| Mend.io mend.io | 14% | 114 | 210 | 11 | 15,059 | 7 | ||
| Trivy trivy.dev | 9% | 207 | 5,400 | 182 | 3,093 | |||
| OWASP Dependency-Track owasp.org OWASP Dependency-Track 5%, OWASP Dependency-Check 4% | 9% | 95 | 720 | 10 | 365,222 | 3 | ||
| Snyk snyk.io Snyk Open Source 5% | 5% | 172 | 12,100 | 581 | 61,651 company | 60 | ||
| JFrog Xray jfrog.com | 4% | 36 | 590 | 37 | 38,697 | $37 | 120 | |
| Aikido aikido.dev Aikido Security 4% | 4% | 342 | 2,400 | 51 | 6,442 company | $936 | 120 | |
| OSV-Scanner osv.dev | 4% | 31 | 390 | 22 | 749 | |||
| GitHub parent site GitHub Advanced Security 4% | 4% | 111 | 1,500,000 | 31,479 |
Google's top ten for the three searches hold 22 sites; 5 of them are among the sites the models cited here (blackduck.com, cycode.com, dev.to, endorlabs.com, sonatype.com). The first result for “best software composition analysis tool” is endorlabs.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best software composition analysis tool for an enterprise B2B company?”Paraphrase“Which open source dependency vulnerability scanner would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade software composition analysis tools and how do they differ?”Budget-constrained“What is the best software composition analysis tool for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a software composition analysis tool. What should we look at?”Negative“Which software composition analysis tools should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5Mend.ioTrivyChangedMend.ioMend.ioagainst: Snyk Open Sourceno first choiceagainst: Black Duck, JFrog Xray, Mend.io, Snyk Open Source
Three alternatives
Black Duck, Snyk Open Source, Sonatype LifecycleThree alternatives
GitHub Dependabot, OWASP Dependency-Check, OWASP Dependency-TrackFive alternatives
Black Duck, Checkmarx SCA, OWASP Dependency-Track, Snyk Open Source, Sonatype LifecycleOne alternative
Black DuckGPT-5.4 miniMend.ioSonatype LifecycleChangedSonatype LifecycleSonatype Lifecycleno first choiceagainst: OWASP Dependency-Check
Three alternatives
Black Duck, Snyk Open Source, Veracode SCAThree alternatives
OWASP Dependency-Check, OWASP Dependency-Track, Snyk Open SourceSix alternatives
Black Duck, Checkmarx One, Checkmarx SCA, JFrog Xray, Mend.io, Snyk Open SourceOne alternative
Black DuckGemini 3.5 FlashSnyk Open SourceSyft, TrivyChangedagainst: Black Duck, Mend.io, OWASP Dependency-Check, Snyk Open SourceEndor Labs, Snyk Open Sourceagainst: GitHub Advanced SecurityJFrog Xrayagainst: GitHub Advanced Security, Mend.io, Snyk Open Sourceno first choiceagainst: Black Duck, Checkmarx SCA, Mend.io, OWASP Dependency-Check, Snyk Open Source, Sonatype Lifecycle, Veracode SCA
Six alternatives
Black Duck, Endor Labs, FOSSA, GitHub Advanced Security, GitLab Dependency Scanning, Sonatype LifecycleOne alternative
OWASP Dependency-TrackThree alternatives
Black Duck, Mend.io, Sonatype LifecycleSix alternatives
Anchore Grype, Black Duck, OWASP Dependency-Track, SonarQube, Trivy, Veracode SCAPerplexity SonarBlack DuckOWASP Dependency-CheckChangedagainst: Snyk Open Sourceno first choiceBlack Duckagainst: Snyk Open Sourceno first choiceagainst: GitHub Dependabot, OWASP Dependency-Check, Semgrep, Trivy
Three alternatives
Checkmarx SCA, Snyk Open Source, Sonatype LifecycleTwo alternatives
Grype, OSV-ScannerTwo alternatives
Mend.io, Sonatype LifecycleGrok 4.1 FastBlack Duck, Sonatype LifecycleOWASP Dependency-TrackChangedBlack Duck, Sonatype LifecycleGitHub Advanced Securityagainst: Black Duck, Mend.io, Snyk Open Source, Sonatype LifecycleBlack Duck, Mend.io, Snyk Open Source, Sonatype Lifecycleagainst: Black Duck, JFrog, Mend.io, OWASP Dependency-Check, Snyk Open Source, Veracode SCA
Four alternatives
Checkmarx SCA, JFrog Xray, Mend.io, Snyk Open SourceThree alternatives
Grype, OWASP Dependency-Check, TrivyFour alternatives
Checkmarx SCA, Mend.io, Snyk Open Source, Veracode SCAMistral SmallBlack DuckOSV-ScannerChangedno first choiceMend.io, Sonatype Lifecycleagainst: GitHub Advanced Security, Snyk Open Sourceno first choicenothing named
Two alternatives
GitHub Advanced Security, Snyk Open SourceTwo alternatives
Grype, TrivyThree alternatives
Black Duck, Checkmarx SCA, HCL AppScanDeepSeek V4 FlashSonatype LifecycleOWASP Dependency-TrackChangedBlack Duck, Sonatype LifecycleMend.ioagainst: Black Duck, FOSSA, Veracode SCAno first choiceagainst: FOSSA, GitHub Advanced Security (GHAS) — Dependabot, JFrog Xray, Mend.io, OWASP Dependency-Check, Snyk Open Source, Veracode SCA
Two alternatives
Black Duck, Snyk Open SourceThree alternatives
GitHub Dependabot, OWASP Dependency-Check, TrivyFive alternatives
Checkmarx SCA, Endor Labs, JFrog Xray, Mend.io, Snyk Open SourceTwo alternatives
Snyk Open Source, Sonatype LifecycleLlama 4 MaverickBlack Duck, Mend.io, Sonatype LifecycleOWASP Dependency-CheckChangedno first choiceno first choiceBlack Duckagainst: Mend.io
Three alternatives
