Index › Developer platform › September 2026 Edition

Static application security testing

Asked as “SAST tool”, and as “static code security scanner”, on behalf of a mid-market B2B company. 45 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.

Standing

Semgrep

Clear leader

47% of first choices, clear leader.

ShowinginAll 67 categories →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

Small business

Semgrep70%Clear leaderStanding →Mid-market

Semgrep47%Clear leaderThis page Enterprise

Checkmarx One54%Clear leaderStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.

ProductFirst-choice shareNegative rateLabelsQuadrant

Semgrep0%56endorsed leader

SonarQube10%48accepted challenger

Snyk Code6%36accepted challenger

Aikido Security0%16accepted challenger

CodeQL8%26accepted challenger

Veracode41%34criticized challenger

Show the five products at 0%, ordered by negative rate

OpenText Fortify52%23criticized challenger

Checkmarx One48%46criticized challenger

Bandit18%11accepted challenger

GitHub Advanced Security8%12accepted challenger

gosec0%10accepted challenger

Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Head to head

Semgrep vs SonarQube Semgrep vs Snyk Code SonarQube vs Snyk Code

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default

Negative label rate →

Accepted challengerEndorsed leader

0%First-choice share → · lines at 30% share and 25% negative60%

Key

Semgrep47%

SonarQube22%

Snyk Code13%

Aikido Security4%

CodeQL2%

Veracode2%

GitHub Advanced Security0%

gosec0%

Bandit0%

Checkmarx One0%

OpenText Fortify0%

02What they warned about

Two of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.

Checkmarx One

48%

22 of 46 labels negative · 9 of 12 models · 4 hard negative

“Tools to Avoid on a Tight Budget ... **Checkmarx One / Fortify / Vercode:** These are enterprise-grade tools” Qwen 3.7 Flash, budget prompt

Veracode

41%

14 of 34 labels negative · 7 of 12 models · 5 hard negative

“Avoid legacy, binary-upload scanners... historically pioneered by tools like Veracode)... a major friction point for modern, fast-paced DevSecOps teams.” Gemini 3.5 Flash, negative prompt

OpenText Fortify

52%

12 of 23 labels negative · 7 of 12 models · 3 hard negative

“High-cost, legacy platforms (like OpenText Fortify or older on-premise setups of Checkmarx)... Avoid legacy, binary-upload scanners and heavyweight on-premise engines.” Gemini 3.5 Flash, negative prompt

SonarQube

10%

5 of 48 labels negative · 5 of 12 models

“**SonarQube**: High false positive rates out-of-the-box (40-82% ...) ... Tune heavily or pair with security-specific tools.” Grok 4.1 Fast, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

63 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 710 links across 140 sites, every framing counted. Ranked by the number of answers carrying the site or page.

appsecsanta.com

32 answers · 43 citations · 10 models

corgea.com

vendor site · Corgea31 answers · 34 citations · 11 models

zeropath.com

vendor site · ZeroPath30 answers · 30 citations · 10 models

dev.to

27 answers · 44 citations · 10 models

ox.security

21 answers · 22 citations · 9 models

augmentcode.com

vendor site · Augment Code20 answers · 23 citations · 9 models

pixee.ai

vendor site · Pixee20 answers · 21 citations · 8 models

endorlabs.com

vendor site · Endor Labs19 answers · 26 citations · 8 models

checkmarx.com

vendor site · Checkmarx18 answers · 22 citations · 7 models

cycode.com

vendor site · Cycode16 answers · 17 citations · 7 models

safeguard.sh

vendor site · Safeguard14 answers · 20 citations · 8 models

expertinsights.com

vendor site · Expert Insights13 answers · 13 citations · 7 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

zeropath.com/blog/best-sast-tools

30 answers · 10 models

corgea.com/learn/best-sast-tools

28 answers · 10 models

appsecsanta.com/sast-tools

24 answers · 9 models

dev.to/rahulxsingh/i-reviewed-32-sast-tools-the-ones-worth-using-283e

22 answers · 9 models

ox.security/blog/static-application-security-sast-tools

21 answers · 9 models

endorlabs.com/learn/best-sast-tools

17 answers · 8 models

pixee.ai/blog/best-sast-tools-2026

16 answers · 7 models

dev.to/rahulxsingh/11-best-sast-tools-in-2026-static-application-security-t…

13 answers · 9 models

augmentcode.com/tools/enterprise-sast-tools-large-teams-field-guide

12 answers · 8 models

checkmarx.com/learn/sast/open-source-vs-premium-sast-tools

12 answers · 7 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.

