# Cobalt: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/cobalt/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Cobalt at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Cobalt sells pentests through a platform that connects buyers with a network of vetted freelance testers, plus an autonomous pentest product. Work is bought mostly as annual credit packages, and results appear in the platform as testing proceeds.
- Website: https://www.cobalt.io/
- Type: PTaaS platform
- Delivery: hybrid. Testing is done by a network of vetted freelance pentesters (the Cobalt Core), with AI agents and a separate autonomous pentest option.
- Scope: Web apps yes; APIs yes; Cloud yes; Network yes; Mobile yes; AI apps yes
- Pricing model: mixed
  - Autonomous Pentest (limited-time offer): $3,500 per test (Web application test started through the platform; findings in 24 hours; offer says the test must start and finish before Dec 31, 2026.) https://www.cobalt.io/pricing
- Pricing note: Only the Autonomous Pentest has a dollar price, and it is a one-off test on a limited-time offer. Standard, Premium and Enterprise tiers are annual credit packages with no published price; one credit equals 8 hours of testing. Credits deducted for a test can vary with the contracted per-credit rate.
- Turnaround: Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. (Time to start a test (annual tiers) or time to first findings (autonomous test). Not the time to the final report.)
- Retesting: Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ.
- Sample report: on request 
- Credentials: SOC 2 Type II (Cobalt's own audit) (https://www.cobalt.io/trust-center); ISO 27001 certified (https://www.cobalt.io/trust-center); CREST Penetration Testing Service accreditation (https://www.cobalt.io/trust-center)
- Compliance mentioned: HIPAA
Good fit when: Teams that want human pentesters on a platform with fast starts and in-platform retesting, and that are happy to buy an annual credit package. The $3,500 autonomous option gives a published entry price for a web app test.
Tradeoffs: Prices for the human-led annual tiers are not published; you must ask for a quote. The retest window is stated two different ways on the pricing page.
Last checked: 2026-11-09
Sources:
- Cobalt pricing: https://www.cobalt.io/pricing (checked 2026-11-09)
- Cobalt homepage: https://www.cobalt.io/ (checked 2026-11-09)
- Cobalt Trust Center: https://www.cobalt.io/trust-center (checked 2026-11-09)