# Software composition analysis: what AI models recommend, September 2026

IT AI Recommendation Index, September 2026 Edition. Asked as "software composition analysis tool" and as "open source dependency vulnerability scanner", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://it-ai-index.com/developer/software-composition-analysis/

**Standing:** Trivy leads with 40% of first choices; verdict contested. 43 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | Trivy | 40% | 3% | 30 |
| 2 | Snyk Open Source | 16% | 15% | 47 |
| 3 | Mend.io | 14% | 15% | 34 |
| 4 | OWASP Dependency-Check | 14% | 38% | 32 |
| 5 | OWASP Dependency-Track | 2% | 0% | 11 |
| 6 | Endor Labs | 0% | 0% | 19 |
| 7 | Black Duck | 0% | 18% | 34 |
| 8 | Sonatype Lifecycle | 0% | 19% | 31 |
| 9 | FOSSA | 0% | 0% | 18 |
| 10 | Grype | 0% | 7% | 14 |
| 11 | OSV-Scanner | 0% | 0% | 13 |
| 12 | JFrog Xray | 0% | 8% | 13 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Mend.io, Snyk Open Source; alternatives Black Duck, GitHub Advanced Security, Sonatype Lifecycle
- Gemini 3.5 Flash: Aikido Security; alternatives Mend.io, Semgrep Supply Chain, Snyk Open Source
- Perplexity Sonar: Mend.io; alternatives Black Duck, Endor Labs, Snyk Open Source, Sonatype Lifecycle
- Grok 4.1 Fast: Snyk Open Source; alternatives Aikido Security, Black Duck, Mend.io, SOOS
- Mistral Small: Mend.io; alternatives OX Security, Sonatype Lifecycle
- DeepSeek V4 Flash: Snyk Open Source; alternatives Mend.io, Sonatype Lifecycle
- Llama 4 Maverick: Mend.io; alternatives Sonatype Lifecycle
- Qwen 3.7 Flash: Mend.io; alternatives Renovate, Snyk Open Source
- Kimi K2: Snyk Open Source; alternatives Mend.io, Sonatype Lifecycle
- GLM 4.7 FlashX: Mend.io; alternatives Black Duck, Snyk Open Source, Sonatype Lifecycle
- MiniMax M2.5: Snyk Open Source; alternatives Black Duck, GitLab Dependency Scanning, Mend.io

## Sources the answers cite

63 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- endorlabs.com: 41 answers, 71 citations
- guideflow.com: 25 answers, 25 citations
- ox.security: 24 answers, 25 citations
- toolradar.com: 24 answers, 24 citations
- safeguard.sh: 22 answers, 52 citations
- appsecsanta.com: 21 answers, 37 citations
- aikido.dev: 21 answers, 23 citations
- cycode.com: 17 answers, 17 citations

Pages named in the most answers:

- https://endorlabs.com/learn/best-sca-tools-05b7a (40 answers)
- https://endorlabs.com/learn/best-sca-tools (27 answers)
- https://ox.security/blog/software-composition-analysis-and-sca-tools (24 answers)
- https://toolradar.com/blog/best-software-composition-analysis-tools (23 answers)
- https://guideflow.com/blog/software-composition-analysis-tools (21 answers)
- https://dupple.com/learn/best-software-composition-analysis-tools (17 answers)
- https://expertinsights.com/application-security/the-top-software-composition-analysis-tools (17 answers)
- https://appsecsanta.com/sca-tools/open-source-sca-tools (15 answers)
- https://appsecsanta.com/sca-tools (13 answers)
- https://sonatype.com/compare/best-sca-tools (13 answers)

## Warned against

- OWASP Dependency-Check: 12 of 32 labels negative. "You should actively avoid using the traditional OWASP Dependency-Check" (Qwen 3.7 Flash, paraphrase prompt)
- Snyk Open Source: 7 of 47 labels negative. "The industry heavyweight with top-tier developer UX, strong remediation suggestions, and a wide ecosystem, though it can be highly expensive." (Gemini 3.5 Flash, scale prompt)
- Black Duck: 6 of 34 labels negative. "like older versions of Black Duck or Sonatype Nexus IQ) can be slow to install, heavy on resources, or difficult to configure at scale" (Qwen 3.7 Flash, negative prompt)
- Mend.io: 5 of 34 labels negative. "reachability) works well for Java/JavaScript but poorly for Python, Go... Internal benchmarks claim "+46% better" remediation but lack external validation." (Kimi K2, negative prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.