# Penetration testing as a service for enterprise buyers: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "penetration testing service" and as "pentest-as-a-service provider", six framings each, to twelve models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/2026-09/enterprise

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/enterprise/index.md

**Standing:** NetSPI leads with 40% of first choices; verdict contested. 48 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [NetSPI](https://www.gane.ai/index/it/vendors/netspi/index.md) | 40% | 0% | 36 |
| 2 | [Synack](https://www.gane.ai/index/it/vendors/synack/index.md) | 23% | 0% | 42 |
| 3 | [Cobalt](https://www.gane.ai/index/it/vendors/cobalt/index.md) | 15% | 6% | 35 |
| 4 | [Bishop Fox](https://www.gane.ai/index/it/vendors/bishop-fox/index.md) | 4% | 7% | 27 |
| 5 | [BreachLock](https://www.gane.ai/index/it/vendors/breachlock/index.md) | 4% | 0% | 13 |
| 6 | [HackerOne PTaaS](https://www.gane.ai/index/it/vendors/hackerone-ptaas/index.md) | 4% | 14% | 21 |
| 8 | [NCC Group](https://www.gane.ai/index/it/vendors/ncc-group/index.md) | 2% | 6% | 17 |
| 11 | [Mandiant](https://www.gane.ai/index/it/vendors/mandiant/index.md) | 0% | 0% | 13 |
| 17 | [Bugcrowd PTaaS](https://www.gane.ai/index/it/vendors/bugcrowd-ptaas/index.md) | 0% | 25% | 12 |

Rank is by share of first choices among all 73 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: NetSPI; alternatives BreachLock, NCC Group, Synack
- GPT-5.4 mini: NetSPI; alternatives BreachLock, Horizon3.ai NodeZero, Pentera, UnderDefense
- Gemini 3.5 Flash: NetSPI; alternatives Bishop Fox, BreachLock, Cobalt, Synack
- Perplexity Sonar: NetSPI; alternatives AppSecure Security, Bishop Fox, Cobalt, Mandiant
- Grok 4.20: Bishop Fox, NetSPI; alternatives Mandiant, NCC Group, Synack
- Mistral Small: Deloitte, Terra Security; alternatives Astra Security
- DeepSeek V4 Flash: Bishop Fox, NetSPI; alternatives Coalfire, Synack
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Cobalt, Synack; alternatives Bishop Fox, Secops, Trustwave, VerSprite
- Kimi K2: Cobalt, Synack; alternatives Bishop Fox, HackerOne PTaaS, NCC Group, NetSPI
- GLM 4.7 FlashX: NetSPI; alternatives Astra Security, Bishop Fox, Cobalt, Synack
- MiniMax M2.5: NCC Group; alternatives Bugcrowd PTaaS, Deloitte, EY, IBM X-Force

## Sources the answers cite

64 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- synack.com: 46 answers, 67 citations
- deepstrike.io: 45 answers, 84 citations
- stingrai.io: 32 answers, 50 citations
- cybri.com: 25 answers, 31 citations
- underdefense.com: 25 answers, 27 citations
- softwaresecured.com: 23 answers, 29 citations
- brightdefense.com: 16 answers, 19 citations
- getastra.com: 16 answers, 18 citations

Pages named in the most answers:

- https://synack.com/blog/best-penetration-testing-companies (33 answers)
- https://underdefense.com/blog/penetration-testing-services (25 answers)
- https://softwaresecured.com/post/top-10-penetration-testing-vendors (19 answers)
- https://cybri.com/blog/best-penetration-testing-vendors (18 answers)
- https://techrepublic.com/article/best-penetration-testing-companies (14 answers)
- https://deepstrike.io/blog/top-penetration-testing-as-a-service-ptaas (13 answers)
- https://redbotsecurity.com/penetration-testing-companies (13 answers)
- https://deepstrike.io/blog/top-penetration-testing-companies (12 answers)
- https://lorikeetsecurity.com/blog/top-10-pentesting-companies-2026 (12 answers)
- https://terra.security/blog/top-10-penetration-testing-as-a-service-ptaas-providers (12 answers)

## Warned against

- Bugcrowd PTaaS: 3 of 12 labels negative. "Avoid pure crowdsourced (HackerOne/Bugcrowd) due to variable bounties/credits" (Grok 4.20, budget prompt)
- Bishop Fox: 2 of 27 labels negative. "What to Avoid for Predictable Cost ... Costs scale unpredictably as scope expands." (DeepSeek V4 Flash, budget prompt)
- HackerOne PTaaS: 3 of 21 labels negative. "Avoid pure crowdsourced (HackerOne/Bugcrowd) due to variable bounties/credits" (Grok 4.20, budget prompt)
- AttackIQ Flex: 1 of 1 labels negative. "avoid pure pay-as-you-go services like AttackIQ Flex unless your testing volume is tightly controlled" (GPT-5.4 mini, budget prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.