# Penetration testing as a service: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "penetration testing service" and as "pentest-as-a-service provider", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/penetration-testing-as-a-service

**Standing:** Cobalt leads with 46% of first choices; verdict clear leader. 50 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cobalt](https://www.gane.ai/index/it/vendors/cobalt/index.md) | 46% | 0% | 47 |
| 2 | [Astra Security](https://www.gane.ai/index/it/vendors/astra-security/index.md) | 16% | 0% | 24 |
| 3 | [BreachLock](https://www.gane.ai/index/it/vendors/breachlock/index.md) | 10% | 0% | 36 |
| 4 | [Stingrai](https://www.gane.ai/index/it/vendors/stingrai/index.md) | 6% | 0% | 17 |
| 6 | [NetSPI](https://www.gane.ai/index/it/vendors/netspi/index.md) | 4% | 9% | 22 |
| 7 | [Bishop Fox](https://www.gane.ai/index/it/vendors/bishop-fox/index.md) | 2% | 8% | 13 |
| 8 | [Intruder](https://www.gane.ai/index/it/vendors/intruder/index.md) | 2% | 15% | 13 |
| 9 | [Raxis](https://www.gane.ai/index/it/vendors/raxis/index.md) | 2% | 0% | 10 |
| 13 | [Synack](https://www.gane.ai/index/it/vendors/synack/index.md) | 0% | 5% | 19 |
| 14 | [Rapid7](https://www.gane.ai/index/it/vendors/rapid7/index.md) | 0% | 9% | 22 |
| 15 | [HackerOne PTaaS](https://www.gane.ai/index/it/vendors/hackerone-ptaas/index.md) | 0% | 15% | 13 |
| 19 | [Bugcrowd PTaaS](https://www.gane.ai/index/it/vendors/bugcrowd-ptaas/index.md) | 0% | 18% | 11 |

Rank is by share of first choices among all 117 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: NetSPI; alternatives Appsecco, Cobalt, HackerOne PTaaS, Packetlabs
- Gemini 3.5 Flash: Cobalt; alternatives BreachLock, NetSPI, Synack
- Perplexity Sonar: Cobalt; alternatives Coalfire, NetSPI, Raxis, Stingrai
- Grok 4.20: BreachLock; alternatives Cobalt, Rapid7
- Mistral Small: Cobalt; alternatives BreachLock, NetSPI, Stingrai
- DeepSeek V4 Flash: BreachLock, Cobalt; alternatives Baker Tilly, Cherry Bekaert, RSM, Rapid7
- Llama 4 Maverick: Cobalt
- Qwen 3.7 Flash: Bishop Fox, Cobalt; alternatives HackerOne PTaaS, Lattice Security, NCC Group, Secureworks
- Kimi K2: BreachLock, Cobalt; alternatives Stingrai
- GLM 4.7 FlashX: Astra Security; alternatives Blaze InfoSec, Cobalt, SecurityMetrics
- MiniMax M2.5: Astra Security; alternatives BreachLock, Cobalt, Intruder, Stingrai
- GPT-6 Luna: Cobalt; alternatives Bishop Fox, NetSPI
- Muse Glimmer 30B: Cobalt; alternatives BreachLock, Bugcrowd PTaaS, HackerOne PTaaS, NetSPI

## Sources the answers cite

67 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- stingrai.io: 28 answers, 50 citations
- netragard.com: 19 answers, 22 citations
- synack.com: 17 answers, 27 citations
- deepstrike.io: 17 answers, 21 citations
- hackernoon.com: 15 answers, 15 citations
- softwaretestinghelp.com: 15 answers, 15 citations
- atlantsecurity.com: 14 answers, 15 citations
- reddit.com: 13 answers, 26 citations

Pages named in the most answers:

- https://hackernoon.com/penetration-testing-companies-comparing-the-top-5-vendors (15 answers)
- https://atlantsecurity.com/blog/top-penetration-testing-companies (14 answers)
- https://stingrai.io/blog/best-penetration-testing-companies-mid-market-2026 (14 answers)
- https://techrepublic.com/article/best-penetration-testing-companies (13 answers)
- https://netragard.com/blog/5-things-look-for-penetration-testing-company (12 answers)
- https://msppentesting.com/blog-posts/best-penetration-testing-companies (11 answers)
- https://clutch.co/it-services/cybersecurity/penetration-testing (9 answers)
- https://softwaretestinghelp.com/top-pen-testing-as-a-service-providers (9 answers)
- https://underdefense.com/blog/penetration-testing-services (9 answers)
- https://7asecurity.com/blog/2026/08/how-to-interview-a-penetration-testing-company (7 answers)

## Warned against

- Bugcrowd PTaaS: 2 of 11 labels negative. "What to Avoid - Synack/Bugcrowd/HackerOne" (Kimi K2, paraphrase prompt)
- HackerOne PTaaS: 2 of 13 labels negative. "What to Avoid - Synack/Bugcrowd/HackerOne" (Kimi K2, paraphrase prompt)
- Acunetix: 2 of 7 labels negative. "Do you only want an automated scan (like Intruder or Acunetix)? *Warning: ... requires a provider that includes manual hacking.*" (Qwen 3.7 Flash, paraphrase prompt)
- Intruder: 2 of 13 labels negative. "Do you only want an automated scan (like Intruder or Acunetix)? *Warning: For true B2B credibility, you almost always need human-exploitable proof*" (Qwen 3.7 Flash, paraphrase prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Cobalt at 46%.

- Astra Security: 4% to 16%, +12. Cleared the floor by 1 point · rank 4 → 2 of 117.
- BreachLock: 19% to 10%, −9. Inside the floor by 2 points · rank 2 → 3 of 117.
- Stingrai: 0% to 6%, +6. Inside the floor by 5 points · rank 24 → 4 of 117.
- NetSPI: 0% to 4%, +4. Inside the floor by 7 points · rank 17 → 6 of 117.
- Synack: 4% to 0%, −4. Inside the floor by 7 points · rank 3 → 13 of 117.
- UnderDefense: 4% to 0%, −4. Inside the floor by 7 points · rank 5 → 33 of 117.
- Bishop Fox: 0% to 2%, +2. Inside the floor by 9 points · rank 18 → 7 of 117.
- HackerOne PTaaS: 2% to 0%, −2. Inside the floor by 9 points · rank 6 → 15 of 117.
- Bugcrowd PTaaS: 2% to 0%, −2. Inside the floor by 9 points · rank 8 → 19 of 117.
- Cobalt: 45% to 46%, +1. Inside the floor by 10 points · rank 1 of 117, unchanged.
- Intruder: 2% to 2%, ±0. Inside the floor by 11 points · rank 12 → 8 of 117.
- Raxis: 2% to 2%, ±0. Inside the floor by 11 points · rank 7 → 9 of 117.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.