Every category where a model named Black Duck for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.

Category	Function	Share	Rank	Negative rate	Labels	Quadrant
Software composition analysis	Developer platform	0%	12 of 49	18%	34	accepted challenger
Penetration testing as a service	Security operations	0%	58 of 76	0%	1	under 10 labels · led by Cobalt at 44%
Static application security testing	Developer platform	0%	29 of 47	0%	1	under 10 labels · led by Semgrep at 47%

Movement

This is the first edition on this tier, so no move can be computed for Black Duck yet. From the next edition this section shows, per buyer segment, whether its share moved by more than the measured noise floor.

By model

How each model treated Black Duck across every prompt where it was named for a mid-market B2B company. Twelve models, six prompts per category.

Model	Alternative	Mention	Negative	Labels
Claude Haiku 4.5	1	2	0	3
GPT-5.4 mini	2	0	0	2
Gemini 3.5 Flash	2	0	0	2
Perplexity Sonar	1	1	0	2
Grok 4.1 Fast	3	1	1	5
Mistral Small	1	1	1	3
DeepSeek V4 Flash	1	2	1	4
Llama 4 Maverick	0	1	0	1
Qwen 3.7 Flash	1	2	2	5
Kimi K2	1	2	1	4
GLM 4.7 FlashX	2	0	0	2
MiniMax M2.5	3	0	0	3

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.

FramingLabels by classFirst choices

Direct23 labels6

Paraphrase4 labelsNone

Comparative29 labels7not counted in share

Budget-constrained15 labels2

Scale-constrained15 labelsNone

Negative18 labelsNone

First choiceAlternativeMentionNegative104 labels in all, every segment counted; 8 of the 15 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“Often considered the "gold standard" for enterprise SCA... Choose Synopsys or Sonatype if you are a large organization with strict legal/compliance requirements” Qwen 3.7 Flash · SCA · comparative prompt · alternative

“Traditional enterprise-grade tools with exceptionally deep license compliance libraries, great for strict governance.” Gemini 3.5 Flash · SCA · scale prompt · alternative

“better if you need heavier governance, compliance, and enterprise-grade license management” Perplexity Sonar · SCA · direct prompt · alternative

“Enterprise Governance ... Best For: Large enterprises with strict compliance requirements” Kimi K2 · SCA · comparative prompt · alternative

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

“like older versions of Black Duck or Sonatype Nexus IQ) can be slow to install, heavy on resources, or difficult to configure at scale” Qwen 3.7 Flash · SCA · negative prompt · soft negative

“Users report significant false positives, especially on large codebases... Expensive enterprise licensing, complex deployment” Kimi K2 · SCA · negative prompt · soft negative

“they can be complex, expensive, and sometimes overkill for smaller teams or simpler use cases” Mistral Small · SCA · negative prompt · soft negative

“Resource-heavy on-prem, slower scans, higher costs; some false positives/container gaps.” Grok 4.1 Fast · SCA · negative prompt · soft negative

Named alongside

The products named in the same answers as Black Duck, over the 104 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and Black Duck was named but was not.

ProductSame answerTook the first choice insteadHead to head

Snyk Open Source94 of 10430Not in the top three

Mend.io81 of 1049Not in the top three

Sonatype Lifecycle76 of 1049Not in the top three

Endor Labs47 of 1044Not in the top three

FOSSA36 of 1040Not in the top three

JFrog Xray33 of 1040Not in the top three

OWASP Dependency-Check29 of 1041Not in the top three

Trivy27 of 1048Not in the top three

Checkmarx SCA27 of 1040Not in the top three

GitHub Advanced Security22 of 1041Not in the top three

A head-to-head page exists where both products are in a category's top three. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named Black Duck. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, four of the twelve in this edition, so these counts come from 88 of the 104 answers that named Black Duck and are not a share of its labels.

Domains cited

endorlabs.com71

guideflow.com43

cycode.com41

safeguard.sh40

mend.io37

sonatype.com36

toolradar.com35

dupple.com34

expertinsights.com34

ox.security33

404 of the 404 domain citations in answers naming Black Duck came from somebody else's page.

Pages cited

endorlabs.com/learn/best-sca-tools-05b7a65

endorlabs.com/learn/best-sca-tools42

guideflow.com/blog/software-composition-analysis-tools40

dupple.com/learn/best-software-composition-analysis-tools34

toolradar.com/blog/best-software-composition-analysis-tools34

expertinsights.com/application-security/the-top-software-composition-analysis-tools33

cycode.com/blog/top-enterprise-sca-tools32

ox.security/blog/software-composition-analysis-and-sca-tools31

Pages are listed as the models cited them.

Names read as Black Duck

What the judge wrote, as written, with how often. The vendor table decides that these count as Black Duck; a claim can dispute any of them.

Black Duck (Synopsys) 8Black Duck/Synopsys 2Synopsys Black Duck 2Black Duck (by Synopsys) 1Black Duck SCA (formerly Synopsys) 1Synopsys 1Synopsys (Black Duck) 1

Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Black Duck's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Black Duck, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

It does not get any change to labels, shares or verdicts, any preview, or any say over which quotes appear. A verification link goes to your work email; an address at blackduck.com is approved on the spot, any other address is reviewed by hand.

Your name and company appear on the claimed page, or the company alone if you ask below. A title and a LinkedIn address appear there too if you give them, and are left off if you do not. Your email address is never published.