ModelDirect“What is the best SAST tool for a mid-market B2B company?”Paraphrase“Which static code security scanner would you recommend to a mid-sized B2B company?”Comparative“What are the top SAST tools and how do they differ?”Budget-constrained“What is the best SAST tool for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a SAST tool. What should we look at?”Negative“Which SAST tools should I avoid or be cautious about?”

Claude Haiku 4.5no first choiceSnyk, SonarQubeChanged

Three alternatives

Checkmarx One, GitHub Advanced Security, Semgrep

no first choice

Five alternatives

Checkmarx One, Corgea, OpenText Fortify, Snyk Code, Veracode

Semgrep, SonarQube

One alternative

Codacy

no first choicenothing named

GPT-5.4 miniSnyk Code

Three alternatives

Checkmarx One, GitHub Advanced Security / CodeQL, Veracode

SemgrepChanged

One alternative

CodeQL

against: Checkmarx One, OpenText FortifyCheckmarx One, HCL AppScan, Veracode Static Analysis

Four alternatives

Black Duck Coverity, Semgrep, Snyk Code, SonarQube

against: Contrast AssessCodeQL

One alternative

Semgrep

no first choicenothing named

Gemini 3.5 FlashAikido Security

Four alternatives

GitHub Advanced Security, GitLab SAST, Semgrep, Snyk

against: Checkmarx One, OpenText Fortify, VeracodeAikido SecurityHeld

Two alternatives

GitLab SAST, Semgrep

against: Checkmarx One, GitHub Advanced Security, Snyk, Veracodeno first choice

Five alternatives

Checkmarx One, GitHub Advanced Security / CodeQL, Semgrep, Snyk Code, Veracode

Semgrep

Six alternatives

Aikido Security, Bandit, Brakeman, SonarQube, SpotBugs/FindSecBugs, gosec

Semgrep, Snyk

Three alternatives

Aikido Security, GitHub Advanced Security, SonarQube

against: Checkmarx One, Veracodeagainst: Bandit, Checkmarx One, OpenText Fortify, Snyk Code, Veracode

