# Penetration testing as a service for enterprise buyers: what AI models recommend, October 2026

Gane Index, October 2026 Edition. Asked as "penetration testing service" and as "pentest-as-a-service provider", six framings each, to fourteen models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/2026-10/enterprise

This is the permanent record of the October 2026 Edition, published October 1, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/enterprise/index.md

**Standing:** NetSPI leads with 46% of first choices; verdict clear leader. 48 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [NetSPI](https://www.gane.ai/index/it/vendors/netspi/index.md) | 46% | 2% | 46 |
| 2 | [Synack](https://www.gane.ai/index/it/vendors/synack/index.md) | 23% | 2% | 47 |
| 3 | [Cobalt](https://www.gane.ai/index/it/vendors/cobalt/index.md) | 12% | 10% | 42 |
| 4 | [BreachLock](https://www.gane.ai/index/it/vendors/breachlock/index.md) | 6% | 4% | 25 |
| 5 | [Bishop Fox](https://www.gane.ai/index/it/vendors/bishop-fox/index.md) | 4% | 0% | 22 |
| 6 | [Bugcrowd PTaaS](https://www.gane.ai/index/it/vendors/bugcrowd-ptaas/index.md) | 4% | 18% | 11 |
| 7 | [Mandiant](https://www.gane.ai/index/it/vendors/mandiant/index.md) | 2% | 7% | 15 |
| 9 | [NCC Group](https://www.gane.ai/index/it/vendors/ncc-group/index.md) | 0% | 0% | 18 |
| 10 | [Rapid7](https://www.gane.ai/index/it/vendors/rapid7/index.md) | 0% | 0% | 15 |
| 11 | [HackerOne PTaaS](https://www.gane.ai/index/it/vendors/hackerone-ptaas/index.md) | 0% | 12% | 17 |
| 12 | [Astra Security](https://www.gane.ai/index/it/vendors/astra-security/index.md) | 0% | 0% | 11 |

Rank is by share of first choices among all 66 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: NetSPI, Synack; alternatives Cobalt, NCC Group
- Gemini 3.5 Flash: Bishop Fox, NetSPI; alternatives BreachLock, Cobalt, Synack
- Perplexity Sonar: NetSPI, Synack; alternatives A-LIGN, BreachLock, GuidePoint Security, Kroll
- Grok 4.20: NetSPI; alternatives BreachLock, Cobalt, Synack, TrustedSec
- Mistral Small: BreachLock, NetSPI; alternatives Redbot Security
- DeepSeek V4 Flash: NetSPI; alternatives Bishop Fox, Cobalt, NCC Group, Rapid7
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Mandiant; alternatives Coalfire, Cobalt, NCC Group, Secureworks
- Kimi K2: NetSPI, Synack; alternatives Bishop Fox, Cobalt
- GLM 4.7 FlashX: NetSPI; alternatives Bishop Fox, Cobalt, NCC Group, Rapid7
- MiniMax M2.5: BreachLock; alternatives Bulletproof, Qualys, Redbot Security
- GPT-6 Luna: Bishop Fox, Cobalt; alternatives NetSPI
- Muse Glimmer 30B: NetSPI; alternatives Bugcrowd PTaaS, Coalfire, Cobalt, HackerOne PTaaS

## Sources the answers cite

75 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- deepstrike.io: 50 answers, 105 citations
- synack.com: 50 answers, 74 citations
- underdefense.com: 41 answers, 44 citations
- stingrai.io: 37 answers, 75 citations
- getastra.com: 37 answers, 52 citations
- techrepublic.com: 29 answers, 30 citations
- softwaresecured.com: 28 answers, 35 citations
- beaglesecurity.com: 20 answers, 20 citations

Pages named in the most answers:

- https://underdefense.com/blog/penetration-testing-services (39 answers)
- https://synack.com/blog/best-penetration-testing-companies (33 answers)
- https://techrepublic.com/article/best-penetration-testing-companies (29 answers)
- https://getastra.com/blog/penetration-testing/companies (22 answers)
- https://deepstrike.io/blog/top-penetration-testing-companies-us (21 answers)
- https://getastra.com/blog/penetration-testing/top-providers (21 answers)
- https://beaglesecurity.com/blog/article/top-penetration-testing-companies.html (19 answers)
- https://softwaresecured.com/post/top-10-penetration-testing-vendors (19 answers)
- https://deepstrike.io/blog/penetration-testing-vendors (15 answers)
- https://deepstrike.io/blog/top-penetration-testing-as-a-service-ptaas (15 answers)

## Warned against

- Cobalt: 4 of 42 labels negative. "uses a credit-based model that requires active management to avoid credit expiration — less predictable" (DeepSeek V4 Flash, budget prompt)
- Bugcrowd PTaaS: 2 of 11 labels negative. "Crowdsourced ... platforms (e.g., HackerOne, Bugcrowd, Synack, etc.) can be powerful for certain use cases, but they are not universally suitable for large enterprises." (GLM 4.7 FlashX, negative prompt)
- HackerOne PTaaS: 2 of 17 labels negative. "Crowdsourced Penetration Testing as a Service (PTaaS) platforms (e.g., HackerOne, Bugcrowd, Synack, etc.) can be powerful for certain use cases, but they are not universally suitable for large enterprises." (GLM 4.7 FlashX, negative prompt)
- BreachLock: 1 of 25 labels negative. "more geared toward SMB/mid-market and lacks the enterprise scale and compliance depth of Synack" (DeepSeek V4 Flash, budget prompt)

## Movement since September 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: NetSPI at 48%.

- NetSPI: 40% to 48%, +8. Inside the floor by 3 points · rank 1 of 62, unchanged.
- Cobalt: 15% to 10%, −5. Inside the floor by 6 points · rank 3 of 62, unchanged.
- BreachLock: 4% to 8%, +4. Inside the floor by 7 points · rank 5 → 4 of 62.
- HackerOne PTaaS: 4% to 0%, −4. Inside the floor by 7 points · rank 6 → 11 of 62.
- Synack: 23% to 25%, +2. Inside the floor by 9 points · rank 2 of 62, unchanged.
- Bishop Fox: 4% to 2%, −2. Inside the floor by 9 points · rank 4 → 5 of 62.
- Mandiant: 0% to 2%, +2. Inside the floor by 9 points · rank 11 → 6 of 62.
- Bugcrowd PTaaS: 0% to 2%, +2. Inside the floor by 9 points · rank 17 → 8 of 62.
- NCC Group: 2% to 0%, −2. Inside the floor by 9 points · rank 8 → 9 of 62.
- Rapid7: 0% to 0%, ±0. Inside the floor by 11 points · rank 12 → 10 of 62.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, October 2026 Edition, www.gane.ai/index/it.