Penetration testing as a service for small business buyers
Asked as “penetration testing service”, and as “pentest-as-a-service provider”, on behalf of a small B2B company. 46 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
22%
Contested · Astra Security 17%
22Stingrai17Astra Security13BreachLock48others
22% of first choices, contested.
Since October 2026↗new leaderNew leader since October 2026: Stingrai (22%) replaces Cobalt (17% then, 13% now), 9 points clear, inside the 11-point floor.Stingrai leads at 22%, replacing Cobalt, which led at 17% and stands at 13% now: 9 points clear, inside the floor, so the swap reads as unsettled.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Stingrai22%Contested↗new leaderNew leader since October 2026: Stingrai (22%) replaces Cobalt (17% then, 13% now), 9 points clear, inside the 11-point floor.This pageMid-market
Cobalt46%Clear leader▲+1Since October 2026: 45% → 46%, +1 point. Inside the 11-point floor: within noise.Standing →Enterprise
NetSPI30%Contested▼−16Since October 2026: 46% → 30%, −16 points. Past the 11-point floor: movement.Standing →
Stingrai22%Contested↗new leaderNew leader since October 2026: Stingrai (22%) replaces Cobalt (17% then, 13% now), 9 points clear, inside the 11-point floor.This pageMid-marketCobalt46%Clear leader▲+1Since October 2026: 45% → 46%, +1 point. Inside the 11-point floor: within noise.Standing →EnterpriseNetSPI30%Contested▼−16Since October 2026: 46% → 30%, −16 points. Past the 11-point floor: movement.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01Stingrai22%0%27accepted challenger▲+22Since October 2026: 0% → 22%, +22 points. Past the 11-point floor: movement.0% → 22%
Stingrai22%0%27accepted challenger▲+22Since October 2026: 0% → 22%, +22 points. Past the 11-point floor: movement.0% → 22%02
Astra Security17%0%37accepted challenger▲+6Since October 2026: 11% → 17%, +6 points. Inside the 11-point floor: within noise.11% → 17%
Astra Security17%0%37accepted challenger▲+6Since October 2026: 11% → 17%, +6 points. Inside the 11-point floor: within noise.11% → 17%03Cobalt13%7%44accepted challenger▼−4Since October 2026: 17% → 13%, −4 points. Inside the 11-point floor: within noise.17% → 13%
Cobalt13%7%44accepted challenger▼−4Since October 2026: 17% → 13%, −4 points. Inside the 11-point floor: within noise.17% → 13%04
BreachLock13%0%28accepted challenger=heldSince October 2026: 13% → 13%, ±0 points. Inside the 11-point floor: within noise.13% → 13%
BreachLock13%0%28accepted challenger=heldSince October 2026: 13% → 13%, ±0 points. Inside the 11-point floor: within noise.13% → 13%05
Kobalt.io7%0%16accepted challenger▲+5Since October 2026: 2% → 7%, +5 points. Inside the 11-point floor: within noise.2% → 7%
Kobalt.io7%0%16accepted challenger▲+5Since October 2026: 2% → 7%, +5 points. Inside the 11-point floor: within noise.2% → 7%06
Bright Defense7%0%10accepted challenger▼−10Since October 2026: 17% → 7%, −10 points. Inside the 11-point floor: within noise.17% → 7%
Bright Defense7%0%10accepted challenger▼−10Since October 2026: 17% → 7%, −10 points. Inside the 11-point floor: within noise.17% → 7%Show the two products at 0%, ordered by negative rate
07
Intruder0%0%18accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Intruder0%0%18accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%08Raxis0%0%10accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to headHead-to-head pages are published for mid-market buyers, so these open on mid-market figures, not small business.