Perplexity SonarCodeAnt AI

Two alternatives

Aikido Security, Semgrep

VeracodeChanged

Two alternatives

Aikido Security, Semgrep

Checkmarx One, Veracode

Four alternatives

Aikido Security, CodeQL, Semgrep, Snyk Code

against: OpenText FortifySemgrep

Five alternatives

Bandit, CodeAnt AI, Qodana, SonarQube, gosec

against: Checkmarx One, Veracodeno first choiceagainst: Bandit, Brakeman, CodeQL

Grok 4.1 FastSemgrep

Two alternatives

Snyk Code, SonarQube

against: Checkmarx OneSonarQubeChanged

Two alternatives

Semgrep, Snyk Code

against: Checkmarx One, VeracodeCheckmarx One, Snyk Code

Four alternatives

CodeQL, Semgrep, SonarQube, Veracode

Semgrep

Three alternatives

Bandit, CodeQL, SonarQube

no first choice

Four alternatives

Checkmarx One, Semgrep, Snyk Code, SonarQube

against: Checkmarx One, OpenText Fortify, SonarQube

Mistral SmallSemgrep

Two alternatives

CodeAnt AI, SonarQube

SonarQubeChanged

Three alternatives

Checkmarx One, GitHub Advanced Security, Snyk Code

Semgrep

Seven alternatives

Checkmarx One, Cycode, GitLab SAST, Snyk Code, SonarQube, Veracode, ZeroPath

Semgrep

Five alternatives

Bandit, Brakeman, CodeQL, SonarQube, gosec

no first choicenothing named

DeepSeek V4 FlashSemgrep

Five alternatives

Checkmarx One, GitHub Advanced Security, Snyk Code, SonarQube, Veracode

SemgrepHeld

Two alternatives

CodeQL, Snyk Code

against: Checkmarx One, SonarQube, Veracodeno first choiceSemgrep

Six alternatives

Bandit, Brakeman, Codacy, Qodana, SonarQube, gosec

against: Checkmarx One, CodeQL, VeracodeSemgrep

Four alternatives

Checkmarx One, CodeQL, Snyk Code, SonarQube

against: Checkmarx One, OpenText Fortify, Veracodeagainst: Checkmarx One, OpenText Fortify, Veracode

Llama 4 MaverickSnyk Code

One alternative

SonarQube

SonarQubeChanged

Two alternatives

Semgrep, Snyk Code

no first choiceSemgrep

Two alternatives

Codacy, Qodana

no first choicenothing named

Qwen 3.7 FlashSnyk, SonarQube

Two alternatives

GitHub Advanced Security, GitLab SAST

Semgrep, SonarQubeChanged

Two alternatives

GitHub Advanced Security, Snyk Code

against: OpenText FortifyCheckmarx One, Semgrep, Snyk Code, Veracode

One alternative

SonarQube

Semgrep

Six alternatives

Bandit, Codacy, ESLint + Security Plugins, Qodana, SonarQube, gosec

against: Checkmarx One, OpenText Fortify, Snyk Code, Veracodeno first choiceagainst: Checkmarx One, OpenText Fortifyagainst: Checkmarx One, OpenText Fortify, RIPS, Scan4all, SonarQube

Kimi K2Semgrep, Snyk Code

One alternative

SonarQube

Snyk Code, SonarQubeChanged

One alternative

Semgrep

against: Checkmarx One, VeracodeSemgrep

Five alternatives

Checkmarx One, CodeQL, Snyk Code, SonarQube, Veracode

Semgrep

Five alternatives

Bandit, Brakeman, CodeQL, SonarQube, gosec

no first choiceagainst: Checkmarx One, Veracodeagainst: SonarQube

GLM 4.7 FlashXSnyk Code

Three alternatives

CodeAnt AI, Semgrep, SonarQube

against: Checkmarx One, VeracodeSemgrepChanged

Two alternatives

GitHub Advanced Security, SonarQube

against: Checkmarx OneSemgrep, Snyk Code

Eight alternatives

Black Duck Coverity, Checkmarx One, CodeQL, DeepSource, OpenText Fortify, SonarQube, Veracode, gosec

Semgrep

Six alternatives

Codacy, CodeAnt AI, CodeQL, Qodana, Snyk Code, SonarQube

no first choiceagainst: SonarQube

MiniMax M2.5Snyk Code, SonarQube

Two alternatives

Checkmarx One, Semgrep

SonarQubeChanged

Two alternatives

CodeQL, Semgrep

no first choice

Five alternatives

Checkmarx One, CodeQL, Semgrep, Snyk Code, Veracode

Semgrep

Two alternatives

Qodana, SonarQube

no first choiceagainst: Checkmarx One, OpenText Fortify

Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record

Seventy-two rows: every prompt, every model, every answer.

