NEW FEATURE
Cobalt PtaaS + DAST combines manual pentests and automated scanning for comprehensive applications security.
NEW FEATURE
Cobalt PtaaS + DAST combines manual pentests and automated scanning for comprehensive applications security.

Cobalt Pentest Pricing

Modern Pentesting for All
Cobalt offers a flexible, on-demand consumption model to meet the modern pentesting needs of all security and development teams. Receive a full compliance test in two weeks by the leading PtaaS authority for as little as $8,500 with Starter Packs. Explore Cobalt’s offerings below to determine the right package for your testing goals.
Standard

For teams in need of a speedy,
annual pentest to meet
a compliance need
or client request.

get a quote
Includes:
  • Pentest Start Time Within 3 Business Days
  • Self-Service Platform with Google OAUTH 2.0 & 2FA
  • SAML-Based SSO
  • Best Practice Methodology + Pentest Coverage Checklist
  • Detailed Findings with Recommended Fixes
  • Real-time Collaboration with Pentesters via Slack and Platform
  • Cobalt API
  • Free Retesting
Premium

For teams looking to build
a structured pentest program
to meet compliance needs and
improve overall security.

get a quote
Includes Everything in Standard, Plus:
  • Pentest Start Time Within 2 Business Days
  • Named Customer Success Manager (CSM)
  • Native Integrations (Jira, GitHub)
  • Customizable Reports
  • Onboarding for Teams
  • Annual Strategic Planning
Enterprise

For teams looking to scale their pentest programs to meet compliance needs, increase testing frequency, and improve overall security.

get a quote
Includes Everything in Premium, Plus:
  • Pentest Start Time Within 1 Business Day
  • Quarterly Strategic Planning
  • Quarterly Maturity Assessments
  • Custom Pentester Requests (Geo, Time Zone, Testing Windows)
  • Up to 10% Annual Credit Rollover

Compare What's Offered in Each Tier

Self-Service Platform with
google oauth 2.0 & 2fa

saml-based sso
best practice methodology +
coverage checklist
detailed findings
with recommended fixes
real-time collaboration via slack and the platform
cobalt api
start pentest within
free retesting
customer success team
native integrations (jira, github)
customizable reports
onboarding
strategic planning
quarterly maturity assessment

Custom Pentester Requests (Geo, Time Zone, Testing Windows)

credit rollover

Standard

3 Business Days
6 Months

Pool

Premium

2 Business Days
12 Months

Named CSM

Security + 1 Dev Team

Annual

Enterprise

1 Business Day
12 Months

Named CSM

All Teams

Quarterly

Up to 10%

Download the Cobalt Packaging Brief

Read about Cobalt's flexible, on-demand consumption model to meet your modern pentesting needs.

Cobalt Credits Provide a Flexible Consumption Model

A Cobalt Credit is a standardized unit of work that represents 8 pentesting hours. Credits provide flexibility in both planning and executing pentests. They are sold in annual packages that include asset scoping, retesting, unlimited platform access, and more.

You can think of a Cobalt Credit as a virtual voucher that you consume whenever a manual pentesting need arises, meaning you can get a pentest up and running within days, compared to weeks with traditional services. Instead of being tied to a traditional ‘all in scope’ assessment, you can tailor and distribute the amount of work based on the complexity of your asset(s).
Cobalt-Pricing-Cobalt logo graphic

Frequently Asked Questions

  • Why should I use Cobalt?

    At Cobalt, we believe that modern applications deserve something better than generic vulnerability scanners and overpriced penetration testing consultants. We have built a best-in-class SaaS platform which provides on-demand pentesting by connecting you to top application pentesters around the world to conduct efficient manual penetration testing services.
  • How can I determine the number of Cobalt Credits needed for a pentest?

    Cobalt offers pentests for a variety of asset types: web applications, mobile applications, APIs, internal and external networks, and cloud services (GCP, AWS, Azure).

    Some of the most common pentesting use cases we see are compliance, M&A due diligence, customer requests, new release testing, delta testing, single OWASP category testing, exploitable vulnerability testing, and microservice testing.

    To determine the number of credits required for a pentest, we look at asset-based parameters. For example, we'd look at the number of users and the number of dynamic pages to determine the scope of a web application test.

    Get in touch with the Cobalt team today to determine how many Cobalt Credits you'll need for your next pentest.

  • How do you support custom pentester requests?

    For the Enterprise tier, we’ll accommodate special requests regarding pentesters who perform the pentest, which includes:
    • Staffing a pentest with pentesters from a specific region or time zone; or
    • Ensuring that pentesters can communicate with you and/or perform testing at specified times.
    We’ll facilitate other requests on a case-by-case basis. All custom requests are subject to Cobalt availability. We may not be able to accommodate more than one such request per pentest.
  • What do you mean by ‘customizable reports’?

    Cobalt offers a variety of report templates for Comprehensive Pentests, including a full pentest report with finding details, a customer letter, and an attestation letter.

    All Agile Pentests include an automated report with finding details.

    For Premium and Enterprise Tier customers, report templates can be customized as needed with the ability to remove sections.

