Software composition analysis for small business buyers
Asked as “software composition analysis tool”, and as “open source dependency vulnerability scanner”, on behalf of a small B2B company. 61 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
39%
Contested · Trivy 18%
39Snyk Open Source18Trivy15OWASP Dependency-Check28others
39% of first choices, contested.
Since September 2026↗new leaderNew leader since September 2026: Snyk Open Source (41%) replaces Trivy (36% then, 15% now), 26 points clear, past the 11-point floor.Snyk Open Source leads at 41%, replacing Trivy, which led at 36% and stands at 15% now: 26 points clear, past the floor. The verdict moved from contested to clear leader.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Snyk Open Source39%Contested↗new leaderNew leader since September 2026: Snyk Open Source (41%) replaces Trivy (36% then, 15% now), 26 points clear, past the 11-point floor.This pageMid-market
Trivy31%Contested▼−5Since September 2026: 40% → 34%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →Enterprise
Black Duck23%Contested↗new leaderNew leader since September 2026: Sonatype Lifecycle (22%) replaces Black Duck (19% then, 22% now), 0 points clear, inside the 11-point floor.Standing →
Snyk Open Source39%Contested↗new leaderNew leader since September 2026: Snyk Open Source (41%) replaces Trivy (36% then, 15% now), 26 points clear, past the 11-point floor.This pageMid-marketTrivy31%Contested▼−5Since September 2026: 40% → 34%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →EnterpriseBlack Duck23%Contested↗new leaderNew leader since September 2026: Sonatype Lifecycle (22%) replaces Black Duck (19% then, 22% now), 0 points clear, inside the 11-point floor.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince September 2026
01Snyk Open Source39%18%62endorsed leader▲+7Since September 2026: 33% → 41%, +7 points. Inside the 11-point floor: within noise. Read over the models both editions asked.33% → 41%
Snyk Open Source39%18%62endorsed leader▲+7Since September 2026: 33% → 41%, +7 points. Inside the 11-point floor: within noise. Read over the models both editions asked.33% → 41%02Trivy18%0%41accepted challenger▼−21Since September 2026: 36% → 15%, −21 points. Past the 11-point floor: movement. Read over the models both editions asked.36% → 15%
Trivy18%0%41accepted challenger▼−21Since September 2026: 36% → 15%, −21 points. Past the 11-point floor: movement. Read over the models both editions asked.36% → 15%03
OWASP Dependency-Check15%22%41accepted challenger▲+12Since September 2026: 5% → 17%, +12 points. Past the 11-point floor: movement. Read over the models both editions asked.5% → 17%
OWASP Dependency-Check15%22%41accepted challenger▲+12Since September 2026: 5% → 17%, +12 points. Past the 11-point floor: movement. Read over the models both editions asked.5% → 17%04
GitHub Dependabot5%14%28accepted challenger▼−1Since September 2026: 5% → 4%, −1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.5% → 4%
GitHub Dependabot5%14%28accepted challenger▼−1Since September 2026: 5% → 4%, −1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.5% → 4%05
FOSSA5%0%19accepted challenger▲+4Since September 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 4%
FOSSA5%0%19accepted challenger▲+4Since September 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 4%06
Aikido Security5%0%13accepted challenger▲+3Since September 2026: 2% → 6%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 6%
Aikido Security5%0%13accepted challenger▲+3Since September 2026: 2% → 6%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 6%07
Socket2%0%19accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
Socket2%0%19accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%08
GitHub Advanced Security2%15%26accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
GitHub Advanced Security2%15%26accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%09Grype2%0%12accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
10
OSV-Scanner2%7%14accepted challenger▼−1Since September 2026: 2% → 2%, −1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 2%
