Comparisons
Cobalt vs HackerOne for penetration testing
Cobalt vs HackerOne pentest compared on delivery, scope, pricing, turnaround, retests, sample reports and credentials, with vendor sources checked on 9 November 2026.
Short answer
Cobalt and HackerOne both sell pentests through a platform with human testers and an AI option. Cobalt sells annual credit packages and one published $3,500 autonomous test. HackerOne publishes no price. Retest terms differ in both vendors' own sources. This comparison uses vendor pages checked on 9 November 2026 and names no winner.
Cobalt and HackerOne are both platforms where buyers order pentests from vetted external testers and track findings online. This page compares the pentest products only, using each vendor's public pages on 9 November 2026. Both are in the provider dataset. The products overlap, but they sell differently: Cobalt prices in credits and shows one dollar figure, while HackerOne shows no pentest price.
How do Cobalt and HackerOne compare at a glance?#
| Field | Cobalt | HackerOne |
|---|---|---|
| Delivery | Vetted freelance testers (Cobalt Core) with AI agents, plus a separate Autonomous Pentest | H1 Pentest, fully human-led; H1 Agentic Pentest, AI agents with human review of every agent finding |
| Scope named | Web app, API, cloud, network, mobile, AI apps | H1 Pentest: web, API, cloud, AI and LLM, mobile, network, desktop, code audits, PCI segmentation. Agentic: web apps and APIs only |
| Pricing model | Annual credit packages (Standard, Premium, Enterprise); one credit is 8 hours of testing; no tier price published | Custom quote; no pentest price on the pricing page |
| Published price | $3,500 per Autonomous Pentest (limited time; start and finish before 31 Dec 2026) | None |
| Turnaround claim | Autonomous: findings in 24 hours. Annual tiers: start in 3 / 2 / 1 business days (Standard / Premium / Enterprise), varying by engagement type | Page: findings in "hours not weeks"; no start time or test length. Docs: final report 3 to 5 business days after testing ends |
| What turnaround measures | Time to first findings (autonomous) or time to start (tiers) | Report delivery after testing (docs); live findings during testing (page) |
| Retest terms | Table: free for 6 months (Standard), 12 months (Premium, Enterprise). FAQ: unlimited on demand during the contract | Docs: unlimited during the remediation period (typically 30 or 90 days), usually completed in about three days; fee (minimum $50) possible after. Older docs: 60 days, two retests |
| Sample report | On request | Not published (interactive demo linked) |
| Credentials with evidence | SOC 2 Type II, ISO 27001, CREST accreditation (Trust Center) | None found on the pages checked |
| Integrations | Jira, GitHub, Slack | GitHub, Jira, Slack, ServiceNow |
Sources: Cobalt pricing, Cobalt Trust Center, HackerOne pentest page, HackerOne pricing and HackerOne docs (found via search; not opened directly), all checked 9 November 2026. HackerOne's list of standards (SOC 2, ISO 27001, PCI DSS, DORA, NIST CSF 2.0, GDPR) describes what its reports support, not certifications it holds, so we do not list them as credentials.
Are these two the same kind of product?#
Mostly. Both resemble PTaaS: you scope a test online, testers work on the platform, and findings appear as the work proceeds. The PTaaS vs traditional pentesting guide explains that model.
They differ in what else the vendor sells. HackerOne is also known for bug bounty and disclosure programs, and its pentest page says results stream into the same platform. Cobalt's credit packages cover scoping, testing, retesting and platform access, and it adds an autonomous test at a fixed price. Read the bug bounty vs pentest guide if you are choosing between a program and a test.
Choose Cobalt if#
- You want a published entry price for one web app test. The $3,500 Autonomous Pentest has a dollar figure, but it ends 31 December 2026 and covers a web application test.
- You want a stated start time. Cobalt lists 3, 2 or 1 business days by tier, with a footnote that start times vary by engagement type.
- You want certifications you can verify on a Trust Center: SOC 2 Type II, ISO 27001 and CREST.
- You can commit to an annual credit package and have a plan for how many hours you will use. The FAQ and the table disagree on rollover (up to 10% in the table, none in the FAQ), so ask.
Choose HackerOne if#
- You already use HackerOne for bug bounty or vulnerability disclosure and want pentests from the same vendor and platform.
- You want to choose between a fully human-led test and an agentic test where human testers review every agent finding.
- You need ServiceNow among your integrations, or desktop, code-audit or PCI segmentation testing in the scope list.
- Your plan is to negotiate retest terms from HackerOne's documented window (typically 30 or 90 days of unlimited retests) and have them written in.
What differences matter most?#
Pricing visibility is the clearest gap. Cobalt shows one figure for a one-off autonomous test and none for human-led work. HackerOne shows none. For either vendor, a quote is the only way to price a human-led test, and the quote unit (credits, effort days, a fixed fee) will decide what you can compare. Never set a credit package next to a per-test price as if they were equal.
Turnaround numbers measure different events. Cobalt's tier figures are start times. HackerOne's docs figure is report delivery after the testing phase. Neither tells you how long a test runs.
Retest terms need a written answer from both. Cobalt's own page states two versions. HackerOne's sources disagree across the product page, current docs and older posts.
Credentials are easier to check for Cobalt, because its Trust Center lists them. We found no credential list for HackerOne's pentest service on the pages checked. That is a gap in the pages, so ask HackerOne what applies to the testers and the service.
Neither vendor publishes a sample report. Cobalt provides one on request; ask HackerOne. The sample report guide lists what to look for.
What to ask both vendors#
- Which of the retest statements applies to my contract, and what is the end date?
- What does your turnaround number measure?
- Who tests my scope, and can I see tester profiles or certifications?
- What is the quote unit, and what does a second scope cost?
- Can I see a sample report before I sign?
Need more options? See Cobalt alternatives and HackerOne pentest alternatives. Found an error? Send a correction.
Questions
Do Cobalt and HackerOne use the same kind of testers?
Both use vetted external testers on a platform. Cobalt describes a network of vetted freelance pentesters, the Cobalt Core. HackerOne says testers are matched to your asset type and stack. Neither page checked gives the number of testers or the hiring bar, so ask for tester profiles in your scoping call.
Which one has a price I can budget with?
Only Cobalt publishes a dollar figure: $3,500 per Autonomous Pentest, a limited-time offer that must start and finish before 31 December 2026. Its human-led tiers have no published price. HackerOne publishes no pentest price. Both need a quote to budget a human-led test.
Can I compare their retest windows directly?
Not yet. Cobalt's table says 6 or 12 months by tier while its FAQ says unlimited during the contract term. HackerOne's docs say unlimited retests in a remediation window of typically 30 or 90 days. Get the window written into your order form for either vendor.
Sources
- Cobalt pricing (checked 9 November 2026)
- Cobalt Trust Center (checked 9 November 2026)
- Cobalt homepage (checked 9 November 2026)
- HackerOne pentest product page (checked 9 November 2026)
- HackerOne pricing (checked 9 November 2026)
- HackerOne docs: retesting pentests (found via search; not opened directly) (checked 9 November 2026)