# Penetration testing as a service: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "penetration testing service" and as "pentest-as-a-service provider", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/2026-09

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/index.md

**Standing:** Cobalt leads with 44% of first choices; verdict clear leader. 45 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cobalt](https://www.gane.ai/index/it/vendors/cobalt/index.md) | 44% | 5% | 40 |
| 2 | [Astra Security](https://www.gane.ai/index/it/vendors/astra-security/index.md) | 13% | 0% | 26 |
| 3 | [BreachLock](https://www.gane.ai/index/it/vendors/breachlock/index.md) | 9% | 3% | 30 |
| 5 | [NetSPI](https://www.gane.ai/index/it/vendors/netspi/index.md) | 2% | 9% | 22 |
| 17 | [Bishop Fox](https://www.gane.ai/index/it/vendors/bishop-fox/index.md) | 0% | 6% | 16 |
| 18 | [Synack](https://www.gane.ai/index/it/vendors/synack/index.md) | 0% | 11% | 18 |
| 23 | [Bugcrowd PTaaS](https://www.gane.ai/index/it/vendors/bugcrowd-ptaas/index.md) | 0% | 30% | 10 |
| 26 | [HackerOne PTaaS](https://www.gane.ai/index/it/vendors/hackerone-ptaas/index.md) | 0% | 30% | 10 |

Rank is by share of first choices among all 76 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Cobalt; alternatives Astra Security, HackerOne PTaaS, Packetlabs, Thoropass Pentesting
- Gemini 3.5 Flash: Cobalt; alternatives BreachLock, Cybri, NetSPI
- Perplexity Sonar: Cobalt; alternatives BreachLock, DeepStrike, Prescient Security, Stingrai
- Grok 4.20: Packetlabs; alternatives BreachLock, Cobalt
- Mistral Small: Cobalt; alternatives BreachLock, Packetlabs, Stingrai
- DeepSeek V4 Flash: Cobalt; alternatives Astra Security, BreachLock, NetSPI, Packetlabs
- Llama 4 Maverick: Cobalt; alternatives DeepStrike, Echelon Cyber
- Qwen 3.7 Flash: Cobalt; alternatives Coalfire, Kforce, Synack, Trustwave
- Kimi K2: Cobalt; alternatives BreachLock, NetSPI, UnderDefense
- GLM 4.7 FlashX: Cobalt, NetSPI; alternatives Astra Security, Bishop Fox, BreachLock, Secureworks
- MiniMax M2.5: Stingrai; alternatives Cobalt, Invadel

## Sources the answers cite

62 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- deepstrike.io: 40 answers, 67 citations
- synack.com: 34 answers, 44 citations
- stingrai.io: 21 answers, 32 citations
- underdefense.com: 21 answers, 24 citations
- techrepublic.com: 21 answers, 22 citations
- getastra.com: 16 answers, 22 citations
- softwaresecured.com: 16 answers, 18 citations
- clutch.co: 15 answers, 22 citations

Pages named in the most answers:

- https://synack.com/blog/best-penetration-testing-companies (24 answers)
- https://techrepublic.com/article/best-penetration-testing-companies (20 answers)
- https://underdefense.com/blog/penetration-testing-services (19 answers)
- https://clutch.co/it-services/cybersecurity/penetration-testing (15 answers)
- https://deepstrike.io/blog/top-penetration-testing-companies (15 answers)
- https://deepstrike.io/blog/top-penetration-testing-as-a-service-ptaas (14 answers)
- https://terra.security/blog/top-10-penetration-testing-as-a-service-ptaas-providers (12 answers)
- https://softwaresecured.com/post/top-10-penetration-testing-vendors (11 answers)
- https://cybri.com/blog/ptaas-companies (10 answers)
- https://soc2auditors.org/penetration-testing-firms (10 answers)

## Warned against

- HackerOne PTaaS: 3 of 10 labels negative. "While good for finding unique bugs, tester continuity is lower because you never know which specific hacker will test your system next." (Qwen 3.7 Flash, comparative prompt)
- Acunetix: 2 of 6 labels negative. "but it is more of a web app security product than a full manual pentest firm" (Perplexity Sonar, budget prompt)
- Bugcrowd PTaaS: 3 of 10 labels negative. "typically more expensive for enterprise‑scale needs; often better suited to large, complex programs" (GLM 4.7 FlashX, paraphrase prompt)
- Cobalt: 2 of 40 labels negative. "though it is more of a managed marketplace than a low-cost commodity service" (Perplexity Sonar, budget prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.