OSV-Scanner2%7%14accepted challenger▼−1Since September 2026: 2% → 2%, −1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 2%11
Sonatype Lifecycle2%55%22criticized challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
Sonatype Lifecycle2%55%22criticized challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%Show the three products at 0%, ordered by negative rate
14Black Duck0%80%25criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Black Duck0%80%25criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%13
Mend.io0%50%28criticized challenger▼−2Since September 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 0%
Mend.io0%50%28criticized challenger▼−2Since September 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 0%12
Semgrep Supply Chain0%14%14accepted challenger▼−2Since September 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 0%
Semgrep Supply Chain0%14%14accepted challenger▼−2Since September 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
All twenty-eight head-to-head pages: the top eight products, each against each
Trivy vs OWASP Dependency-CheckTrivy vs GitHub DependabotTrivy vs Sonatype LifecycleTrivy vs GitHub Advanced SecuritySnyk Open Source vs Mend.ioSnyk Open Source vs OWASP Dependency-TrackSnyk Open Source vs OWASP Dependency-CheckSnyk Open Source vs GitHub DependabotSnyk Open Source vs Sonatype LifecycleSnyk Open Source vs GitHub Advanced SecurityMend.io vs OWASP Dependency-TrackMend.io vs OWASP Dependency-CheckMend.io vs GitHub DependabotMend.io vs Sonatype LifecycleMend.io vs GitHub Advanced SecurityOWASP Dependency-Track vs OWASP Dependency-CheckOWASP Dependency-Track vs GitHub DependabotOWASP Dependency-Track vs Sonatype LifecycleOWASP Dependency-Track vs GitHub Advanced SecurityOWASP Dependency-Check vs GitHub DependabotOWASP Dependency-Check vs Sonatype LifecycleOWASP Dependency-Check vs GitHub Advanced SecurityGitHub Dependabot vs Sonatype LifecycleGitHub Dependabot vs GitHub Advanced SecuritySonatype Lifecycle vs GitHub Advanced Security
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
0102030405060708G09
1011121314Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Snyk Open Source39%
Snyk Open Source39%02Trivy18%
Trivy18%03OWASP Dependency-Check15%
OWASP Dependency-Check15%04GitHub Dependabot5%
GitHub Dependabot5%05FOSSA5%
FOSSA5%06Aikido Security5%
Aikido Security5%07Socket2%
Socket2%08GitHub Advanced Security2%
GitHub Advanced Security2%09Grype2%
10OSV-Scanner2%
OSV-Scanner2%11Sonatype Lifecycle2%
Sonatype Lifecycle2%12Semgrep Supply Chain0%
Semgrep Supply Chain0%13Mend.io0%
Mend.io0%14Black Duck0%
Black Duck0%What they warned about
Zero of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Black Duck80%
20 of 25 labels negative · 10 of 14 models · 13 hard negative
“Marketed as a large‑enterprise solution; pricing can be prohibitive for small teams... Enterprise workflows and binary analysis are unnecessary for most small businesses.” GLM 4.7 FlashX, negative prompt
Mend.io50%
14 of 28 labels negative · 9 of 14 models · 5 hard negative
“Priced on a per‑developer basis, often in the thousands of dollars per developer per year... renewal costs can rise year over year and that licensing is opaque.” GLM 4.7 FlashX, negative prompt
Snyk Open Source18%
11 of 62 labels negative · 9 of 14 models · 1 hard negative
“What I'd Avoid ... eventually pushes toward paid plans; also requires account creation and has usage limits” Kimi K2, paraphrase prompt
Sonatype Lifecycle55%
12 of 22 labels negative · 8 of 14 models · 8 hard negative
“"Enterprise-first" SCA platforms (e.g., Veracode, Checkmarx, Sonatype Nexus Lifecycle) ... Verdict: Avoid unless you are already an enterprise customer” DeepSeek V4 Flash, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
79 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 1067 links across 187 sites, every framing counted. Ranked by the number of answers carrying the site or page. 3 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Guideflow48 answers · 52 citations · 10 models
33 answers · 33 citations · 10 models
vendor site · Checkmarx31 answers · 34 citations · 10 models