All twenty-eight head-to-head pages: the top eight products, each against each
Cobalt vs NetSPICobalt vs Bishop FoxCobalt vs IntruderCobalt vs RaxisAstra Security vs BreachLockAstra Security vs StingraiAstra Security vs NetSPIAstra Security vs Bishop FoxAstra Security vs IntruderAstra Security vs RaxisBreachLock vs StingraiBreachLock vs NetSPIBreachLock vs Bishop FoxBreachLock vs IntruderBreachLock vs RaxisStingrai vs NetSPIStingrai vs Bishop FoxStingrai vs IntruderStingrai vs RaxisNetSPI vs Bishop FoxNetSPI vs IntruderNetSPI vs RaxisBishop Fox vs IntruderBishop Fox vs RaxisIntruder vs Raxis
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
01020304050607R08
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01Stingrai22%
Stingrai22%02Astra Security17%
Astra Security17%03Cobalt13%
Cobalt13%04BreachLock13%
BreachLock13%05Kobalt.io7%
Kobalt.io7%06Bright Defense7%
Bright Defense7%07Intruder0%
Intruder0%08Raxis0%
What they warned about
Three of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.20, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Tenable Nessus67%
6 of 9 labels negative · 5 of 14 models
“Some low-cost vendors run an automated tool (like Nessus, Qualys, or Burp Suite) and hand you a 50-page PDF of raw scan results, calling it a "pen test."” Gemini 3.5 Flash, scale prompt
Bishop Fox80%
4 of 5 labels negative · 3 of 14 models · 1 hard negative
“Avoid for Small B2B” DeepSeek V4 Flash, direct prompt
NetSPI60%
3 of 5 labels negative · 3 of 14 models · 1 hard negative
“Avoid for Small B2B” DeepSeek V4 Flash, direct prompt
OpenVAS100%
3 of 3 labels negative · 3 of 14 models
“A vendor runs an automated tool (like Nessus, Qualys, or OpenVAS) ... Why Avoid It: A vulnerability scan is not a penetration test.” Gemini 3.5 Flash, negative prompt
What they cite
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.
Sites the answers cite
73 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 772 links across 231 sites, every framing counted. Ranked by the number of answers carrying the site or page. 11 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Stingrai44 answers · 81 citations · 12 models
vendor site · Atlant Security29 answers · 34 citations · 12 models
27 answers · 40 citations · 11 models
20 answers · 22 citations · 7 models
vendor site · Netragard15 answers · 16 citations · 9 models
vendor site · Cobalt14 answers · 29 citations · 8 models
vendor site · DeepStrike13 answers · 17 citations · 7 models
13 answers · 13 citations · 7 models
vendor site · Synack11 answers · 13 citations · 6 models
vendor site · UnderDefense11 answers · 13 citations · 5 models
10 answers · 22 citations · 7 models
vendor site · G210 answers · 15 citations · 7 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
32 answers · 10 models
30 answers · 10 models
26 answers · 12 models
18 answers · 7 models
12 answers · 6 models
11 answers · 8 models
11 answers · 7 models
10 answers · 6 models
10 answers · 4 models
9 answers · 8 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best penetration testing service”, “penetration testing service”, “penetration testing services”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Stingrai stingrai.io | 22% | 53 | 201,000 | 23,274 | 70 | |||
| Astra getastra.com Astra Security 17% | 17% | 85 | 590 | 20 | 60,832 company | $17,489 | 75 | 5 |
| Cobalt cobalt.io | 13% | 127 | 135,000 | 27,732 | 23,655 | 14 | ||
| BreachLock breachlock.com | 13% | 81 | 590 | 6 | 2,479 | 22 | ||
| Kobalt.io kobalt.io | 7% | 20 | ||||||
| Bright Defense brightdefense.com | 7% | 13 | 110 | 100 | 45,507 | |||
| TurboPentest turbopentest.com | 7% | 12 | ||||||
| Pentest People pentest.fyi Pentest-Tools.com 4%, Pentest People 2% | 7% | 10 | 110 | 0 | 287 | |||
| Atlant Security atlantsecurity.com | 2% | 7 | ||||||
| Vonahi vonahi.io Vonahi Security vPenTest 2% | 2% | 12 |
Google's top ten for the three searches hold 22 sites; 3 of them are among the sites the models cited here (getastra.com, reddit.com, synack.com). The first result for “best penetration testing service” is reddit.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best penetration testing service for a small B2B company?”Paraphrase“Which pentest-as-a-service provider would you recommend to a small business that sells to other businesses?”Comparative“What are the top penetration testing services for a small team and how do they differ?”Budget-constrained“What is the best penetration testing service for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a penetration testing service. What should we look at?”Negative“Which penetration testing services should a small business avoid or be cautious about?”
