Sonali Shah

From Investment Banking to Security Products

She did not start out in technology. She told the SECURE& podcast: unlike a, a lot of people, I actually started out in finance. So I was an investment banker at Credit Suisse and did a bunch of deals in cybersecurity and really fell in love with the industry. From banking she moved to corporate development and then to running products. She holds an MBA from Wharton and a master's degree in economics from the London School of Economics.

Rating Companies at Bitsight

She then joined Bitsight, a startup in Cambridge, Massachusetts, founded in 2011. Bitsight graded companies' security from the outside, so a business could check a partner without questionnaires. In 2013, as vice president of product marketing, she explained its Partner SecurityRating to Network World. The score ran from 250 to 900, like a credit rating, and fell when Bitsight's sensors saw a company's computers taken over by botnets or when news of a breach came out. We rate the security risk, she said.

After hackers stole card data from Target in late 2013, months after the retailer passed an industry security audit, she argued that passing a compliance check did not make a company safe. She told TechNewsWorld in 2014: The lesson here is even if you're pretty vigilant and at the top of your industry, being secure today doesn't mean being secure tomorrow. Cobalt now credits her with creating Bitsight Security Ratings, the first security rating service for companies.

Veracode, HUMAN and Invicti

At Veracode, which sells tools that test software for security flaws, she was vice president of product management and marketing. She argued that security experts were too scarce for security teams to check all code themselves, so developers had to take on part of the job. At a 2018 company summit reported by SD Times, she described security champions, developers who volunteer for extra training and act as the security team's eyes and ears inside their own teams. A security champion is a product champion, she said, because a good product is a secure product.

She went on to lead product strategy at HUMAN, formerly White Ops, which fights bot fraud. In June 2021 she joined Invicti Security, a company in Austin, Texas, that makes the Netsparker and Acunetix scanners for web applications, as chief product officer., according to the company's announcement.

Coming to Cobalt

After Invicti was sold she took time off. She told the Hacker Valley podcast that family came first then: my son was a senior in high school and just going through college applications and I'm like, okay, I just want to sort of be around more. She took consulting work instead of a full-time job, and one client was Cobalt. When the assignment ended, Cobalt's board asked her to join it, and after several months as a director she was asked to become chief executive. Cobalt announced her appointment on August 28, 2024.

Of the company's scale she said We do 5,000 pen tests a year. In an interview on Cobalt's blog she explained what drew her: We have great people, a fast growing market, and a product our customers love.

Pentesting in the Age of AI

She argues that yearly tests no longer fit companies that release new code several times a day. She made the same point more than a decade later, telling Hacker Valley just because you're secure today doesn't mean you're secure tomorrow. She questions what customers mean when they ask for continuous testing: Do you really want someone trying to break in and attack your network all the time, right? Most, she said, want testing timed to their releases.

She expects machines to take over much of the routine work while people find the subtle flaws. She told Tech Talks Daily in January 2026: We're quickly getting to this point where AI can do, AI agents can do 70 to 80% of the work. Cobalt has also launched an automated product it calls Autonomous Pentest, which returns findings within 24 hours while its human testers direct each job. On LinkedIn she wrote that the launch is about solving the tension I hear from our customers every day, because companies want the speed of AI but we are not ready to trust AI blindly.

Painting, Travel and Boards

Away from work she paints. I love to paint! My favorite medium is painting with acrylic paint, on anything I can! She likes to travel and lists Costa Rica, South Africa and India among her favorite trips, and before her son left for college the two of them went to Peru.

She sits on the board of Shibumi, which makes software for planning and tracking company strategy. She joined it in 2023, according to Shibumi. She also serves on the boards of two Boston nonprofits, 826 Boston and Mass TLC. Through her education work she has seen schools try AI to help children learn English, and she told Hacker Valley the same lesson applies to security: You still need that human teacher.