29 answers · 47 citations · 10 models
vendor site · Aikido28 answers · 37 citations · 10 models
vendor site · Sonatype25 answers · 31 citations · 10 models
24 answers · 24 citations · 10 models
vendor site · Safeguard23 answers · 40 citations · 7 models
vendor site · Mend22 answers · 26 citations · 10 models
22 answers · 23 citations · 10 models
vendor site · G220 answers · 33 citations · 12 models
vendor site · Endor Labs20 answers · 21 citations · 9 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
46 answers · 10 models
33 answers · 10 models
27 answers · 10 models
23 answers · 10 models
22 answers · 10 models
20 answers · 10 models
19 answers · 8 models
17 answers · 7 models
17 answers · 8 models
14 answers · 8 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best software composition analysis tool”, “software composition analysis tool”, “software composition analysis tools”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Snyk snyk.io Snyk Open Source 39% | 39% | 172 | 12,100 | 581 | 61,651 company | 60 | ||
| Trivy trivy.dev | 18% | 207 | 5,400 | 182 | 3,093 | |||
| OWASP Dependency-Check owasp.org OWASP Dependency-Check 15%, OWASP Dependency-Track 2% | 16% | 95 | 720 | 10 | 365,222 | 3 | ||
| GitHub parent site GitHub Dependabot 5%, GitHub Advanced Security 2% | 7% | 111 | 1,500,000 | 31,479 | ||||
| FOSSA fossa.com | 5% | 55 | 74,000 | 4,140 | 133,902 | 1 | ||
| Aikido aikido.dev Aikido Security 5% | 5% | 342 | 2,400 | 51 | 6,442 company | $936 | 120 | |
| Socket socket.dev | 2% | 33 | 60,500 | 95,979 | 16,465 | 1 | ||
| Grype | 2% | 1,000 | 44 | |||||
| OSV-Scanner osv.dev | 2% | 31 | 390 | 22 | 749 | |||
| Semgrep semgrep.dev Semgrep 2%, Semgrep Supply Chain 0% | 2% | 194 | 8,100 | 191 | 3,461 | 43 |
Google's top ten for the three searches hold 22 sites; 2 of them are among the sites the models cited here (endorlabs.com, sonatype.com). The first result for “best software composition analysis tool” is endorlabs.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best software composition analysis tool for a small B2B company?”Paraphrase“Which open source dependency vulnerability scanner would you recommend to a small business that sells to other businesses?”Comparative“What are the top software composition analysis tools for a small team and how do they differ?”Budget-constrained“What is the best software composition analysis tool for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a software composition analysis tool. What should we look at?”Negative“Which software composition analysis tools should a small business avoid or be cautious about?”
Claude Haiku 4.5Aikido Security, Snyk Open SourceTrivyChangedGitHub Dependabot, OWASP Dependency-Check, Snyk Open Sourceagainst: Semgrep Supply ChainSnyk Open Sourceno first choiceagainst: Black Duck, Endor Labs, Snyk Open Source, Veracode SCA
Two alternatives
FOSSA, OWASP Dependency-CheckTwo alternatives
OSV-Scanner, OWASP Dependency-CheckTwo alternatives
GitLab Dependency Scanning, SOOSFour alternatives
GitHub Dependabot, OWASP Dependency-Check, SOOS, TrivyGPT-5.4 miniSnyk Open SourceOWASP Dependency-CheckChangedOWASP Dependency-Check, Snyk Open Sourceagainst: Black Duck, Sonatype LifecycleOWASP Dependency-Trackagainst: Mend.io, Snyk Open Sourceno first choiceagainst: GitHub Advanced Security, Snyk Open Source, Sonatype Lifecycle
Two alternatives
Mend.io, Sonatype LifecycleTwo alternatives
OWASP Dependency-Track, TrivyOne alternative
Mend.ioThree alternatives
OSS Review Toolkit, OWASP Dependency-Check, TrivyGemini 3.5 FlashAikido Securityagainst: GitHub DependabotTrivyChangedAikido Security, GitHub DependabotGitHub Dependabotagainst: Black Duck, Mend.io, Veracode SCAAikido Security, SOOSagainst: Black Duck, Mend.io, Snyk Open Source, Sonatype Lifecycleagainst: Black Duck, OWASP Dependency-Check, Snyk Open Source, Sonatype Lifecycle, Veracode SCA
Three alternatives
FOSSA, SOOS, Snyk Open SourceThree alternatives
Grype, OSV-Scanner, SyftThree alternatives
Snyk Open Source, Socket, TrivyFive alternatives
Aikido Security, GitLab Dependency Scanning, Grype + Syft, Snyk Open Source, TrivyFour alternatives