Claude Haiku 4.5TraceSecurityBreachLockChangedBeagle Securityno first choiceno first choicenothing named
Five alternatives
Bright Defense, Cobalt, Packetlabs, Software Secured, VulnVoyagerTwo alternatives
Bugcrowd PTaaS, Pentest-Tools.comFive alternatives
Atlant Security, Cobalt, Intruder, Packetlabs, TraceSecurityGPT-5.4 miniCobaltAstra SecurityChangedCobaltCobaltno first choicenothing named
Three alternatives
Astra Security, HackerOne PTaaS, OneleetThree alternatives
Cobalt, HackerOne PTaaS, SynackFour alternatives
Bugcrowd PTaaS, ImmuniWeb, Rapid7, SynackTwo alternatives
Bugcrowd PTaaS, HackerOne PTaaSGemini 3.5 FlashAstra Security, BreachLockCobaltChangedCobaltBreachLockagainst: Mandiant, NetSPIno first choiceagainst: Burp Suite, Qualys, Tenable Nessusagainst: Fiverr, OpenVAS, Qualys, Tenable Nessus, Upwork
Three alternatives
Bright Defense, Cobalt, Software SecuredFour alternatives
Astra Security, BreachLock, Horizon3.ai NodeZero, Sprocket SecurityFour alternatives
Astra Security, BreachLock, HackerOne PTaaS, StingraiFour alternatives
Astra Security, Intruder, Pentest-Tools.com, Vonahi Security vPenTestPerplexity SonarBright DefenseCobaltChangedAstra Securityagainst: Bishop Fox, Bugcrowd PTaaS, HackerOne PTaaS, NetSPIBright Defenseno first choicenothing named
Five alternatives
Astra Security, Cobalt, Packetlabs, Raxis, Software SecuredOne alternative
Astra SecuritySix alternatives
BreachLock, Bright Defense, Cobalt, Intruder, Packetlabs, RaxisThree alternatives
Astra Security, Atlant Security, BreachLockGrok 4.20Astra Securityagainst: Bishop Fox, Black Hills Information SecurityCobaltChangedAstra Securityagainst: Bishop Fox, Rapid7TurboPentestno first choiceagainst: OpenVAS, Tenable Nessus
Four alternatives
BreachLock, Cobalt, Cybri, StingraiFour alternatives
Astra Security, BreachLock, Bugcrowd PTaaS, SynackFour alternatives
Acunetix, BreachLock, Cobalt, IntruderTwo alternatives
Astra Security, HIFENCEMistral SmallAtlant Security, StingraiCobaltChangedAstra Security, StingraiStingraino first choiceagainst: Tenable Nessus
Four alternatives
Astra Security, Packetlabs, Raxis, SecarmaTwo alternatives
Kobalt.io, StingraiThree alternatives
BreachLock, Cobalt, SecurityMetricsThree alternatives
HIFENCE, Kobalt.io, Triaxiom SecurityDeepSeek V4 FlashKobalt.io, Stingraiagainst: Bishop Fox, Cobalt, HackerOne PTaaS, NCC Group, NetSPI, Rapid7, SynackBreachLockChangedagainst: CobaltAstra Securityagainst: Traditional ConsultanciesBreachLock, Stingraino first choicenothing named
Two alternatives
BreachLock, Software SecuredTwo alternatives
Astra Security, IntruderFour alternatives
Beagle Security, BreachLock, Cobalt, IntruderTwo alternatives
Defense.com, Target DefenseLlama 4 MaverickStingraiBreachLockChangedno first choiceno first choiceno first choicenothing named
Qwen 3.7 FlashStingraiagainst: MandiantPentest PeopleChangedSherlock Forensics, Stingraiagainst: Deloitte, MandiantStingraiagainst: Accenture, Kroll, Pentest-Tools.comno first choiceagainst: Qualys, Tenable Nessusnothing named
Four alternatives
Atlant Security, BreachLock, Cobalt, NetragardTwo alternatives
SecureLeap, StingraiFour alternatives
Astra Security, Bishop Fox, BreachLock, CobaltFive alternatives
Astra Security, Cobalt, HackerOne PTaaS, PurpleSec, RaxisKimi K2Astra SecurityAstra SecurityHeldagainst: Bugcrowd PTaaS, Cobalt, SynackCobaltno first choiceno first choiceagainst: OpenVAS, Qualys, Tenable Nessus
Six alternatives
BreachLock, Bug Circuit, Cobalt, Cybri, Intruder, TurboPentestTwo alternatives
Intruder, StingraiFour alternatives
Astra Security, BreachLock, Intruder, StingraiGLM 4.7 FlashXAstra SecurityTurboPentestChangedAstra Security, Cobaltagainst: NetragardPentest-Tools.com, TurboPentestno first choicenothing named
Four alternatives
BreachLock, Cobalt, Stingrai, TurboPentestTwo alternatives
Astra Security, Penti.aiSix alternatives
BreachLock, Intruder, Kobalt.io, Sherlock Forensics, Stingrai, penetrationtestingvendor.comSeven alternatives