  • Is the Cobalt API public-facing?

    Yes, the Cobalt API is public-facing. For access to our API documentation, visit https://docs.cobalt.io/.

  • What is included in Strategic Planning?

    Work with your CSM to proactively plan when the testing of assets should take place. This includes a kick-off meeting to better understand your needs and asset criticality to draft an appropriate schedule. Strategic Planning takes place annually for Premium customers, and quarterly for Enterprise customers.

  • What are Quarterly Maturity Assessments?

    Utilizing objective scoring and concrete guidance, your CSM will help you take your program to the next level. These assessments are based on Cobalt’s framework for maturity, which leverages data from our 1,000+ customers.

  • Does Cobalt offer other security services beyond pentesting?

    Absolutely! At Cobalt, our goal is to be an ongoing resource for our customers and a true extension of their security team by helping them protect their broader IT ecosystems. For this reason, we offer a variety of professional services designed to boost the maturity of your current security program and improve your overall security posture.

  • What does Onboarding include?

    Onboarding includes CSM-led calls in which your team and Cobalt align on primary points of contact, success plans, and an inventory of your assets. In addition, a Cobalt Sales Engineer will provide a comprehensive demo of the Cobalt platform, along with technical guidance on how to set your first pentest. Premium Tier Onboarding is provided to your Security team and 1 dev team. Enterprise Tier Onboarding is provided to all teams.

  • Can I change pentesters across different tests to fulfill company requirements?

    Yes! We can rotate pentesters for every pentest. Get a fresh perspective, reduce bias, and a diverse skill set on every pentest you conduct with Cobalt. Avoid multiple procurement processes and still remain compliant with our community of 400+ pentesters. Read more about best practices rotating pentesters.

Why should I use Cobalt?

At Cobalt, we believe that modern applications deserve something better than generic vulnerability scanners and overpriced penetration testing consultants. We have built a best-in-class SaaS platform which provides on-demand pentesting by connecting you to top application pentesters around the world to conduct efficient manual penetration testing services.
How can I determine the number of Cobalt Credits needed for a pentest?

Cobalt offers pentests for a variety of asset types: web applications, mobile applications, APIs, internal and external networks, and cloud services (GCP, AWS, Azure).

Some of the most common pentesting use cases we see are compliance, M&A due diligence, customer requests, new release testing, delta testing, single OWASP category testing, exploitable vulnerability testing, and microservice testing.

To determine the number of credits required for a pentest, we look at asset-based parameters. For example, we'd look at the number of users and the number of dynamic pages to determine the scope of a web application test.

Get in touch with the Cobalt team today to determine how many Cobalt Credits you'll need for your next pentest.

How do you support custom pentester requests?

For the Enterprise tier, we’ll accommodate special requests regarding pentesters who perform the pentest, which includes:
  • Staffing a pentest with pentesters from a specific region or time zone; or
  • Ensuring that pentesters can communicate with you and/or perform testing at specified times.
We’ll facilitate other requests on a case-by-case basis. All custom requests are subject to Cobalt availability. We may not be able to accommodate more than one such request per pentest.
What do you mean by ‘customizable reports’?

Cobalt offers a variety of report templates for Comprehensive Pentests, including a full pentest report with finding details, a customer letter, and an attestation letter.

All Agile Pentests include an automated report with finding details.

For Premium and Enterprise Tier customers, report templates can be customized as needed with the ability to remove sections.

Is the Cobalt API public-facing?

Yes, the Cobalt API is public-facing. For access to our API documentation, visit https://docs.cobalt.io/.

What is included in Strategic Planning?

Work with your CSM to proactively plan when the testing of assets should take place. This includes a kick-off meeting to better understand your needs and asset criticality to draft an appropriate schedule. Strategic Planning takes place annually for Premium customers, and quarterly for Enterprise customers.

What are Quarterly Maturity Assessments?

Utilizing objective scoring and concrete guidance, your CSM will help you take your program to the next level. These assessments are based on Cobalt’s framework for maturity, which leverages data from our 1,000+ customers.

Does Cobalt offer other security services beyond pentesting?

Absolutely! At Cobalt, our goal is to be an ongoing resource for our customers and a true extension of their security team by helping them protect their broader IT ecosystems. For this reason, we offer a variety of professional services designed to boost the maturity of your current security program and improve your overall security posture.

What does Onboarding include?

Onboarding includes CSM-led calls in which your team and Cobalt align on primary points of contact, success plans, and an inventory of your assets. In addition, a Cobalt Sales Engineer will provide a comprehensive demo of the Cobalt platform, along with technical guidance on how to set your first pentest. Premium Tier Onboarding is provided to your Security team and 1 dev team. Enterprise Tier Onboarding is provided to all teams.

Can I change pentesters across different tests to fulfill company requirements?

Yes! We can rotate pentesters for every pentest. Get a fresh perspective, reduce bias, and a diverse skill set on every pentest you conduct with Cobalt. Avoid multiple procurement processes and still remain compliant with our community of 400+ pentesters. Read more about best practices rotating pentesters.

Ready to Get Started?