# Cobalt: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 47 judge labels across 1 category by 14 of 14 models. Page: https://www.gane.ai/index/it/vendors/cobalt

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Penetration testing as a service](https://www.gane.ai/index/it/security/penetration-testing-as-a-service/index.md) | 46% | 1 | 0% | 47 |

## What the models said for it

- "Known for pioneer PTaaS delivery. Cobalt connects customers with a vetted network of certified testers (the Cobalt Core) via a modern platform." (Gemini 3.5 Flash, PTaaS)
- "For most mid-market B2B companies, Cobalt and BreachLock tend to offer the strongest combination of quality, speed, and value." (DeepSeek V4 Flash, PTaaS)
- "Cobalt.io and Astra Security are top recommendations due to their scalability, compliance support, and ease of use" (Mistral Small, PTaaS)
- "PTaaS platforms like Cobalt or BreachLock offer the best balance of quality, ongoing coverage, and retesting flexibility" (MiniMax M2.5, PTaaS)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 1 | 1 | 0 | 0 | 2 |
| GPT-5.4 mini | 0 | 1 | 0 | 0 | 1 |
| Gemini 3.5 Flash | 3 | 1 | 1 | 0 | 5 |
| Perplexity Sonar | 2 | 1 | 0 | 0 | 3 |
| Grok 4.20 | 0 | 3 | 1 | 0 | 4 |
| Mistral Small | 2 | 1 | 0 | 0 | 3 |
| DeepSeek V4 Flash | 2 | 1 | 0 | 0 | 3 |
| Llama 4 Maverick | 2 | 0 | 2 | 0 | 4 |
| Qwen 3.7 Flash | 3 | 1 | 0 | 0 | 4 |
| Kimi K2 | 4 | 0 | 0 | 0 | 4 |
| GLM 4.7 FlashX | 1 | 1 | 1 | 0 | 3 |
| MiniMax M2.5 | 2 | 1 | 0 | 0 | 3 |
| GPT-6 Luna | 2 | 2 | 0 | 0 | 4 |
| Muse Glimmer 30B | 2 | 1 | 1 | 0 | 4 |

## Sources returned with these answers

The sites and pages cited by the answers that named Cobalt, from 127 of the 139 answers that named it (only the models that return a source list).

### Domains cited

- stingrai.io: 67
- atlantsecurity.com: 43
- techrepublic.com: 42
- synack.com: 41
- cobalt.io: 30 (its own site)
- softwaretestinghelp.com: 25
- clutch.co: 24
- reddit.com: 23
- cybri.com: 22
- cloudsecuritypartners.com: 21

### Pages cited

- https://techrepublic.com/article/best-penetration-testing-companies: 41
- https://atlantsecurity.com/blog/top-penetration-testing-companies: 37
- https://stingrai.io/blog/best-penetration-testing-companies-startups-2026: 27
- https://clutch.co/it-services/cybersecurity/penetration-testing: 24
- https://cobalt.io/platform/pricing: 24
- https://msppentesting.com/blog-posts/best-penetration-testing-companies: 21
- https://stingrai.io/blog/best-penetration-testing-companies-small-businesses-2026: 21
- https://cloudsecuritypartners.com/blog/best-penetration-testing-companies: 20

## In its own words

What Cobalt's own pages state, read 2026-09-28. Stated by the vendor, not checked by the index.

- Positioning: Offensive security services from human-led to autonomous pentesting. (https://cobalt.io/)
- For: Small businesses, Enterprises, Developers, Security Analysts, Technology Architects, Software Managers (https://cobalt.io/)
- Price stated: Explore the flexible Cobalt credit model that scales to your needs (https://www.cobalt.io/platform)
- Integrations claimed: 50 (https://cobalt.io/)
- Certifications: SOC 2, ISO 27001, HIPAA, PCI DSS
- Hosting: USA, EU
- Customers named: Personio, Smarsh, Snow Software, Dropbox, Toast, Pendo, Sentara Healthcare, Aircall

## What it publishes

Every page cobalt.io exposes, read 2026-09-29: 1678 addresses. By kind, pages and the last 90 days:

- blog: 696 pages, 16 in the last 90 days, latest 2026-09-24
- case study: 34 pages, 1 in the last 90 days, latest 2026-09-17
- webinar or virtual event: 110 pages, 0 in the last 90 days, latest 2025-12-10
- conference or event: 22 pages, 0 in the last 90 days, latest 2026-03-09
- report or ebook: 2 pages, 0 in the last 90 days, latest undated
- comparison: 19 pages, 0 in the last 90 days, latest 2025-12-16
- template or tool: 8 pages, 0 in the last 90 days, latest 2026-06-26
- glossary or explainer: 32 pages, 0 in the last 90 days, latest 2026-05-13
- podcast or video: 2 pages, 0 in the last 90 days, latest 2025-08-29
- news or press: 237 pages, 3 in the last 90 days, latest 2026-09-02
- Recent: 2026-09-24 blog: Automated agentic autonomous the ai pentesting vocabulary problem https://www.cobalt.io/blog/automated-agentic-autonomous-the-ai-pentesting-vocabulary-problem
- Recent: 2026-09-17 blog: From internet exposure to operational disruption a red team view of connected infrastructure https://www.cobalt.io/blog/from-internet-exposure-to-operational-disruption-a-red-team-view-of-connected-infrastructure
- Recent: 2026-09-17 case study: Case study how a bracket bypassed a denylist and exposed a database password https://www.cobalt.io/blog/case-study-how-a-bracket-bypassed-a-denylist-and-exposed-a-database-password
- Recent: 2026-09-16 blog: How cobalt brings real time exploit and threat intelligence to vulnerability findings https://www.cobalt.io/blog/how-cobalt-brings-real-time-exploit-and-threat-intelligence-to-vulnerability-findings
- Recent: 2026-09-15 blog: Pentester spotlight edu garcia https://www.cobalt.io/blog/pentester-spotlight-edu-garcia
- Recent: 2026-09-02 news or press: Cobalt recognized for fourth consecutive year in three gartner hype cycle reports https://www.cobalt.io/press-release/cobalt-recognized-for-fourth-consecutive-year-in-three-gartner-hype-cycle-reports

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.