# Penetration testing as a service: what AI models recommend, October 2026

Gane Index, October 2026 Edition. Asked as "penetration testing service" and as "pentest-as-a-service provider", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/2026-10

This is the permanent record of the October 2026 Edition, published October 1, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/index.md

**Standing:** Cobalt leads with 45% of first choices; verdict clear leader. 47 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cobalt](https://www.gane.ai/index/it/vendors/cobalt/index.md) | 45% | 2% | 41 |
| 2 | [BreachLock](https://www.gane.ai/index/it/vendors/breachlock/index.md) | 19% | 0% | 35 |
| 3 | [Synack](https://www.gane.ai/index/it/vendors/synack/index.md) | 4% | 10% | 29 |
| 4 | [Astra Security](https://www.gane.ai/index/it/vendors/astra-security/index.md) | 4% | 0% | 17 |
| 5 | [UnderDefense](https://www.gane.ai/index/it/vendors/underdefense/index.md) | 4% | 0% | 11 |
| 6 | [HackerOne PTaaS](https://www.gane.ai/index/it/vendors/hackerone-ptaas/index.md) | 2% | 14% | 14 |
| 8 | [Bugcrowd PTaaS](https://www.gane.ai/index/it/vendors/bugcrowd-ptaas/index.md) | 2% | 17% | 12 |
| 17 | [NetSPI](https://www.gane.ai/index/it/vendors/netspi/index.md) | 0% | 9% | 22 |
| 18 | [Bishop Fox](https://www.gane.ai/index/it/vendors/bishop-fox/index.md) | 0% | 0% | 10 |
| 20 | [Rapid7](https://www.gane.ai/index/it/vendors/rapid7/index.md) | 0% | 9% | 11 |

Rank is by share of first choices among all 82 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: BreachLock, Cobalt; alternatives Packetlabs, Raxis, Stingrai
- GPT-5.4 mini: Cobalt; alternatives Cognisys, Trava Security
- Gemini 3.5 Flash: Cobalt; alternatives BreachLock, NetSPI, UnderDefense
- Perplexity Sonar: BreachLock; alternatives Cobalt, Raxis, Stingrai
- Grok 4.20: BreachLock; alternatives Bright Defense, NetSPI, Packetlabs, Prescient Security
- Mistral Small: BreachLock, Cobalt; alternatives NetSPI, Stingrai, Synack
- DeepSeek V4 Flash: Cobalt, Raxis; alternatives BreachLock, Packetlabs, UnderDefense
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Red Siege Security; alternatives Astra Security, BreachLock, Lumina.io, Netragard
- Kimi K2: Cobalt; alternatives BreachLock, Coalfire, Praetorian
- GLM 4.7 FlashX: Cobalt, UnderDefense; alternatives BreachLock, NetSPI, Packetlabs
- MiniMax M2.5: BreachLock, UnderDefense; alternatives Raxis, Synack
- GPT-6 Luna: Cobalt; alternatives Bishop Fox, NetSPI
- Muse Glimmer 30B: Cobalt; alternatives Astra Security, HackerOne PTaaS, Netragard, Red Siege

## Sources the answers cite

73 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- deepstrike.io: 41 answers, 80 citations
- synack.com: 39 answers, 46 citations
- underdefense.com: 38 answers, 43 citations
- stingrai.io: 31 answers, 67 citations
- techrepublic.com: 27 answers, 28 citations
- beaglesecurity.com: 25 answers, 25 citations
- getastra.com: 20 answers, 28 citations
- softwaresecured.com: 16 answers, 16 citations

Pages named in the most answers:

- https://underdefense.com/blog/penetration-testing-services (33 answers)
- https://techrepublic.com/article/best-penetration-testing-companies (27 answers)
- https://beaglesecurity.com/blog/article/top-penetration-testing-companies.html (24 answers)
- https://synack.com/blog/best-penetration-testing-companies (23 answers)
- https://deepstrike.io/blog/penetration-testing-vendors (18 answers)
- https://deepstrike.io/blog/how-to-choose-a-penetration-testing-company (15 answers)
- https://deepstrike.io/blog/top-penetration-testing-as-a-service-ptaas (14 answers)
- https://getastra.com/blog/penetration-testing/top-providers (12 answers)
- https://softwaresecured.com/post/top-10-penetration-testing-vendors (12 answers)
- https://stingrai.io/blog/best-ptaas-providers-2026 (12 answers)

## Warned against

- Synack: 3 of 29 labels negative. "Choose Synack if you want a crowdsourced model and are willing to validate scope and pricing more carefully" (Perplexity Sonar, paraphrase prompt)
- Mandiant: 2 of 4 labels negative. "Avoid pure enterprise giants (e.g., Mandiant, Rapid7) which can be pricier/slower" (Grok 4.20, direct prompt)
- Bugcrowd PTaaS: 2 of 12 labels negative. "often more suited to larger enterprises or those with more complex needs" (Mistral Small, paraphrase prompt)
- HackerOne PTaaS: 2 of 14 labels negative. "crowdsourced like HackerOne/Cobalt work for speed but less for deep compliance" (Grok 4.20, direct prompt)

## Movement since September 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Cobalt at 44%.

- BreachLock: 9% to 20%, +11. Inside the floor by 0 points · rank 3 → 2 of 74.
- Astra Security: 13% to 5%, −8. Inside the floor by 3 points · rank 2 → 4 of 74.
- Synack: 0% to 5%, +5. Inside the floor by 6 points · rank 18 → 3 of 74.
- Bugcrowd PTaaS: 0% to 2%, +2. Inside the floor by 9 points · rank 23 → 7 of 74.
- HackerOne PTaaS: 0% to 2%, +2. Inside the floor by 9 points · rank 26 → 8 of 74.
- NetSPI: 2% to 0%, −2. Inside the floor by 9 points · rank 5 → 15 of 74.
- Cobalt: 44% to 44%, ±0. Inside the floor by 11 points · rank 1 of 74, unchanged.
- Bishop Fox: 0% to 0%, ±0. Inside the floor by 11 points · rank 17 → 16 of 74.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, October 2026 Edition, www.gane.ai/index/it.