# Penetration testing as a service for enterprise buyers: what AI models recommend, September 2026

IT AI Recommendation Index, September 2026 Edition. Asked as "penetration testing service" and as "pentest-as-a-service provider", six framings each, to twelve models with search on, on behalf of an enterprise B2B company. Page: https://it-ai-index.com/security/penetration-testing-as-a-service/enterprise/

**Standing:** NetSPI leads with 40% of first choices; verdict contested. 48 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | NetSPI | 40% | 0% | 36 |
| 2 | Synack | 23% | 0% | 42 |
| 3 | Cobalt | 15% | 6% | 35 |
| 4 | Bishop Fox | 4% | 7% | 27 |
| 5 | BreachLock | 4% | 0% | 13 |
| 6 | HackerOne | 4% | 14% | 21 |
| 7 | NCC Group | 2% | 6% | 17 |
| 8 | Mandiant | 0% | 0% | 13 |
| 9 | Bugcrowd | 0% | 25% | 12 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: NetSPI; alternatives BreachLock, NCC Group, Synack
- GPT-5.4 mini: NetSPI; alternatives BreachLock, Horizon3.ai NodeZero, Pentera, UnderDefense
- Gemini 3.5 Flash: NetSPI; alternatives Bishop Fox, BreachLock, Cobalt, Synack
- Perplexity Sonar: NetSPI; alternatives AppSecure Security, Bishop Fox, Cobalt, Mandiant
- Grok 4.1 Fast: Bishop Fox, NetSPI; alternatives Mandiant, NCC Group, Synack
- Mistral Small: Deloitte, Terra Security; alternatives Astra Security
- DeepSeek V4 Flash: Bishop Fox, NetSPI; alternatives Coalfire, Synack
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Cobalt, Synack; alternatives Bishop Fox, Secops, Trustwave, VerSprite
- Kimi K2: Cobalt, Synack; alternatives Bishop Fox, HackerOne, NCC Group, NetSPI
- GLM 4.7 FlashX: NetSPI; alternatives Astra Security, Bishop Fox, Cobalt, Synack
- MiniMax M2.5: NCC Group; alternatives Bugcrowd, Deloitte, EY, IBM X-Force

## Sources the answers cite

64 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- deepstrike.io: 40 answers, 78 citations
- synack.com: 40 answers, 58 citations
- stingrai.io: 29 answers, 46 citations
- underdefense.com: 25 answers, 27 citations
- cybri.com: 24 answers, 30 citations
- softwaresecured.com: 21 answers, 27 citations
- getastra.com: 15 answers, 17 citations
- brightdefense.com: 14 answers, 17 citations

Pages named in the most answers:

- https://synack.com/blog/best-penetration-testing-companies (29 answers)
- https://underdefense.com/blog/penetration-testing-services (25 answers)
- https://softwaresecured.com/post/top-10-penetration-testing-vendors (18 answers)
- https://cybri.com/blog/best-penetration-testing-vendors (17 answers)
- https://techrepublic.com/article/best-penetration-testing-companies (14 answers)
- https://deepstrike.io/blog/top-penetration-testing-as-a-service-ptaas (13 answers)
- https://redbotsecurity.com/penetration-testing-companies (13 answers)
- https://deepstrike.io/blog/top-penetration-testing-companies (12 answers)
- https://terra.security/blog/top-10-penetration-testing-as-a-service-ptaas-providers (12 answers)
- https://lorikeetsecurity.com/blog/top-10-pentesting-companies-2026 (11 answers)

## Warned against

- Bugcrowd: 3 of 12 labels negative. "Avoid pure crowdsourced (HackerOne/Bugcrowd) due to variable bounties/credits" (Grok 4.1 Fast, budget prompt)
- Bishop Fox: 2 of 27 labels negative. "What to Avoid for Predictable Cost ... Costs scale unpredictably as scope expands." (DeepSeek V4 Flash, budget prompt)
- HackerOne: 3 of 21 labels negative. "Avoid pure crowdsourced (HackerOne/Bugcrowd) due to variable bounties/credits" (Grok 4.1 Fast, budget prompt)
- AttackIQ Flex: 1 of 1 labels negative. "avoid pure pay-as-you-go services like AttackIQ Flex unless your testing volume is tightly controlled" (GPT-5.4 mini, budget prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.