Eight dimensions, six platforms, and one rule: every marker reports what a vendor publishes, never what we think it can do.
If you resell penetration testing, the shortlist is not long. There are AI-native autonomous platforms, automated validation tools, and human-led marketplaces — and the three models are different enough that comparing them on one axis is usually dishonest.
This page compares all three anyway, because that is the choice actually in front of you. What keeps it honest is a rule we hold to everywhere the comparison appears.
Every marker describes what a vendor publishes, not what it can do.
"Not published" means we went looking through public product documentation and did not find it documented. It never means the product cannot do it. A vendor may well ship a capability it has chosen not to write up, and several here almost certainly do.
We hold to this for a plain reason: a table that asserts what a competitor cannot do is a table we would have to defend, and a table that reports what is written down is one we can stand behind. If you find a public document that contradicts a cell below, we would like to know — the correction is cheaper than the mistake.
Everything in the KinoSec column is either a shipped feature or a published number.
Four of the eight rows above are where the models genuinely separate. The other four are rows we share with the autonomous vendors, and they are left in on purpose — eight rows of unbroken checks against six columns of dashes reads as marketing fiction, and buyers discount the whole table when they see it.
This is the row that matters most if you are reselling, and it is the one where the word "white-label" is doing the most work.
Horizon3.ai documents co-branding for MSSP and partner accounts. Cobalt documents uploading a logo that is displayed on your clients' pentest reports. Both are real features, and both are co-branding — your logo is added alongside theirs.
Ours replaces the identity rather than adding to it. The report your client receives carries your brand, not ours. That is a different product decision, not a better version of the same one, and it is the difference between selling a pentest and reselling somebody else's.
XBOW, Pentera and Synack publish no statement on report branding that we found.
We score 99.04% across 104 black-box challenges. XBOW publishes 85.0% on the same benchmark — that figure comes from the head-to-head study, not from us.
The other four publish no score on this benchmark that we are aware of, which is what "not published" records. It is worth saying plainly that this is the row where the rule matters most: a human-led marketplace not publishing a benchmark score is not a failing, it is a category difference. You cannot benchmark a marketplace of people the way you benchmark an engine.
Read the benchmark methodology →
Add a client's repository to the same run and the engine reads the code as well as attacking the surface. Cobalt and Synack can do this per statement of work, which means scoping it, pricing it and scheduling it. The autonomous platforms publish no equivalent.
For a partner this is the difference between a fixed service line and one you can upsell without a new contract.
The autonomous platforms all deliver in hours. The human-led platforms schedule — that is not a defect, it is what buying human time means, and it is why they cost what they cost.
If your service line depends on turning a client request into a report the same week, the scheduling window is the constraint you are actually buying around.
Fully autonomous and proof of exploit we share with XBOW, Horizon3.ai and Pentera. Nothing ships from us unexploited — a finding without a working proof of concept is a guess, and we do not send guesses to your clients.
Perimeter to plant floor — external, web, internal network, Active Directory and OT. We cover all of it: external and web with Zeus, and internal network, Active Directory and OT with Poseidon, now generally available. Horizon3.ai and Pentera document internal coverage; XBOW is web-only per its own documentation.
Runs in your terminal is a first-class CLI, not an API you could build a CLI on top of. Four of the five competitors document an API; that is not the same thing when the person using it is an engineer on your bench who wants to launch a pentest from a terminal they are already in.
If you are choosing an engine to build a service line on, the questions worth asking any vendor on this list — including us — are:
We have tried to answer all four above, in public, with the sourcing visible.
Every finding ships with a working proof of concept. Book a demo →