GitHub Dependabot, GitLab Dependency Scanning, Semgrep Supply Chain, SocketPerplexity SonarSnyk Open SourceOWASP Dependency-CheckChangedSnyk Open Sourceagainst: Black Duck, Mend.ioGrype, Snyk Open Sourceno first choiceagainst: Black Duck, Checkmarx SCA, GitHub Dependabot, Mend.io, OWASP Dependency-Check, Sonatype Lifecycle
Four alternatives
FOSSA, GitHub Advanced Security, OWASP Dependency-Check, Semgrep Supply ChainOne alternative
OSV-ScannerThree alternatives
FOSSA, Grype, TrivyGrok 4.1 FastSnyk Open Sourceagainst: Black Duck, Mend.io, Sonatype Lifecycle, Veracode SCATrivyChangedagainst: OWASP Dependency-CheckSnyk Open Sourceagainst: Black Duck, Sonatype LifecycleTrivyagainst: GitHub Advanced Security, OWASP Dependency-TrackSnyk Open Sourceagainst: Black Duck, Checkmarx SCA, JFrog Xray, Mend.io, OSV-Scanner, OWASP Dependency-Check, Snyk Open Source, Sonatype Lifecycle
Five alternatives
FOSSA, GitHub Advanced Security, Grype, Syft, TrivyOne alternative
GrypeFour alternatives
GitHub Advanced Security (GHAS) / Dependabot, Mend.io, OWASP Dependency-Check, TrivyThree alternatives
Grype, OWASP Dependency-Check, Snyk Open SourceThree alternatives
GitHub Advanced Security, Mend.io, OWASP Dependency-TrackMistral SmallFOSSA, Snyk Open Sourceagainst: Mend.ioOWASP Dependency-CheckChangedSnyk Open SourceTrivyagainst: Snyk Open Sourceno first choicenothing named
One alternative
GitHub Advanced SecurityOne alternative
GitHub DependabotFour alternatives
Aikido Security, GitHub Advanced Security, Semgrep Supply Chain, SocketFour alternatives
GitHub Dependabot, Renovate, Semgrep, SocketDeepSeek V4 FlashSnyk Open Sourceagainst: Mend.ioOWASP Dependency-CheckChangedagainst: Snyk Open SourceSnyk Open Sourceagainst: OWASP Dependency-CheckSnyk Open SourceSnyk Open Sourceagainst: Mend.io, OWASP Dependency-Checkagainst: Black Duck, Checkmarx SCA, Microsoft Defender, OWASP Dependency-Check, Sonatype Lifecycle, Veracode SCA, Wiz
Three alternatives
Endor Labs, FOSSA, OWASP Dependency-CheckTwo alternatives
OWASP Dependency-Track, TrivyFour alternatives
GitHub Dependabot, Mend.io, Semgrep Supply Chain, TrivyThree alternatives
GitHub Dependabot, Semgrep Supply Chain, TrivyTwo alternatives
FOSSA, Semgrep Supply ChainLlama 4 MaverickFOSSA, Snyk Open SourceOWASP Dependency-CheckChangedAikido Security, Dependancy CheckerSemgrep, Snyk Open Sourceno first choicenothing named
Three alternatives
Aikido Security, GitLab Dependency Scanning, dep-scanTwo alternatives
GitHub Advanced Security, Insignary ClarityQwen 3.7 FlashSnyk Open Sourceagainst: Black DuckTrivyChangedSnyk Open SourceSnyk Open Source, Trivyno first choiceagainst: Black Duckagainst: Black Duck, Checkmarx SCA, Mend.io, OpenText Fortify
One alternative
Sonatype LifecycleFive alternatives
OWASP Dependency-Check, cargo audit, govulncheck, npm audit, pip-auditThree alternatives
Aikido Security, OWASP Dependency-Check, SocketTwo alternatives
GitHub Dependabot, SemgrepKimi K2Snyk Open SourceOSV-ScannerChangedagainst: OWASP Dependency-Check, Snyk Open SourceSnyk Open Sourceagainst: GitHub Advanced Security, GitHub DependabotGitHub Dependabot, OWASP Dependency-CheckGitHub Advanced Security, Snyk Open Sourceagainst: Black Duckagainst: Black Duck, JFrog Xray, Sonatype Lifecycle, Veracode SCA
Four alternatives
FOSSA, GitHub Advanced Security, GitHub Dependabot, SemgrepTwo alternatives
Grype + Syft, TrivyThree alternatives
Semgrep Supply Chain, Socket, TrivyTwo alternatives
Snyk Open Source, TrivyOne alternative
Mend.ioGLM 4.7 FlashXSnyk Open SourceOWASP Dependency-CheckChangedSnyk Open Source, Trivyagainst: Black Duck, Sonatype LifecycleTrivyagainst: Black Duck, Endor Labs, Mend.io, Snyk Open SourceSnyk Open Source, Socketagainst: Black Duck, Checkmarx SCA, DeepSource, Endor Labs, GitHub Advanced Security, JFrog Xray, Mend.io, Semgrep Supply Chain, Wiz
Two alternatives
GitHub Advanced Security, TrivyTwo alternatives
OSV-Scanner, OWASP Dependency-TrackThree alternatives
FOSSA, Grype, SyftSix alternatives
GitHub Advanced Security, GitHub Dependabot, Grype + Syft, OSV-Scanner, OWASP Dependency-Check, SemgrepSeven alternatives
