Cobalt
Cobalt lets a company book penetration tests of its web apps, APIs, cloud and network on a platform, then assigns vetted human testers and delivers findings straight into the engineering team's tools.
CyberReviewed Editorial Team · Updated · cobalt.io
Company details
- Score
- 6.4/10Ranked 9 of 12 (tied)
- Category
- Penetration testing
- Founded
- 2013
- Headquarters
- San Francisco, California
- Leadership
- Sonali Shah, CEO since August 2024
- Funding disclosed
- $37 million through its 2020 Series B
- Pricing
- Annual credit packages; autonomous pentest $3,500 per test (promotional)
- Best fit
- SaaS and software companies that need recurring application pentests
Our take
Cobalt is a practical choice for software companies that need regular application and API pentests for customers and auditors and want to schedule them quickly. Organizations whose main need is a deep, bespoke red team engagement may prefer a specialist consultancy.
Scores by criterion
| Criterion | Score |
|---|---|
| Pricing transparency | 5 |
| Product scope and fit | 8 |
| Company durability | 6 |
| Evidence of adoption | 6 |
| Ease of adoption | 7 |
| Overall score (average of the five) | 6.4 |
Each criterion is defined on our methodology page.
Booking testers through a platform
Cobalt sells penetration testing as a service: customers scope tests on a platform, Cobalt assigns vetted testers from its community, and findings arrive in the platform with integrations into tools such as Jira and GitHub.12 Its services now span web, API, cloud, network and AI applications, and it sells an autonomous pentest product that pairs AI systems with its core testers, who direct scope, execution and quality on each engagement.2
Credits and the autonomous test
Cobalt sells annual packages of credits, where one credit equals eight hours of testing, across Standard, Premium and Enterprise tiers that differ in how fast a test can start (three, two or one business days) and in support.2 Packages include free retesting of findings.2 Its autonomous web application pentest is offered at $3,500 per test for engagements started and completed before December 31, 2026.2 Credit prices themselves are quoted.
Danish founders, new CEO
Four Danish co-founders, Jacob Hansen, Esben Friis-Jensen, Jakob Storm and Christian Hansen, started Cobalt in 2013.1 In August 2020 it raised a $29 million Series B led by Highland Europe, bringing total funding to $37 million; at the time it had more than 500 customers, about 300 testers, and was operating at breakeven.1 In August 2024 the board appointed Sonali Shah, a former Bitsight, Veracode and Invicti executive, as CEO, succeeding Chris Manton-Jones; the announcement said Cobalt had reached profitability and that its community numbered more than 400 testers.3
Consultancies, NodeZero and Intruder
Cobalt uses human testers like a consultancy but books them through software, like an automated tool. Horizon3.ai's NodeZero runs autonomous attacks against internal networks at a fixed annual price, which suits frequent infrastructure testing; Cobalt's strength is human-led application testing on a schedule. Intruder's pentest offer starts at the same $3,500 per test, but Intruder is primarily a scanner.
One-off tests and red teams
Companies that need a single annual network test at the lowest cost, or deep adversary simulation tailored to a specific threat group, may get better value from a boutique firm. Cobalt's credits expire at the end of each contract year.2
