Penetration testing as a service · RankedCobalt
Cobalt is a penetration testing as a service platform offering offensive security services, from human-led to autonomous pentesting · cobalt.io ↗
Leads at mid-market. Ranked 3 of 98 for enterprise buyers.
The standing depends on who is buying. Every model is asked the same questions for each company size.
Stingrai is first at 22%.
Ranked first. Next is Astra Security at 16%. 9 of 14 models made it the first choice when asked directly.
NetSPI is first at 30%.
Why models recommend it
“Known for pioneer PTaaS delivery. Cobalt connects customers with a vetted network of certified testers (the Cobalt Core) via a modern platform.”Gemini 3.5 Flash · Comparative question · first choice
“For most mid-market B2B companies, Cobalt and BreachLock tend to offer the strongest combination of quality, speed, and value.”DeepSeek V4 Flash · Direct question · first choice
“Cobalt.io and Astra Security are top recommendations due to their scalability, compliance support, and ease of use”Mistral Small · Paraphrase question · first choice
“PTaaS platforms like Cobalt or BreachLock offer the best balance of quality, ongoing coverage, and retesting flexibility”MiniMax M2.5 · Comparative question · first choice
What gives them pause
No model argued against it.
Also on the shortlist
The products named in the same answers as Cobalt, over the 139 answers that named it, and how often each was the first choice instead.
| Product | Named together | Picked instead | |
|---|---|---|---|
| 70 | 6 | Compare → | |
| 63 | 6 | View → | |
| 58 | 19 | Compare → | |
| 56 | 20 | Compare → | |
| 42 | 11 | Compare → | |
| 42 | 5 | Compare → | |
| 38 | 0 | View → | |
| 35 | 1 | View → | |
| 33 | 0 | Compare → | |
| 29 | 3 | View → |
What the models named instead of Cobalt →
A side-by-side page exists where both products are among a category's top eight.
At a glance
Stated on Cobalt's own site, not checked by Gane.
- For
- Small businesses, Enterprises, Developers, Security Analysts, Technology Architects, Software Managers
- Price stated
- Explore the flexible Cobalt credit model that scales to your needs
- Integrations
- 50
- Certifications
- SOC 2, ISO 27001, HIPAA, PCI DSS
- Hosting
- USA, EU
- Customers named
- Personio, Smarsh, Snow Software, Dropbox, Toast, Pendo, Sentara Healthcare, Aircall
How this is measured
Fourteen AI models from 12 labs are asked the same buying questions six ways, for three company sizes. Standings refresh every edition.
Gane sells AI visibility software. No company can pay to change a result.
Read the method →Sources returned with these answers
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted. These counts come from 127 of the 139 answers that named Cobalt and are not a share of its labels.
Domains cited
308 of the 338 domain citations in answers naming Cobalt came from a third party's page.
Pages cited
Pages are listed as the models cited them.
By model
| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 1 | 1 | 0 | 0 | 2 |
| GPT-5.4 mini | 0 | 1 | 0 | 0 | 1 |
| Gemini 3.5 Flash | 3 | 1 | 1 | 0 | 5 |
| Perplexity Sonar | 2 | 1 | 0 | 0 | 3 |
| Grok 4.20 | 0 | 3 | 1 | 0 | 4 |
| Mistral Small | 2 | 1 | 0 | 0 | 3 |
| DeepSeek V4 Flash | 2 | 1 | 0 | 0 | 3 |
| Llama 4 Maverick | 2 | 0 | 2 | 0 | 4 |
| Qwen 3.7 Flash | 3 | 1 | 0 | 0 | 4 |
| Kimi K2 | 4 | 0 | 0 | 0 | 4 |
| GLM 4.7 FlashX | 1 | 1 | 1 | 0 | 3 |
| MiniMax M2.5 | 2 | 1 | 0 | 0 | 3 |
| GPT-6 Luna | 2 | 2 | 0 | 0 | 4 |
| Muse Glimmer 30B | 2 | 1 | 1 | 0 | 4 |
What it publishes
| Kind | Pages | Last 90 days | 2025-10 to 2026-09 | Latest | Categories named |
|---|---|---|---|---|---|
| Blog | 696 | 16 | 2026-09-24 | PTaaS, MFA | |
| News or press | 237 | 3 | 2026-09-02 | PTaaS | |
| Webinar or virtual event | 110 | 0 | 2025-12-10 | Compliance automation, TPRM | |
| Case study | 34 | 1 | 2026-09-17 | ||
| Glossary or explainer | 32 | 0 | 2026-05-13 | PTaaS | |
| Conference or event | 22 | 0 | 2026-03-09 | ||
| Comparison | 19 | 0 | 2025-12-16 | SAST | |
| Template or tool | 8 | 0 | 2026-06-26 | PTaaS | |
| Report or ebook | 2 | undated | |||
| Podcast or video | 2 | 0 | 2025-08-29 |
Most recent
- 2026-09-24Automated agentic autonomous the ai pentesting vocabulary problem blog
- 2026-09-17From internet exposure to operational disruption a red team view of connected infrastructure blog
- 2026-09-17Case study how a bracket bypassed a denylist and exposed a database password case study
- 2026-09-16How cobalt brings real time exploit and threat intelligence to vulnerability findings blog
- 2026-09-15Pentester spotlight edu garcia blog
- 2026-09-02Cobalt recognized for fourth consecutive year in three gartner hype cycle reports news or press
Events in person
- March 23, 2026 to March 26, 2026RSAC 2026Moscone Center, North Hall, Booth N4519, San Francisco, United States · exhibited
As the event pages on cobalt.io state them, read September 28, 2026.
How it is countedHide how it is counted
Every page cobalt.io exposes, subdomains included. Kind is read from the address and title. The last 90 days, the latest date and the twelve months count pages by when they were published, from the site's feeds, a date in the address, or the page's own publication date, read from up to a hundred of its most recently changed pages; a page that says only when it last changed is counted in its kind but not in when, so the recent counts are a floor, and a kind none of whose pages gives a publication date reads undated. An event counts as online when its address or title says so (webinar, on demand, virtual or online summit); a conference, summit, trade show, expo or roadshow that does not say so is counted as a conference or event, which on a vendor's site is mostly in person. Read September 29, 2026.