# Penetration testing as a service for small business buyers: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "penetration testing service" and as "pentest-as-a-service provider", six framings each, to twelve models with search on, on behalf of a small B2B company. Page: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/2026-09/smb

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/smb/index.md

**Standing:** BreachLock leads with 28% of first choices; verdict contested. 43 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [BreachLock](https://www.gane.ai/index/it/vendors/breachlock/index.md) | 28% | 0% | 31 |
| 2 | [Cobalt](https://www.gane.ai/index/it/vendors/cobalt/index.md) | 21% | 6% | 33 |
| 3 | [Astra Security](https://www.gane.ai/index/it/vendors/astra-security/index.md) | 19% | 0% | 22 |
| 4 | [Acunetix](https://www.gane.ai/index/it/vendors/acunetix/index.md) | 9% | 19% | 16 |
| 6 | [Bugcrowd PTaaS](https://www.gane.ai/index/it/vendors/bugcrowd-ptaas/index.md) | 2% | 0% | 17 |
| 12 | [Intruder](https://www.gane.ai/index/it/vendors/intruder/index.md) | 0% | 20% | 10 |

Rank is by share of first choices among all 57 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Cobalt; alternatives Astra Security, Beagle Security, BreachLock
- GPT-5.4 mini: no first choice; alternatives Bishop Fox, Cobalt, NCC Group, NetSPI
- Gemini 3.5 Flash: BreachLock; alternatives Astra Security, Cobalt, SecureLeap
- Perplexity Sonar: Astra Security; alternatives Acunetix, BreachLock, Bright Defense, Cobalt
- Grok 4.20: Astra Security, BreachLock; alternatives Acunetix, Cobalt
- Mistral Small: Bugcrowd PTaaS, Terra Security; alternatives Acunetix
- DeepSeek V4 Flash: Astra Security, BreachLock; alternatives Bugcrowd PTaaS, Intruder, Practical Assurance, Software Secured
- Llama 4 Maverick: Acunetix; alternatives Bugcrowd PTaaS, Terra Security
- Qwen 3.7 Flash: Cobalt; alternatives Bugcrowd PTaaS, Coalfire, SANS Security Awareness, Synack
- Kimi K2: Astra Security, Cobalt; alternatives Bug Circuit, Stingrai, TurboPentest
- GLM 4.7 FlashX: Bug Circuit; alternatives Affordable Pentesting, Cobalt, SRS Networks
- MiniMax M2.5: Acunetix, Pentest-Tools.com; alternatives Terra Security

## Sources the answers cite

61 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- deepstrike.io: 46 answers, 72 citations
- synack.com: 32 answers, 38 citations
- terra.security: 30 answers, 30 citations
- techrepublic.com: 27 answers, 30 citations
- underdefense.com: 23 answers, 27 citations
- stingrai.io: 20 answers, 32 citations
- g2.com: 19 answers, 28 citations
- softwaresecured.com: 18 answers, 19 citations

Pages named in the most answers:

- https://terra.security/blog/top-10-penetration-testing-as-a-service-ptaas-providers (30 answers)
- https://techrepublic.com/article/best-penetration-testing-companies (27 answers)
- https://deepstrike.io/blog/top-penetration-testing-as-a-service-ptaas (24 answers)
- https://synack.com/blog/best-penetration-testing-companies (23 answers)
- https://underdefense.com/blog/penetration-testing-services (20 answers)
- https://deepstrike.io/blog/top-penetration-testing-companies (19 answers)
- https://softwaresecured.com/post/top-10-penetration-testing-vendors (13 answers)
- https://reddit.com/r/msp/comments/znf99o/small_business_pen_testing (11 answers)
- https://artificesecurity.com/penetration-testing-firms-red-flags (9 answers)
- https://cyberbench.net/blog/best-penetration-testing-companies-mid-market-2026 (9 answers)

## Warned against

- Invicti: 3 of 4 labels negative. "Invicti is mentioned for larger firms, so it is usually less aligned with a small-company default choice" (Perplexity Sonar, direct prompt)
- Synack: 3 of 8 labels negative. "While known for enterprise, they offer trials (like SARA®) and have tiered pricing that can be accessible" (Qwen 3.7 Flash, budget prompt)
- Acunetix: 3 of 16 labels negative. "An enterprise tool, but the scaled-down option is often cited as best for small businesses" (DeepSeek V4 Flash, comparative prompt)
- Cobalt: 2 of 33 labels negative. "annual PTaaS programs from vendors like Cobalt can still run $20,000 to $100,000+ per year, which may be too high for a tight budget" (Perplexity Sonar, budget prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.