# Black Duck: how AI models rank it, September 2026

IT AI Recommendation Index, September 2026 Edition. Named in 36 judge labels across 3 categories by 12 of 12 models. Page: https://it-ai-index.com/vendors/black-duck/

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| Software composition analysis | 0% | 12 | 18% | 34 |
| Penetration testing as a service | 0% | 58 | 0% | 1 |
| Static application security testing | 0% | 29 | 0% | 1 |

## What the models said for it

- "Often considered the "gold standard" for enterprise SCA... Choose Synopsys or Sonatype if you are a large organization with strict legal/compliance requirements" (Qwen 3.7 Flash, SCA)
- "Traditional enterprise-grade tools with exceptionally deep license compliance libraries, great for strict governance." (Gemini 3.5 Flash, SCA)
- "better if you need heavier governance, compliance, and enterprise-grade license management" (Perplexity Sonar, SCA)
- "Enterprise Governance ... Best For: Large enterprises with strict compliance requirements" (Kimi K2, SCA)

## And against it

- "like older versions of Black Duck or Sonatype Nexus IQ) can be slow to install, heavy on resources, or difficult to configure at scale" (Qwen 3.7 Flash, SCA)
- "Users report significant false positives, especially on large codebases... Expensive enterprise licensing, complex deployment" (Kimi K2, SCA)
- "they can be complex, expensive, and sometimes overkill for smaller teams or simpler use cases" (Mistral Small, SCA)
- "Resource-heavy on-prem, slower scans, higher costs; some false positives/container gaps." (Grok 4.1 Fast, SCA)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.