# Software composition analysis for small business buyers: what AI models recommend, September 2026

IT AI Recommendation Index, September 2026 Edition. Asked as "software composition analysis tool" and as "open source dependency vulnerability scanner", six framings each, to twelve models with search on, on behalf of a small B2B company. Page: https://it-ai-index.com/developer/software-composition-analysis/smb/

**Standing:** Trivy leads with 36% of first choices; verdict contested. 42 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | Trivy | 36% | 2% | 48 |
| 2 | Snyk Open Source | 33% | 4% | 50 |
| 3 | GitHub Dependabot | 5% | 12% | 17 |
| 4 | OWASP Dependency-Check | 5% | 32% | 31 |
| 5 | Semgrep Supply Chain | 2% | 5% | 20 |
| 6 | OSV-Scanner | 2% | 0% | 11 |
| 7 | Mend.io | 2% | 41% | 22 |
| 8 | Socket | 0% | 0% | 22 |
| 9 | FOSSA | 0% | 0% | 20 |
| 10 | Endor Labs | 0% | 33% | 12 |
| 11 | Sonatype Lifecycle | 0% | 73% | 11 |
| 12 | Black Duck | 0% | 80% | 20 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: SonarQube; alternatives Libraries.io
- GPT-5.4 mini: Snyk Open Source; alternatives OWASP Dependency-Track, Trivy
- Gemini 3.5 Flash: Aikido Security; alternatives FOSSA, Jit, Semgrep Supply Chain, Snyk Open Source
- Perplexity Sonar: Snyk Open Source; alternatives FOSSA, Mend.io, Trivy
- Grok 4.1 Fast: Snyk Open Source; alternatives GitHub Dependabot, OWASP Dependency-Check, Trivy
- Mistral Small: Snyk Open Source; alternatives Semgrep, Trivy
- DeepSeek V4 Flash: Snyk Open Source; alternatives GitHub Dependabot, Mend.io, SOOS
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Snyk Open Source; alternatives GitHub Dependabot, Trivy
- Kimi K2: Snyk Open Source; alternatives GitHub Dependabot, Trivy
- GLM 4.7 FlashX: Snyk Open Source; alternatives GitHub Advanced Security, Mend.io, Semgrep Supply Chain, Socket
- MiniMax M2.5: Snyk Open Source; alternatives FOSSA

## Sources the answers cite

64 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- endorlabs.com: 47 answers, 74 citations
- dupple.com: 32 answers, 32 citations
- toolradar.com: 30 answers, 31 citations
- guideflow.com: 25 answers, 25 citations
- appsecsanta.com: 24 answers, 48 citations
- aikido.dev: 22 answers, 27 citations
- safeguard.sh: 21 answers, 43 citations
- mend.io: 18 answers, 20 citations

Pages named in the most answers:

- https://endorlabs.com/learn/best-sca-tools-05b7a (42 answers)
- https://dupple.com/learn/best-software-composition-analysis-tools (32 answers)
- https://endorlabs.com/learn/best-sca-tools (30 answers)
- https://toolradar.com/blog/best-software-composition-analysis-tools (29 answers)
- https://guideflow.com/blog/software-composition-analysis-tools (22 answers)
- https://expertinsights.com/application-security/the-top-software-composition-analysis-tools (18 answers)
- https://ox.security/blog/software-composition-analysis-and-sca-tools (17 answers)
- https://blog.jetbrains.com/qodana/2025/09/best-software-composition-analysis-tools (16 answers)
- https://appsecsanta.com/sca-tools/open-source-sca-tools (15 answers)
- https://cycode.com/blog/top-enterprise-sca-tools (15 answers)

## Warned against

- Black Duck: 16 of 20 labels negative. "Black Duck has a high price and minimum licensing requirements that can be prohibitive for small teams or startups." (Claude Haiku 4.5, negative prompt)
- OWASP Dependency-Check: 10 of 31 labels negative. "It generally has a higher false-positive rate and a less modern user interface compared to Trivy or Semgrep." (GLM 4.7 FlashX, budget prompt)
- Mend.io: 9 of 22 labels negative. "premature and pricey for a small business ... rather than locking into an enterprise contract like Black Duck or Mend prematurely" (DeepSeek V4 Flash, negative prompt)
- Sonatype Lifecycle: 8 of 11 labels negative. "PeerSpot users call it "high" and "suitable only for enterprises," not small businesses." (Grok 4.1 Fast, negative prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.