Atlant Security, CheckBox Penetration Testing, Cobalt, Kobalt.io, Penetrify, Raxis, StingraiMiniMax M2.5Astra Security, Bright DefenseAstra SecurityChangedno first choicePentest-Tools.com, Vonahi Security vPenTestno first choicenothing named
Three alternatives
Acunetix, Cobalt, IntruderThree alternatives
Cobalt, Intruder, Security MetricsTwo alternatives
Cobalt, StingraiGPT-6 LunaKobalt.ioKobalt.ioHeldAstra SecurityAWS Continuum for penetration testingno first choicenothing named
One alternative
CobaltOne alternative
CobaltThree alternatives
Bugcrowd PTaaS, Cobalt, HackerOne PTaaSTwo alternatives
Cobalt, Pensure Core PlusMuse Glimmer 30BStingraiStingraiHeldStingraiStingraino first choicenothing named
Five alternatives
Acunetix, Astra Security, BreachLock, Cobalt, Kobalt.ioTwo alternatives
Cobalt, TurboPentestFour alternatives
Acunetix, Astra Security, BreachLock, HIFENCEThree alternatives
Affordable Pentesting, Target Defense, TurboPentestBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 14:48 | yes | 10 | 8 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 14:22 | yes | 1 | 6 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 10:57 | yes | 11 | 16 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-11-01 09:32 | yes | 10 | 4 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 19:26 | yes | 5 | 8 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 16:47 | yes | 5 | 5 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 09:47 | yes | 22 | 28 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 13:47 | yes | 5 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 12:14 | yes | 5 | 27 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 10:59 | yes | 15 | 39 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 16:36 | yes | 14 | 22 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 19:05 | yes | 5 | 27 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:34 | yes | 3 | 16 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 08:48 | yes | 13 | 21 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 14:51 | yes | 9 | 8 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 19:17 | yes | 4 | 4 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 10:05 | no | 0 | 16 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-11-01 12:22 | yes | 10 | 4 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 19:12 | yes | 5 | 7 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 17:11 | yes | 5 | 6 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 11:17 | yes | 24 | 19 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 12:26 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 14:16 | yes | 5 | 21 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 17:16 | yes | 14 | 43 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 19:20 | yes | 22 | 31 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:17 | yes | 20 | 33 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-11-01 11:41 | yes | 2 | 15 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 15:11 | yes | 14 | 19 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 16:13 | yes | 10 | 9 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 10:00 | yes | 5 | 8 s |
| Comparative | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 14:59 | yes | 13 | 30 s |
| Comparative | Perplexity Sonar | sonar | 2026-11-01 12:57 | yes | 10 | 7 s |
| Comparative | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:27 | yes | 5 | 18 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 10:09 | yes | 5 | 7 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 16:30 | yes | 25 | 39 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 18:18 | yes | 5 | 3 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 15:27 | yes | 5 | 26 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 09:46 | yes | 20 | 31 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 09:40 | yes | 23 | 70 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 10:29 | yes | 25 | 33 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-11-01 14:49 | yes | 5 | 22 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 12:08 | yes | 15 | 31 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 