# Cobalt pentest pricing: what Cobalt.io publishes

Source: https://pentestcompare.com/pricing/cobalt/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Cobalt.io pentest pricing as published on 9 November 2026: one $3,500 autonomous test, annual credit tiers with no price, retest terms and a quote checklist.

> **Short answer:** Cobalt.io publishes one dollar price: $3,500 per Autonomous Pentest, a limited-time offer for tests that start and finish before 31 December 2026. The Standard, Premium and Enterprise tiers are annual credit packages with no published price. One credit equals 8 hours of testing. This page lists each figure with its unit, source and check date (9 November 2026), plus the questions to put in a quote request.

This page covers the pentest company Cobalt.io, not the metal or the video downloader that share the name. It lists what Cobalt publishes about price on its [pricing page](https://www.cobalt.io/pricing), read on 9 November 2026. We use no third-party price estimates.

## What does Cobalt publish about price?

Cobalt publishes one dollar figure. Everything else on the pricing page routes to a quote.

| Offer | Price | Unit | What it covers | Checked |
|---|---|---|---|---|
| Autonomous Pentest (limited-time offer) | $3,500 | per test | Web application test started through the platform. Findings in 24 hours. The test must start and finish before 31 December 2026. | 9 Nov 2026 |
| Standard | Not published | Annual credit package | Start within 3 business days | 9 Nov 2026 |
| Premium | Not published | Annual credit package | Start within 2 business days | 9 Nov 2026 |
| Enterprise | Not published | Annual credit package | Start within 1 business day | 9 Nov 2026 |

Source for every row: [Cobalt pricing](https://www.cobalt.io/pricing). Cobalt's footnote says start times vary by engagement type.

## What is the price unit, and what does it buy?

The two product lines use different units, so the $3,500 figure cannot be multiplied into a tier price.

The Autonomous Pentest is priced per test. The annual tiers are priced in credits, and Cobalt says one credit equals 8 hours of testing. The credits deducted for a test can vary with the per-credit rate in your contract. So the cost of a test is the credits debited times your rate per credit, and both numbers come from the quote.

> **Worked example with invented numbers:** This is a demonstration of the arithmetic only. No real quote was used. Suppose a quote lists a per-credit rate of R and a scoped test debits 5 credits. The test costs 5 x R. A second test that debits 8 credits costs 8 x R. Ask for R, the number of credits for each asset in your scope, and the date the credits expire.
## What costs extra or is not stated?

Cobalt's pricing page does not state a platform fee, an add-on price or a support charge for the annual tiers. We record these as Not published.

Two limits matter for budgeting. The $3,500 offer ends with tests finished before 31 December 2026, and the page does not state a price after that date. The credit rate is set per contract, so two buyers with the same scope can pay different amounts. Third-party estimates exist on other sites. They are not Cobalt figures, so we do not repeat them.

## What do retests and turnaround look like?

Cobalt states its retest window two ways, and its turnaround figures measure different events.

| Item | Statement on Cobalt's pricing page |
|---|---|
| Retest, comparison table | Free retesting for 6 months (Standard) or 12 months (Premium, Enterprise) |
| Retest, FAQ | Unlimited on-demand retesting during the contract term |
| Autonomous Pentest | Findings in 24 hours (time to first findings) |
| Annual tiers | Start within 3 / 2 / 1 business days for Standard / Premium / Enterprise (time to start, not to the final report) |

Ask Cobalt in writing which retest statement applies to your contract. Ask also what the start time means for your asset type. See [Cobalt's provider profile](/providers/cobalt/) for the other fields we track.

## Which providers publish a price in a similar unit?

Several providers publish a per-test or per-assessment price. The units and scope differ, so the figures do not buy equal work. A to Z, from the dataset checked on 9 November 2026:

| Provider | Published price | Unit |
|---|---|---|
| [Aikido](/providers/aikido/) | $4,000 (TYPICAL Pentest) | per assessment |
| [Intruder](/providers/intruder/) | $3,500 (single pentest) | per test |
| [Payatu](/providers/payatu/) | $3,500 (AI-Native Express, starts from) | per test |
| [Stingrai](/providers/stingrai/) | US$3,000 (Autonomous Pentest) | per assessment |
| [Synack](/providers/synack/) | $5,085 (Sara Pentest, starting price) | per test |

For a longer list and the reasons units differ, read the [penetration testing cost guide](/guides/penetration-testing-cost/). To see Cobalt next to other platforms, use [Cobalt alternatives](/compare/cobalt-alternatives/) or the [Cobalt vs HackerOne comparison](/compare/cobalt-vs-hackerone/).

## How do you budget a Cobalt purchase?

Budget in two steps, because the two product lines answer different questions.

For a single web application test before 31 December 2026, the published $3,500 gives a ceiling for planning that one test. It covers a web application test started through the platform, with findings in 24 hours. It is a limited-time offer, so check that it is still live when you order.

For recurring testing, start from your asset list, not from the tier names. List each web app, API, cloud account, network range and mobile app you want tested in the year. Ask Cobalt how many credits each one is likely to debit. Multiply by the per-credit rate in the quote. The tier then decides how fast a test starts (3, 2 or 1 business days) and how long retesting runs, not the price of a test. Cobalt describes the tiers as annual credit packages, so unused credits are a cost to plan for. Ask what happens to them at the end of the term.

## What should a Cobalt quote request include?

Send the same scope summary to every provider, then ask Cobalt for these items in writing:

1. The per-credit rate and the number of credits debited for each asset in scope.
2. The term of the credit package and the date unused credits expire.
3. Which retest statement applies: 6 or 12 months, or unlimited during the term.
4. What "start within N business days" measures and whether it applies to your asset type.
5. Who tests and who reviews findings, for both the human-led tiers and the Autonomous Pentest.
6. A sample report. Cobalt lists one as available on request.
7. The quote expiry date and any platform or support fees.

The [scoping checklist](/tools/scoping-checklist/) builds the scope summary in your browser.

Found an error or a newer Cobalt page? [Send a correction](/methodology/#corrections).

## Questions

### How much does Cobalt cost?

Cobalt publishes $3,500 per Autonomous Pentest, a web application test, as a limited-time offer. It publishes no price for the Standard, Premium or Enterprise tiers. Those are annual credit packages sold by quote. We checked the pricing page on 9 November 2026.

### What is a Cobalt credit?

Cobalt says one credit equals 8 hours of offensive security testing. The credits deducted for a given test can vary with your contracted per-credit rate, so a credit total alone does not give a price. Ask for the rate in writing.

### Does the $3,500 Autonomous Pentest include a human tester?

The pricing page describes it as a web application test started through the platform, with findings in 24 hours. Our dataset does not record human review for this product. Ask Cobalt who reviews the findings before you buy.

### Are Cobalt retests free?

The comparison table says free retesting for 6 months (Standard) or 12 months (Premium and Enterprise). The FAQ says unlimited on-demand retesting during the contract term. The two statements differ, so get the window written into your order.

## Sources

- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Cobalt homepage](https://www.cobalt.io/)