Request a Demo

Cobalt Pricing

Modern security testing for all
Cobalt offers a flexible, on-demand consumption model to meet the modern pentesting needs of all security and development teams. Explore Cobalt’s offerings below to determine the right package for your testing goals.
Standard

For teams in need of a speedy, annual pentest to meet a compliance need
or client request.

get a quote
Premium

For teams looking to build
a structured pentest program
to meet compliance needs and
improve overall security.

get a quote
Enterprise

For teams looking to scale their pentest programs to meet compliance needs, increase testing frequency, and improve overall security.

get a quote

Compare What's Offered in Each Tier

SAML-Based SSO

User and Group Access Controls
best practice methodology +
coverage checklist
detailed findings
with recommended fixes
real-time collaboration via slack and the platform
Insights Dashboard

Attack Surface Monitoring (ASM)

start pentest within *
free retesting
customer success team
onboarding support method
Dynamic Application Security Testing (DAST)
strategic program planning
native integrations (jira, github, etc.)
customizable reports

Custom Pentester Requests (Geo, Time Zone, Testing Windows)

credit rollover

Standard

3 Business Days
6 Months

Pool

Email
1 Target Included

Premium

2 Business Days
12 Months

Named CSM

Live
1 Target Included

Annual

Enterprise

1 Business Day
12 Months

Named CSM

Live
1 Target Included

Quarterly

Up to 10%
*Start times may vary depending on type of testing engagement.

AUTONOMOUS PENTEST

Cobalt Autonomous Pentest

Test every release, cover every application, and stay ahead of AI-augmented threats.

Cobalt Autonomous Pentest pairs AI systems with elite Cobalt Core pentesters to deliver continuous offensive security across your full application portfolio. Built on 13 years of real-world exploit data, with our Core pentesters directing scope, execution, and quality on every engagement.

Pricing

$3,500 per test

Limited time offer

Talk to a team member to get started

What's included

  • Web application testing, scoped and launched through the Cobalt Platform
  • Findings in 24 hours, with proof of exploit and remediation guidance
  • Cobalt Core pentester direction on every engagement — plan review, in-flight oversight, scope enforcement
  • Results delivered in the Cobalt Offensive Security Platform alongside all your other tests
  • Integrations with Jira, GitHub, Slack, and 50+ tools
  • Structured report generated automatically at engagement close

New customers and existing customers on any credit tier are eligible for the promotional $3,500 per test offer.* Autonomous Pentest must be initiated and completed before Dec 31st 2026 in order to qualify.

*The exact number of credits debited from your account may vary based on your contracted rate per credit.

Cobalt Credits Provide a Flexible Consumption Model

A Cobalt Credit represents the equivalent of 8 hours of offensive security testing—delivered through a combination of AI-powered automation and human expertise. Credits provide flexibility in both planning and executing pentests. They are sold in annual packages that include asset scoping, testing, retesting, platform access, and more.

You can think of a Cobalt Credit as a virtual voucher that you consume whenever a pentesting need arises, meaning you can get a pentest up and running in hours, compared to weeks with traditional services. Instead of being tied to a traditional ‘all in scope’ assessment, you can tailor and distribute the amount of work based on the breadth and depth of your testing needs.
scale_image@2x

FAQ

What is a "Cobalt Credit," and how do I know how many I need for a specific asset?

A Cobalt Credit is a standardized unit of work that represents the equivalent of 8 pentesting hours—delivered through a combination of AI-powered automation and human expertise. Credits provide flexibility in both planning and executing pentests. They are sold in annual packages that include platform access, test orchestration, expert validation, reporting, and more. The amount of credits required to test a specific asset will depend on the scope and delivery options of each test.

Do credits expire, or can they be rolled over to the next contract year?

Credits do not roll over into the next contract. To keep your momentum going, credits are specific to each contract year. This structure ensures you have a dedicated budget to maximize your results every single year.

What is included in "Free Retesting," and are there limits on how many times we can retest?

Our PTaaS model provides unlimited on-demand retesting throughout your contract term. This ensures that every fix your team implements is rigorously validated and that your assets remain secure as you evolve.

Can we purchase additional credits mid-year if our attack surface grows unexpectedly?

Yes, credits are available throughout your contract which enables teams flexibility in case of last minute product launches or security concerns arise. 

GET STARTED

Ready to up-level your offensive security?

Empower your security and development teams with Cobalt’s unique combination of a modern SaaS platform and our community of vetted security experts. Trust the pioneers of PtaaS as your offensive security partner across your entire attack surface.

Cobalt Get Started