# Mend.io vs OWASP Dependency-Track: which do AI models recommend for SCA, October 2026

IT AI Recommendation Index, October 2026 Edition, Software composition analysis. Seven of fourteen models named Mend.io first on the direct prompt; zero named OWASP Dependency-Track. Page: https://it-ai-index.com/developer/software-composition-analysis/mend-io-vs-owasp-dependency-track/

| | First-choice share | Rank | Negative rate | Labels | Models naming it |
|---|---|---|---|---|---|
| Mend.io | 14% | #3 of 17 | 19% | 37 | 14 of 14 |
| OWASP Dependency-Track | 8% | #4 of 17 | 0% | 21 | 10 of 14 |

## The direct prompt, model by model

- Claude Haiku 4.5: mend.io first (first choices: Mend.io) (alternatives: Black Duck, Endor Labs, FOSSA, Snyk Open Source, Sonatype Lifecycle)
- Perplexity Sonar: mend.io first (first choices: Mend.io) (alternatives: Black Duck, Snyk Open Source, Sonatype Lifecycle)
- Mistral Small: mend.io first (first choices: Mend.io) (alternatives: GitHub Advanced Security, Insignary Clarity)
- Llama 4 Maverick: mend.io first (first choices: Mend.io)
- Qwen 3.7 Flash: mend.io first (first choices: Mend.io) (alternatives: GitHub Advanced Security, Snyk Open Source)
- Kimi K2: mend.io first (first choices: Mend.io, Snyk Open Source) (alternatives: GitHub Advanced Security, GitHub Dependabot, Sonatype Lifecycle, Trivy)
- Muse Glimmer 30B: mend.io first (first choices: Mend.io) (alternatives: Snyk Open Source, Sonatype Lifecycle)
- GPT-5.4 mini: neither first, one named (first choices: Snyk Open Source) (alternatives: FOSSA, OWASP Dependency-Check, OWASP Dependency-Track)
- Gemini 3.5 Flash: neither first, one named (first choices: Aikido Security) (alternatives: Endor Labs, Mend.io, Snyk Open Source)
- Grok 4.1 Fast: neither first, one named (first choices: Snyk Open Source) (alternatives: Mend.io, Sonatype Lifecycle)
- DeepSeek V4 Flash: neither first, one named (first choices: Snyk Open Source) (alternatives: Mend.io, Sonatype Lifecycle)
- GLM 4.7 FlashX: neither first, one named (first choices: GitHub Advanced Security, Snyk Open Source) (alternatives: Black Duck, Endor Labs, FOSSA, Mend.io, Sonatype Lifecycle)
- GPT-6 Luna: neither first, one named (first choices: Snyk Open Source) (alternatives: GitHub's built-in supply-chain tools, Mend.io, Sonatype Lifecycle)
- MiniMax M2.5: neither named (first choices: Snyk Open Source, Sonatype Lifecycle) (alternatives: Black Duck, FOSSA, GitHub Advanced Security)

## What the models said about Mend.io

- "This is the tool that surfaces most frequently in negative developer feedback" (DeepSeek V4 Flash, negative prompt, hard negative)
- "Aggressive automation often creates noise by suggesting unnecessary updates or upgrades that introduce breaking changes." (Claude Haiku 4.5, negative prompt, soft negative)
- "you do not need a high-end enterprise Software Composition Analysis (SCA) tool (like Black Duck, Mend, or Sonatype)" (Gemini 3.5 Flash, budget prompt, soft negative)
- "For most mid-market B2B companies balancing security, compliance, and developer experience, Mend.io is the most frequently recommended choice." (Claude Haiku 4.5, direct prompt, first choice)
- "the best Software Composition Analysis (SCA) tool for a mid-market B2B company is Mend.io" (Qwen 3.7 Flash, direct prompt, first choice)
- "The best software composition analysis tool for a mid-market B2B company is Mend.io" (Llama 4 Maverick, direct prompt, first choice)

## What the models said about OWASP Dependency-Track

- "If you asked me to pick one for a mid-sized B2B company, I'd choose: Dependency-Track for centralized visibility and governance" (GPT-5.4 mini, paraphrase prompt, first choice)
- "OWASP Dependency-Track and Scanmycode.io are the top choices due to their open-source nature and lack of ongoing costs." (Mistral Small, budget prompt, first choice)
- "Top Recommendation: OWASP Dependency-Track + Trivy (or Grype)" (DeepSeek V4 Flash, paraphrase prompt, first choice)

Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all fourteen models, for a mid-market B2B company; rank is within the category. Comparisons are drawn for the top eight products in each category. Published under CC BY 4.0; the output is the models' output, and nothing here is a recommendation by the index.