Aikido Security, GitLab Dependency Scanning, Snyk Open SourceQwen 3.7 FlashSonatype Lifecycleagainst: GitHub Advanced SecurityTrivyChangedno first choiceBlack Duck, Snyk Open Sourceno first choiceagainst: Black Duck, Mend.io, Snyk Open Source, npm audit
Three alternatives
Black Duck, Mend.io, Snyk Open SourceTwo alternatives
Grype, OWASP Dependency-TrackFive alternatives
Black Duck, Mend.io, Snyk Open Source, Sonatype Nexus IQ, Veracode SCAOne alternative
ProjenyKimi K2Black Duck, Sonatype LifecycleTrivyChangedagainst: OWASP Dependency-CheckSonatype Lifecycleagainst: GitHub Advanced SecurityGitHub Advanced Securityagainst: Snyk Open Sourceno first choiceagainst: Black Duck, Checkmarx SCA, FOSSA, Mend.io, Snyk Open Source, Veracode SCA
Two alternatives
Mend.io, Snyk Open SourceThree alternatives
FOSSA, Grype + Syft, OSS Review ToolkitFour alternatives
Black Duck, JFrog Xray, Mend.io, Snyk Open SourceTwo alternatives
Black Duck, Sonatype LifecycleThree alternatives
Black Duck, Snyk Open Source, Sonatype LifecycleGLM 4.7 FlashXBlack Duck, Sonatype LifecycleOWASP Dependency-TrackChangedSonatype Lifecycleagainst: Checkmarx SCA, GitHub Advanced SecurityAikido Securityagainst: Black Duck, Snyk Open Sourceno first choiceagainst: Black Duck, FOSSA, JFrog, Mend.io, Snyk Open Source
Two alternatives
Mend.io, Snyk Open SourceFive alternatives
Grype, OSV-Scanner, Syft, Trivy, cdxgenThree alternatives
Black Duck, Mend.io, Snyk Open SourceTwo alternatives
Debricked, SonarQubeMiniMax M2.5Black Duck, Sonatype LifecycleOSV-ScannerChangedSonatype Lifecycleagainst: OWASP Dependency-CheckAikido Securityagainst: Snyk Open Sourceno first choiceagainst: OWASP Dependency-Check, npm audit, yarn audit
Three alternatives
Checkmarx SCA, Mend.io, OpenText FortifyThree alternatives
OWASP Dependency-Check, Syft, TrivyThree alternatives
Black Duck, GitHub Advanced Security, Snyk Open SourceThree alternatives
Black Duck, Checkmarx One, Sonatype Nexus IQGPT-6 LunaSonatype LifecycleGoogle OSV-ScannerChangedagainst: Trivyno first choiceagainst: GitHub's DependabotMend.ioagainst: Snyk Open Source, Sonatype Lifecycleno first choiceagainst: GitHub Dependabot, OWASP Dependency-Check
Three alternatives
Black Duck, JFrog Xray, Snyk Open SourceTwo alternatives
Grype, OWASP Dependency-TrackEight alternatives
Black Duck, Checkmarx One SCA, FOSSA, JFrog Xray, Mend.io, Snyk Open Source, Sonatype Lifecycle, Veracode SCAMuse Glimmer 30BBlack DuckTrivyChangedagainst: OWASP Dependency-CheckSynopsys Black Duck SCABlack Duck, JFrog Xrayagainst: Mend.io, Snyk Open Sourceno first choiceagainst: Black Duck, GitHub Dependabot, Grype, OWASP Dependency-Check, Sonatype Lifecycle, Trivy
Three alternatives
Mend.io, Snyk Open Source, Sonatype LifecycleFour alternatives
Grype, OSV-Scanner, OWASP Dependency-Track, SyftSix alternatives
Endor Labs, FOSSA, JFrog Xray, Mend.io – Mend SCA, Snyk Open Source, Sonatype LifecycleOne alternative
FOSSABold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 08:48 | yes | 18 | 9 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:56 | yes | 1 | 5 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 08:07 | yes | 15 | 32 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-01 12:59 | yes | 16 | 4 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 07:59 | yes | 21 | 9 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 08:20 | yes | 10 | 6 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 09:44 | yes | 23 | 29 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 08:13 | yes | 5 | 1 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 11:48 | yes | 9 | 32 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:25 | yes | 17 | 23 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:06 | yes | 22 | 51 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 09:45 | yes | 10 | 29 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:49 | yes | 4 | 19 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 09:26 | yes | 21 | 33 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 10:30 | yes | 17 | 9 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 09:51 | yes | 4 | 7 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 08:36 | yes | 17 | 29 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-01 12:13 | yes | 23 | 3 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 10:49 | yes | 22 | 6 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:29 | yes | 5 | 3 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 13:50 | yes | 23 | 40 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 07:45 | yes | 5 | 1 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 09:17 | yes | 10 | 40 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:13 | yes | 19 | 31 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 12:25 | yes | 13 | 55 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 13:11 | yes | 5 | 53 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-01 07:26 | yes | 4 | 31 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 08:09 | yes | 15 | 18 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 