Provider profile
Cobalt
Cobalt sells pentests through a platform that connects buyers with a network of vetted freelance testers, plus an autonomous pentest product. Work is bought mostly as annual credit packages, and results appear in the platform as testing proceeds.
Visit Cobalt Back to comparison
Last checked 9 November 2026. Facts come from Cobalt's own public pages, linked below.
At a glance
| Type | PTaaS platform |
|---|---|
| Delivery | hybrid Testing is done by a network of vetted freelance pentesters (the Cobalt Core), with AI agents and a separate autonomous pentest option. |
| Scope | Web apps: yes APIs: yes Cloud: yes Network: yes Mobile: yes AI apps: yes |
| Pricing model | mixed |
| Turnaround | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. Time to start a test (annual tiers) or time to first findings (autonomous test). Not the time to the final report. source |
| Retesting | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. source |
| Sample report | on request |
| Compliance mentioned | HIPAA |
| Integrations | Jira, GitHub, Slack |
Pricing
| Plan or item | Price | Unit | What it covers |
|---|---|---|---|
| Autonomous Pentest (limited-time offer) | $3,500 | per test | Web application test started through the platform; findings in 24 hours; offer says the test must start and finish before Dec 31, 2026. source |
Only the Autonomous Pentest has a dollar price, and it is a one-off test on a limited-time offer. Standard, Premium and Enterprise tiers are annual credit packages with no published price; one credit equals 8 hours of testing. Credits deducted for a test can vary with the contracted per-credit rate.
Credentials
- SOC 2 Type II (Cobalt's own audit) evidence
- ISO 27001 certified evidence
- CREST Penetration Testing Service accreditation evidence
Our assessment
Editorial judgment by Excession Labs, based on the facts above. Not a rating.
Good fit when
Teams that want human pentesters on a platform with fast starts and in-platform retesting, and that are happy to buy an annual credit package. The $3,500 autonomous option gives a published entry price for a web app test.
Tradeoffs
Prices for the human-led annual tiers are not published; you must ask for a quote. The retest window is stated two different ways on the pricing page.
Sources
- Cobalt pricing (checked 9 November 2026)
- Cobalt homepage (checked 9 November 2026)
- Cobalt Trust Center (checked 9 November 2026)
See something wrong or out of date? Send a correction.