11:54 | no | 0 | 4 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 19:03 | yes | 4 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 18:47 | yes | 8 | 18 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-11-01 17:56 | yes | 10 | 4 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 14:00 | yes | 5 | 11 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 17:08 | yes | 5 | 5 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 11:16 | yes | 18 | 23 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 13:11 | yes | 5 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 18:18 | yes | 20 | 64 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 17:08 | yes | 19 | 18 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 11:11 | yes | 10 | 43 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 08:57 | yes | 5 | 45 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 14:23 | yes | 2 | 20 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 15:55 | yes | 14 | 20 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:24 | no | 0 | 6 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 10:57 | no | 0 | 6 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 10:48 | no | 0 | 15 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-11-01 08:53 | yes | 10 | 6 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 19:06 | yes | 5 | 42 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 13:08 | no | 0 | 6 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 10:31 | yes | 20 | 26 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 17:47 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 08:36 | yes | 10 | 28 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 17:13 | no | 0 | 53 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 14:35 | yes | 8 | 130 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:02 | no | 0 | 27 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:43 | yes | 5 | 16 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 12:52 | yes | 15 | 17 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 11:03 | yes | 18 | 11 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 13:22 | no | 0 | 4 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 13:12 | no | 0 | 17 s |
| Negative framing | Perplexity Sonar | sonar | 2026-11-01 16:02 | yes | 10 | 5 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 15:27 | yes | 5 | 14 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 11:16 | yes | 5 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 10:50 | yes | 22 | 41 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 10:23 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 10:52 | yes | 5 | 22 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 11:54 | yes | 25 | 31 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 08:40 | yes | 23 | 80 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 13:38 | no | 0 | 27 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-11-01 10:02 | yes | 4 | 9 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 16:09 | yes | 13 | 23 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Astra read as Astra Security
Bugcrowd read as Bugcrowd PTaaS
HackerOne read as HackerOne PTaaS
HackerOne Pentest read as HackerOne PTaaS
Horizon3.ai read as Horizon3.ai NodeZero
Horizon3.ai (NodeZero) read as Horizon3.ai NodeZero
Vonahi read as Vonahi Security vPenTest
Vonahi Security read as Vonahi Security vPenTest
Vonahi Security (vPenTest) read as Vonahi Security vPenTest
Unresolved, counted raw
AWS Continuum for penetration testing
Burp Pro
CREST's Marketplace
Central InfoSec
CheckBox Penetration Testing
Core Impact
Cyberware
Den Secure
HackerOne or Bugcrowd
Kali Linux
Meta Defence Labs
Packet Labs
Penetrify
Pensure Core Plus
Pentest People
Penti.ai
PurpleSec or Defendify
Raxis or Triaxiom Security
Red Seer
Red Team Partners
SecureLeap
SecureTeam
Security Metrics
StealthNet AI
Traditional Consultancies (e.g., boutique firms)
Truvantis
VulnVoyager
penetrationtestingvendor.com
Discontinued, still offered
No shut-down product was recommended here.