12:11 | yes | 9 | 9 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 12:31 | yes | 6 | 9 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:39 | yes | 18 | 27 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-01 07:46 | yes | 17 | 6 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:57 | yes | 20 | 8 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 09:07 | yes | 7 | 8 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 11:46 | yes | 18 | 40 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 13:45 | yes | 5 | 3 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 11:29 | yes | 10 | 33 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:47 | yes | 18 | 31 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:50 | yes | 21 | 48 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 09:16 | yes | 24 | 49 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-01 10:11 | yes | 10 | 26 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 09:11 | yes | 21 | 50 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 09:04 | yes | 15 | 8 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:26 | yes | 4 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 12:58 | yes | 18 | 28 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-01 10:11 | yes | 17 | 4 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 07:57 | yes | 20 | 10 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 10:07 | yes | 5 | 4 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 09:35 | yes | 25 | 38 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 10:23 | yes | 5 | 1 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:06 | no | 0 | 31 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 07:50 | yes | 22 | 24 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 08:20 | yes | 22 | 199 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 13:30 | yes | 22 | 43 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 13:39 | yes | 3 | 20 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:16 | yes | 18 | 37 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 12:41 | yes | 19 | 13 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:38 | no | 0 | 12 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:51 | no | 0 | 15 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-01 10:14 | yes | 16 | 6 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:24 | yes | 18 | 7 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 13:47 | no | 0 | 9 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 10:12 | yes | 24 | 45 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 08:08 | yes | 5 | 2 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 13:39 | no | 0 | 34 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 13:41 | yes | 24 | 34 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 12:30 | yes | 22 | 55 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:28 | yes | 5 | 25 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 13:02 | yes | 2 | 26 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:49 | yes | 13 | 25 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 10:44 | yes | 17 | 11 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:25 | yes | 6 | 10 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 10:26 | yes | 20 | 29 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-01 07:54 | yes | 18 | 5 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:42 | yes | 22 | 10 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 13:03 | yes | 5 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 09:16 | yes | 20 | 38 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 12:42 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 11:49 | no | 0 | 41 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 07:45 | yes | 22 | 48 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 11:17 | yes | 20 | 38 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 09:05 | yes | 17 | 69 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-01 11:22 | yes | 3 | 32 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 11:48 | yes | 17 | 41 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Aikido read as Aikido Security
Checkmarx read as Checkmarx SCA
GitLab Ultimate read as GitLab Dependency Scanning
Mend read as Mend.io
Mend (Sonatype) read as Mend.io
Mend (WhiteSource) read as Mend.io
Mend (formerly WhiteSource) read as Mend.io
Snyk read as Snyk Open Source
Snyk (Snyk Open Source) read as Snyk Open Source
Snyk Team read as Snyk Open Source
Sonatype read as Sonatype Lifecycle
Sonatype (Lifecycle/SBOM Manager) read as Sonatype Lifecycle
Sonatype (Nexus Lifecycle) read as Sonatype Lifecycle
Veracode read as Veracode SCA
Unresolved, counted raw
Anchore Grype
Checkmarx One SCA
GitHub Advanced Security (GHAS) — Dependabot
GitHub's Dependabot
Google OSV-Scanner
Mend.io – Mend SCA
Projeny
Revenera (Flexera)
yarn audit
Discontinued, still offered
No shut-down product was recommended here.