# Penetration testing as a service for small business buyers: what AI models recommend, October 2026

Gane Index, October 2026 Edition. Asked as "penetration testing service" and as "pentest-as-a-service provider", six framings each, to fourteen models with search on, on behalf of a small B2B company. Page: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/2026-10/smb

This is the permanent record of the October 2026 Edition, published October 1, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/penetration-testing-as-a-service/smb/index.md

**Standing:** Cobalt (tied with Bright Defense) leads with 17% of first choices; verdict contested. 47 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cobalt](https://www.gane.ai/index/it/vendors/cobalt/index.md) | 17% | 11% | 37 |
| 2 | [Bright Defense](https://www.gane.ai/index/it/vendors/bright-defense/index.md) | 17% | 0% | 17 |
| 3 | [BreachLock](https://www.gane.ai/index/it/vendors/breachlock/index.md) | 13% | 0% | 24 |
| 4 | [Astra Security](https://www.gane.ai/index/it/vendors/astra-security/index.md) | 11% | 0% | 21 |
| 5 | [Acunetix](https://www.gane.ai/index/it/vendors/acunetix/index.md) | 9% | 20% | 15 |
| 9 | [UnderDefense](https://www.gane.ai/index/it/vendors/underdefense/index.md) | 2% | 0% | 17 |
| 10 | [Bugcrowd PTaaS](https://www.gane.ai/index/it/vendors/bugcrowd-ptaas/index.md) | 2% | 8% | 12 |
| 11 | [Pentest-Tools.com](https://www.gane.ai/index/it/vendors/pentest-tools-com/index.md) | 2% | 0% | 10 |

Rank is by share of first choices among all 76 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Cobalt; alternatives Astra Security, Intruder, TraceSecurity, UnderDefense
- GPT-5.4 mini: Astra Security; alternatives Cobalt, HackerOne PTaaS, Vynox Security PTaaS
- Gemini 3.5 Flash: Astra Security; alternatives BreachLock, Cobalt, Kobalt.io, UnderDefense
- Perplexity Sonar: Bright Defense; alternatives Astra Security, DeepStrike
- Grok 4.20: BreachLock, Cobalt; alternatives Acunetix
- Mistral Small: Astra Security, Bright Defense; alternatives Cobalt, NetSPI
- DeepSeek V4 Flash: Bright Defense; alternatives BreachLock, Cobalt, Prescient Security
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Bright Defense; alternatives Astra Security, Cobalt
- Kimi K2: Bright Defense, Prescient Security; alternatives Affordable Pentesting, Cobalt, Qualysec, Raxis
- GLM 4.7 FlashX: Affordable Pentesting, Bright Defense; alternatives RevealSec, UnderDefense
- MiniMax M2.5: no first choice
- GPT-6 Luna: Cobalt; alternatives Kobalt.io, Packetlabs
- Muse Glimmer 30B: Bright Defense, Prescient Security; alternatives Affordable Pentesting, RevealSec, UnderDefense

## Sources the answers cite

74 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- deepstrike.io: 38 answers, 75 citations
- underdefense.com: 32 answers, 42 citations
- brightdefense.com: 27 answers, 35 citations
- synack.com: 26 answers, 35 citations
- techrepublic.com: 26 answers, 28 citations
- terra.security: 23 answers, 23 citations
- stingrai.io: 22 answers, 39 citations
- netragard.com: 18 answers, 18 citations

Pages named in the most answers:

- https://underdefense.com/blog/penetration-testing-services (29 answers)
- https://techrepublic.com/article/best-penetration-testing-companies (26 answers)
- https://terra.security/blog/top-10-penetration-testing-as-a-service-ptaas-providers (23 answers)
- https://brightdefense.com/resources/best-penetration-testing-companies-for-soc-2-compliance (21 answers)
- https://deepstrike.io/blog/penetration-testing-vendors (16 answers)
- https://deepstrike.io/blog/top-penetration-testing-as-a-service-ptaas (14 answers)
- https://defendify.com/blog/penetration-testing-companies (14 answers)
- https://synack.com/blog/best-penetration-testing-companies (14 answers)
- https://linkedin.com/pulse/10-best-penetration-testing-companies-usa-tamzid-cybersecurity-seo-0gkfc (13 answers)
- https://andersenlab.com/blueprint/top-15-penetration-testing-companies (12 answers)

## Warned against

- Cobalt: 4 of 37 labels negative. "Pricing starts around $65K–$100K+/year — likely overkill for a small business" (Kimi K2, paraphrase prompt)
- Acunetix: 3 of 15 labels negative. "Web-only scanner; no network/API/infrastructure testing" (Kimi K2, paraphrase prompt)
- Bishop Fox: 2 of 4 labels negative. "skip the enterprise giants (Bishop Fox, Mandiant, Rapid7, etc.)" (DeepSeek V4 Flash, direct prompt)
- HackerOne PTaaS: 2 of 6 labels negative. "What to Avoid ... Median contract ~$41K/year; better for bug bounty programs" (Kimi K2, paraphrase prompt)

## Movement since September 2026

Floor: 11 points of share, measured on the calibration repeat.
New leader: BreachLock (28%) to Bright Defense (18%). Margin 6 points, within noise.

- Bright Defense: 0% to 18%, +18. Cleared the floor by 7 points · rank 13 → 1 of 71.
- BreachLock: 28% to 12%, −16. Cleared the floor by 5 points · rank 1 → 3 of 71.
- Astra Security: 19% to 12%, −7. Inside the floor by 4 points · rank 3 → 4 of 71.
- Cobalt: 21% to 15%, −6. Inside the floor by 5 points · rank 2 of 71, unchanged.
- Acunetix: 9% to 10%, +1. Inside the floor by 10 points · rank 4 → 5 of 71.
- UnderDefense: 2% to 2%, ±0. Inside the floor by 11 points · rank 7 → 8 of 71.
- Bugcrowd PTaaS: 2% to 2%, ±0. Inside the floor by 11 points · rank 6 → 10 of 71.
- Intruder: 0% to 0%, ±0. Inside the floor by 11 points · rank 12 → 17 of 71.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, October 2026 Edition, www.gane.ai/index/it.