HackerOne Pentest
Pentera
Tenable Nessus
Invicti
Optro
What is Cobalt?
Founded in 2013 and headquartered in San Francisco, Cobalt provides penetration testing as a service through a software platform and a global tester network. It serves hundreds of organizations with recurring offensive-security assessments.
Cobalt is a penetration-testing-as-a-service platform that combines a workflow dashboard with human security researchers. Teams scope web applications, APIs, mobile apps, cloud environments, networks, or other assets; vetted testers work through engagements while findings appear in the platform and through collaboration channels. The service is designed to replace a static, end-of-engagement report with live communication, actionable evidence, remediation guidance, and retesting.
The product covers web, API, mobile, cloud, internal-network, external-network, and dynamic application security testing, with attack-surface monitoring and AI-assisted capabilities in the broader platform. Native workflow connections include Jira and GitHub, while Slack supports real-time collaboration. Cobalt is not a self-serve low-cost scanner: human testing, scoped engagements, and sales-led plans make it a better fit for teams that need expert judgment than for buyers seeking instant automated coverage.
Security teams buy Cobalt for recurring application assessments, customer assurance, and compliance evidence. Standard, Premium, and Enterprise use custom annual credit packages, with testing starts advertised within three, two, and one business days respectively. Autonomous Pentest adds a promotional $3,500 web application assessment with findings in 24 hours and human oversight; the test must start and finish before December 31, 2026. Retesting windows and program support vary by package.
Key features
Human-led pentesting
Vetted security testers assess scoped applications and infrastructure and provide evidence-backed findings.
Live findings workflow
Teams can review findings as testing proceeds and collaborate with testers through the platform and Slack.
Remediation guidance
Reports include detailed vulnerability analysis, recommended fixes, and support for validation and retesting.
Application testing
Coverage includes web applications, APIs, mobile applications, and dynamic application security testing.
Cloud and network testing
Security teams can scope cloud, internal-network, and external-network assessments.
Attack-surface monitoring
The plan comparison includes attack-surface monitoring alongside penetration-testing services.
Developer integrations
Native integrations listed for higher plans include Jira and GitHub.
Cobalt pricing
Standard, Premium, and Enterprise packages use custom annual credit pricing. Cobalt also advertises Autonomous Pentest at $3,500 per web application test for new and existing customers, provided testing starts and finishes before December 31, 2026. One Cobalt Credit represents eight hours of offensive security testing.
| Plan | Price | What's included |
|---|---|---|
| Standard | Custom quote | SAML SSO, access controls, detailed findings, Slack collaboration, insights dashboard, start within 3 business days, 6-month free retesting, email onboarding, 1 DAST target |
| Premium | Custom quote | Standard features, start within 2 business days, 12-month free retesting, named customer-success manager, live onboarding, annual planning, native integrations, customizable reports |
| Enterprise | Custom quote | Premium features, start within 1 business day, quarterly planning, custom pentester requests, credit rollover up to 10 percent |
| Autonomous Pentest | $3,500/testPromotional price; testing must start and finish before December 31, 2026. | Web application testing, human oversight, findings in 24 hours, exploit evidence, remediation guidance, structured report |
Free trial: No free trial is listed.
Pros & cons
Pros
- Live findings and Slack collaboration shorten the feedback loop with testers.
- The scope spans web, API, mobile, cloud, and network assessments.
- Plan descriptions include retesting and detailed remediation guidance.
- G2 users rate Cobalt 4.5/5 across 178 reviews.
Cons
- Pricing is quote-based, with no public numeric entry price.
- There is no free trial for buyers wanting to evaluate the service self-serve.
- Human-led engagements require scoping and coordination rather than instant scanning.
- A G2 review notes that credit and pricing structures can be confusing.
Who is Cobalt best for?
- Security teams running recurring application and infrastructure penetration tests.
- Organizations that need live tester collaboration instead of a report-only engagement.
- Development teams connecting remediation work to Jira or GitHub.
- Mid-market and enterprise buyers with budget for expert-led testing.
Audit areas
Integrations
Notable customers
Frequently asked questions
How much does Cobalt cost?
+
Standard, Premium, and Enterprise use custom annual credit packages. Autonomous Pentest is advertised at $3,500 per web application test when testing starts and finishes before December 31, 2026.
How does a Cobalt test work and how long does it take?
+
The buyer scopes assets, then testers work through the platform while findings and remediation guidance are shared in real time. Cobalt’s plan comparison says testing starts within three business days on Standard, two on Premium, and one on Enterprise.
How does Cobalt compare with HackerOne Pentest?
+
Both combine a platform with expert-led testing and live findings. Cobalt publicly emphasizes three service tiers, target start times, retesting windows, and Jira/GitHub integrations, while HackerOne emphasizes its vetted pentester pool and broader HackerOne ecosystem.
Which integrations does Cobalt support?
+
The published plan comparison names native Jira and GitHub integrations and Slack collaboration. The platform also provides its own insights dashboard and remediation workflow.
Who is Cobalt for?
+
It is aimed at security and development teams running recurring tests across applications, APIs, mobile, cloud, or networks. The quote-based model and human-led delivery are better suited to mid-market and enterprise programs than very small teams seeking a low-cost scanner.
How reliable are Cobalt findings?
+
Cobalt uses human testers and provides detailed findings, evidence, recommended fixes, and retesting. G2 reviewers praise the depth and collaboration, while one review cautions that time-boxed testing cannot find every issue.
Sources
Facts and pricing verified on October 19, 2026. Vendors change pricing often, so confirm with Cobalt before buying. How we research
