# Cobalt vs UnderDefense: which do AI models recommend for ptaas, October 2026

IT AI Recommendation Index, October 2026 Edition, Penetration testing as a service. Nine of fourteen models named Cobalt first on the direct prompt; two named UnderDefense. Page: https://it-ai-index.com/security/penetration-testing-as-a-service/cobalt-vs-underdefense/

| | First-choice share | Rank | Negative rate | Labels | Models naming it |
|---|---|---|---|---|---|
| Cobalt | 45% | #1 of 10 | 2% | 41 | 14 of 14 |
| UnderDefense | 4% | #5 of 10 | 0% | 11 | 7 of 14 |

## The direct prompt, model by model

- GLM 4.7 FlashX: both first (first choices: Cobalt, UnderDefense) (alternatives: BreachLock, NetSPI, Packetlabs)
- Claude Haiku 4.5: cobalt first (first choices: BreachLock, Cobalt) (alternatives: Packetlabs, Raxis, Stingrai)
- GPT-5.4 mini: cobalt first (first choices: Cobalt) (alternatives: Cognisys, Trava Security)
- Gemini 3.5 Flash: cobalt first (first choices: Cobalt) (alternatives: BreachLock, NetSPI, UnderDefense)
- Mistral Small: cobalt first (first choices: BreachLock, Cobalt) (alternatives: NetSPI, Stingrai, Synack)
- DeepSeek V4 Flash: cobalt first (first choices: Cobalt, Raxis) (alternatives: BreachLock, Packetlabs, UnderDefense)
- Kimi K2: cobalt first (first choices: Cobalt) (alternatives: BreachLock, Coalfire, Praetorian)
- GPT-6 Luna: cobalt first (first choices: Cobalt) (alternatives: Bishop Fox, NetSPI)
- Muse Glimmer 30B: cobalt first (first choices: Cobalt) (alternatives: Astra Security, HackerOne, Netragard, Red Siege, UnderDefense)
- MiniMax M2.5: underdefense first (first choices: BreachLock, UnderDefense) (alternatives: Raxis, Synack)
- Perplexity Sonar: neither first, one named (first choices: BreachLock) (alternatives: Cobalt, Raxis, Stingrai)
- Grok 4.1 Fast: neither named (first choices: BreachLock) (alternatives: Bright Defense, NetSPI, Packetlabs, Prescient Security)
- Llama 4 Maverick: neither named
- Qwen 3.7 Flash: neither named (first choices: Red Siege Security) (alternatives: Astra Security, BreachLock, Lumina.io, Netragard)

## What the models said about Cobalt

- "crowdsourced like HackerOne/Cobalt work for speed but less for deep compliance" (Grok 4.1 Fast, direct prompt, soft negative)
- "I would recommend considering Cobalt or Software Secured, as they are specifically highlighted as top choices for mid-market organizations" (Qwen 3.7 Flash, paraphrase prompt, first choice)
- "For Growing Tech Companies: Go with Cobalt. The ability to run frequent tests on your API and web app helps you ship faster" (Qwen 3.7 Flash, comparative prompt, first choice)
- "For compliance-driven mid-market: Cobalt, Packetlabs, or BreachLock are the most frequently recommended choices." (Claude Haiku 4.5, direct prompt, first choice)

## What the models said about UnderDefense

- "I'd recommend BreachLock or UnderDefense as they specifically target mid-market companies" (MiniMax M2.5, direct prompt, first choice)
- "UnderDefense or Cobalt offer the best balance of pricing, quality, and scalability" (GLM 4.7 FlashX, direct prompt, first choice)

Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all fourteen models, for a mid-market B2B company; rank is within the category. Comparisons are drawn for the top eight products in each category. Published under CC BY 4.0; the output is the models' output, and nothing here is a recommendation by the index.