Brandwave

OWASP Dependency-Track vs Syft:Which is more popular?

In September 2026, Syft had more branded searches than OWASP Dependency-Track among SBOM platforms worldwide. Syft had about 12,100 branded searches, while OWASP Dependency-Track had 9,900. Syft made up 13.6% of all SBOM platform searches we track, and OWASP Dependency-Track accounted for 11.2%. When we asked ChatGPT and Google AI Overviews about SBOM platforms, OWASP Dependency-Track and Syft each appeared in three of the five answers. OWASP Dependency-Track was mentioned before Syft in three out of four answers.

Among SBOM platforms worldwide in September 2026

Who do people search for more?

Syft, about 22% more searches than OWASP Dependency-Track

Syft 12.1K searchesOWASP Dependency-Track 9.9K searches

Who does AI mention more?

Both were mentioned in 3 of 5 answers.

OWASP Dependency-Track in 3 of 5Syft in 3 of 5

Who does AI recommend more?

OWASP Dependency-Track, named ahead of Syft in 3 of 4 answers

OWASP Dependency-Track first in 3Syft first in 1

Follow OWASP Dependency-Track vs Syft and get free monthly updates on what changed

By continuing you'll get index updates and occasional product news from Brandwave. Unsubscribe any time. Privacy

Track your brand against a rival →

Top SBOM platforms in ChatGPT and Google AI Overviews

In three ChatGPT questions and two Google AI Overviews, OWASP Dependency-Track was mentioned in three out of five: in all three ChatGPT answers, but not in either of the two Google AI Overviews. Syft was mentioned in three out of five: in two of the three ChatGPT answers and in one of the two Google AI Overviews. OWASP Dependency-Track was listed before Syft in three out of four answers.

Most recommended by AI

Brands get a higher ranking if they are mentioned earlier in the answers.

  1. Anchore1st
  2. Snyk2nd
  3. OWASP Dependency-Track3rd
  4. Syft4th
  5. Black Duck5th
  6. FOSSA6th
  7. JFrog Xray7th
  8. CycloneDX8th
  9. Mend–
  10. Cybeats–

Mentioned by AI

Each dot is one answer, filled in when that answer mentions the brand.

  • CycloneDX5 of 5Named in 3 of 3 ChatGPT answersNamed in 2 of 2 Google answers
  • Anchore4 of 5Named in 3 of 3 ChatGPT answersNamed in 1 of 2 Google answers
  • Snyk3 of 5Named in 3 of 3 ChatGPT answersNamed in 0 of 2 Google answers
  • Syft3 of 5Named in 2 of 3 ChatGPT answersNamed in 1 of 2 Google answers
  • OWASP Dependency-Track3 of 5Named in 3 of 3 ChatGPT answersNamed in 0 of 2 Google answers
  • JFrog Xray2 of 5Named in 2 of 3 ChatGPT answersNamed in 0 of 2 Google answers
  • Black Duck2 of 5Named in 2 of 3 ChatGPT answersNamed in 0 of 2 Google answers
  • FOSSA2 of 5Named in 2 of 3 ChatGPT answersNamed in 0 of 2 Google answers
  • Mend0 of 5Named in 0 of 3 ChatGPT answersNamed in 0 of 2 Google answers
  • Cybeats0 of 5Named in 0 of 3 ChatGPT answersNamed in 0 of 2 Google answers

See every answer about SBOM platforms

5 answers

Not named in any answer:

Brands are shown in the order each answer named them. The survey took place in the United States on October 21, 2026.

Is OWASP Dependency-Track or Syft more popular in search?

This chart shows how often people search Google for OWASP Dependency-Track and Syft by name. Each line represents a brand's share of searches for all ten SBOM platforms we track, month by month, from English-language searches worldwide.

OWASP Dependency-Track and Syft among SBOM platforms worldwide, by month

Share of searches by month for Syft, OWASP Dependency-Track. The figures are in the table below the chart.

View monthly share of searches table
MonthSnykSyftOWASP Dependency-TrackCycloneDXAnchoreJFrog XrayBlack DuckMendCybeatsFOSSA
Oct 202560.7%14.9%8.1%6.6%4.4%1.9%1.5%1%0.88%0.01%
Nov 202556.9%17%9.3%6.2%5.1%2.2%1.4%1.1%0.83%0.01%
Dec 202559.2%14.5%9.7%6.5%4.3%2.3%1.6%1.2%0.86%0.01%
Jan 202656.7%17%9.3%6.2%5%2.2%1.5%1.1%1%0.01%
Feb 202661.3%15%8.2%6.7%3.6%1.9%1.3%1%0.89%0.01%
Mar 202657.7%17.3%9.4%6.3%3.4%2.3%1.7%0.95%0.95%<0.01%
Apr 202659.1%14.5%9.7%6.4%4.3%2.3%1.6%1.3%0.86%<0.01%
May 202660.1%14.7%9.8%6.6%3.6%1.9%1.4%0.99%0.87%<0.01%
Jun 202661%12.2%10%8.2%3.6%1.9%1.5%0.89%0.73%0.01%
Jul 202657%13.9%11.4%7.6%4.1%1.8%2%1.2%0.83%0.01%
Aug 202657.3%14%9.4%9.4%4.2%1.9%1.7%1.2%1%0.01%
Sep 202655.8%13.6%11.2%9.1%5%1.8%1.6%0.99%0.81%0.01%

How has the OWASP Dependency-Track and Syft comparison changed over the last 12 months?

3 findings
  • Syft was ahead of OWASP Dependency-Track in every measured month of the 12 months ending September 2026.
  • Across the 12 months ending September 2026, OWASP Dependency-Track’s share of searches among SBOM platforms worldwide moved from 8.1% to 11.2%, and its estimated monthly branded searches moved from 8.1K to 9.9K.
  • Across the 12 months ending September 2026, Syft’s share of searches among SBOM platforms worldwide moved from 14.9% to 13.6%, and its estimated monthly branded searches moved from 14.8K to 12.1K.

How did search popularity change for SBOM platforms worldwide in September 2026?

2 changes

  1. In September 2026, OWASP Dependency-Track overtook CycloneDX to rank 3rd among SBOM platforms worldwide, with 11.2% of the searches.

  2. Estimated monthly branded searches for Syft worldwide fell 18.2% over 12 measured months, from 14.8K to 12.1K in September 2026.

How are branded searches counted?

2 search terms

Brandwave collects information about searches that people make online using OWASP Dependency-Track’s and Syft’s names. When viewed over time, estimated search volumes for these branded terms can be used to understand whether interest in the brands is growing, holding steady, or fading.

OWASP Dependency-Track

1 branded search term

  • dependency track

Syft

1 branded search term

  • syft

How the Brand Demand Index is measured

Other head-to-heads among SBOM platforms

Creator with pink hair and a pink jacket

Put your own brand in this comparison

Brandwave tracks your branded demand next to the rival you actually watch, with your campaigns, spend and outcomes on the same timeline.

Start free