Aikido Security, Black Duck, Endor Labs, GitHub Advanced Security, JFrog Xray, Semgrep Supply Chain, Sonatype LifecycleMiniMax M2.5Snyk Open Source, Sonatype Lifecycleagainst: Black DuckOWASP Dependency-CheckChangedSnyk Open SourceOWASP Dependency-Check, Snyk Open SourceSnyk Open Sourcenothing named
Two alternatives
GitHub Advanced Security, Mend.ioTwo alternatives
GitHub Advanced Security, Retire.jsFour alternatives
GitHub Dependabot, OWASP Dependency-Check, SonarQube, TrivyTwo alternatives
GitHub Dependabot, Mend.ioFour alternatives
Black Duck, GitHub Advanced Security, GitHub Dependabot, Veracode SCAGPT-6 LunaSnyk Open SourceTrivyChangedGitHub DependabotGitHub Dependabotagainst: Snyk Open Sourceno first choiceagainst: GitHub Dependabot, GitHub's dependency graph, OWASP Dependency-Check, OWASP Dependency-Track, Renovate
Two alternatives
GitHub Dependabot, SocketOne alternative
OSV-ScannerFour alternatives
OSV-Scanner, Renovate, Snyk Open Source, SocketTwo alternatives
OSV-Scanner, TrivyMuse Glimmer 30BFOSSA, Snyk Open SourceTrivyChangedSnyk Open Sourceagainst: Mend.ioTrivyno first choiceagainst: JFrog Xray, Mend.io, formerly WhiteSource, Sonatype Lifecycle, Synopsys Black Duck SCA
Three alternatives
Grype, OWASP Dependency-Check, TrivyThree alternatives
GitHub Dependabot, OWASP Dependency-Check, OWASP Dependency-TrackThree alternatives
FOSSA, OWASP Dependency-Check, TrivySix alternatives
Grype, OWASP Dependency-Check, Semgrep, Snyk Open Source, Socket, SyftBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 07:39 | yes | 17 | 8 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 08:12 | yes | 3 | 6 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 11:20 | yes | 22 | 25 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-01 09:39 | yes | 16 | 3 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:46 | yes | 23 | 7 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 09:15 | yes | 5 | 4 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 08:02 | yes | 23 | 24 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:46 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 12:08 | yes | 20 | 68 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:40 | yes | 19 | 27 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 12:23 | yes | 24 | 145 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:57 | yes | 5 | 16 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:05 | yes | 3 | 22 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 07:55 | yes | 24 | 30 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 08:39 | yes | 17 | 9 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 09:29 | yes | 3 | 4 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 08:27 | yes | 12 | 29 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-01 08:27 | yes | 18 | 3 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 13:46 | yes | 21 | 8 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 13:19 | yes | 5 | 3 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 11:14 | yes | 25 | 24 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 12:25 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:57 | no | 0 | 30 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 10:54 | yes | 18 | 20 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 08:17 | yes | 23 | 176 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:06 | yes | 5 | 15 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:00 | yes | 2 | 20 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 09:06 | yes | 13 | 21 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:59 | yes | 9 | 8 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:05 | yes | 6 | 6 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 07:58 | yes | 16 | 28 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-01 11:26 | yes | 17 | 7 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:23 | yes | 23 | 9 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 10:09 | yes | 12 | 9 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 08:15 | yes | 23 | 45 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:54 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 11:40 | yes | 14 | 46 