Prompt	Model	Version string	Time (UTC)	Searched	Sources	Latency
Direct recommendation	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 13:38	no	0	4 s
Direct recommendation	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 11:28	yes	5	5 s
Direct recommendation	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 10:52	yes	16	23 s
Direct recommendation	Perplexity Sonar	`sonar`	2026-09-17 11:27	yes	20	6 s
Direct recommendation	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 13:09	yes	39	19 s
Direct recommendation	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:13	yes	5	4 s
Direct recommendation	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 12:58	yes	18	20 s
Direct recommendation	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 09:23	yes	5	3 s
Direct recommendation	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 09:32	yes	15	50 s
Direct recommendation	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 14:13	yes	9	18 s
Direct recommendation	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 10:29	yes	13	63 s
Direct recommendation	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 10:49	yes	5	18 s
Paraphrase	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 13:01	no	0	6 s
Paraphrase	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 10:30	yes	2	8 s
Paraphrase	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 14:10	yes	16	23 s
Paraphrase	Perplexity Sonar	`sonar`	2026-09-17 14:01	yes	20	5 s
Paraphrase	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 14:07	yes	45	20 s
Paraphrase	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 10:08	yes	5	7 s
Paraphrase	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 10:00	yes	18	20 s
Paraphrase	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 13:45	yes	5	4 s
Paraphrase	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 13:36	no	0	37 s
Paraphrase	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 11:53	yes	10	29 s
Paraphrase	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 12:54	yes	24	116 s
Paraphrase	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 10:51	yes	9	24 s
Comparative	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 13:31	yes	9	8 s
Comparative	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 13:08	yes	4	9 s
Comparative	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 11:12	yes	13	26 s
Comparative	Perplexity Sonar	`sonar`	2026-09-17 14:08	yes	20	13 s
Comparative	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:41	yes	27	17 s
Comparative	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 10:55	yes	5	8 s
Comparative	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 09:52	yes	11	30 s
Comparative	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 13:31	yes	5	3 s
Comparative	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 10:37	yes	5	32 s
Comparative	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 11:45	yes	10	26 s
Comparative	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 13:04	yes	10	38 s
Comparative	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 12:11	yes	5	22 s
Budget constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 11:48	yes	9	7 s
Budget constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 11:18	yes	2	4 s
Budget constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 12:26	yes	10	25 s
Budget constrained	Perplexity Sonar	`sonar`	2026-09-17 12:49	yes	20	5 s
Budget constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:07	yes	11	6 s
Budget constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:45	yes	5	6 s
Budget constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 11:24	yes	10	12 s
Budget constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 10:18	yes	5	2 s
Budget constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 10:30	yes	5	23 s
Budget constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 13:01	yes	15	22 s
Budget constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 12:03	yes	9	82 s
Budget constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 11:34	yes	5	15 s
Scale constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:11	no	0	7 s
Scale constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 10:42	no	0	11 s
Scale constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 12:11	yes	10	23 s
Scale constrained	Perplexity Sonar	`sonar`	2026-09-17 13:51	yes	20	10 s
Scale constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 12:06	yes	17	11 s
Scale constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 09:28	no	0	7 s
Scale constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 12:34	yes	13	23 s
Scale constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 09:42	yes	5	3 s
Scale constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 12:00	no	0	38 s
Scale constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 09:34	yes	14	39 s
Scale constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 13:55	yes	14	95 s
Scale constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 11:49	yes	5	32 s
Negative framing	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 10:31	no	0	4 s
Negative framing	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 10:47	no	0	6 s
Negative framing	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 10:19	yes	20	25 s
Negative framing	Perplexity Sonar	`sonar`	2026-09-17 12:45	yes	20	7 s
Negative framing	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 12:58	yes	37	16 s
Negative framing	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:12	yes	5	6 s
Negative framing	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 13:20	yes	20	18 s
Negative framing	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:53	yes	5	3 s
Negative framing	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 14:07	yes	5	34 s
Negative framing	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 09:36	yes	14	22 s
Negative framing	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 10:07	yes	13	47 s
Negative framing	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 13:16	yes	24	51 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings

Aikido read as Aikido Security

Checkmarx read as Checkmarx One

Checkmarx (Checkmarx One) read as Checkmarx One

Checkmarx (CxSAST) read as Checkmarx One

Checkmarx (now part of Veracode) read as Checkmarx One

GitLab read as GitLab SAST

GitLab Ultimate read as GitLab SAST

Unresolved, counted raw

Contrast Assess

Corridor

ESLint (with security plugins)

ESLint + Security Plugins (JavaScript)

IBM AppScan Source

NodeJsScan

PHPStan

Parasoft C/C++test

RIPS

Scan4all

Discontinued, still offered

No shut-down product was recommended here.

Static application security testing

By buyer segment

01The standing

Recommended versus criticized

02What they warned about

03What they cite

Sites the answers cite

Pages the answers cite

04How they answered

05The record

Normalization in this category

Also in developer platform