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 10:45 | yes | 18 | 30 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 08:53 | yes | 18 | 21 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:34 | yes | 16 | 24 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:13 | yes | 9 | 22 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 07:45 | yes | 12 | 38 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 07:36 | yes | 9 | 6 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 09:46 | yes | 3 | 6 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:59 | yes | 17 | 22 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-01 08:50 | yes | 17 | 2 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 07:41 | yes | 20 | 6 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:40 | yes | 5 | 3 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 09:25 | yes | 24 | 31 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 12:16 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 11:35 | yes | 10 | 41 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 08:29 | yes | 14 | 24 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:15 | yes | 22 | 128 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:36 | yes | 5 | 20 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:03 | yes | 4 | 14 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 13:13 | yes | 13 | 19 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:22 | no | 0 | 6 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 09:54 | no | 0 | 7 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:43 | yes | 12 | 22 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-01 10:22 | yes | 16 | 4 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 13:31 | yes | 14 | 10 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 10:56 | no | 0 | 8 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 08:53 | yes | 25 | 37 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 13:22 | yes | 5 | 2 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 12:56 | no | 0 | 35 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 09:03 | yes | 13 | 40 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 09:06 | yes | 19 | 64 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:24 | yes | 10 | 36 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 10:24 | yes | 3 | 15 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:51 | yes | 15 | 28 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 08:14 | yes | 18 | 9 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:49 | yes | 4 | 8 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:54 | yes | 13 | 20 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-01 11:47 | yes | 17 | 3 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:33 | yes | 19 | 7 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 10:21 | yes | 5 | 3 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 12:35 | yes | 21 | 45 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:53 | yes | 5 | 2 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 09:03 | yes | 15 | 60 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 07:44 | yes | 23 | 28 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 13:07 | yes | 19 | 28 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 09:44 | yes | 8 | 28 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-01 13:24 | yes | 4 | 19 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:43 | yes | 22 | 36 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Aikido read as Aikido Security
Checkmarx read as Checkmarx SCA
Mend read as Mend.io
Mend (WhiteSource) read as Mend.io
Mend (formerly Veracode) read as Mend.io
Mend (formerly WhiteSource) read as Mend.io
Snyk read as Snyk Open Source
Snyk (Free Tier) read as Snyk Open Source
Snyk Team read as Snyk Open Source
Sonatype read as Sonatype Lifecycle
Veracode read as Veracode SCA
Veracode (SCA) read as Veracode SCA
Unresolved, counted raw
Dependancy Checker
GitHub's dependency graph
Mend.io, formerly WhiteSource
cargo audit
dep-scan
govulncheck
pip-audit
Discontinued, still offered
No shut-down product was recommended here.