Cobalt

What the company sells

Cobalt offers a full suite of offensive security services, from autonomous pentesting to human-led pentesting. The Cobalt Offensive Security Platform helps customers move beyond point in time pentesting to a continuous offensive security program.

Cobalt says most pentesting programs still operate on an annual cycle. Cobalt describes the gap between how fast risk changes and how often organizations test for it as the exposure adversaries count on.

The Cobalt Platform centralizes access to the full range of security testing services: web app, API, cloud, network, red teaming, AI and LLM, and more. Customers can launch a pentest in hours and get real-time findings. Customers can collaborate directly with testers via the platform, Microsoft Teams or Slack. Cobalt says Cobalt Sage AI powers every Cobalt pentest and is built on 13 years of expertise, informed by thousands of security engagements. Cobalt says Cobalt Sage AI removes the reconnaissance, scanning, triage and reporting work so human experts can focus on complex attack paths and creative scenarios.

Cobalt delivers penetration testing across the entire application portfolio to find and fix vulnerabilities before they are exploited. Cobalt says network and cloud infrastructure are high-value targets in a constant state of change, and that Cobalt identifies and validates real exposures across the attack surface. Network and cloud testing covers Internal Network Pentest, External Network Pentest, Cloud Pentest and Cloud Configuration Review. Advanced offensive security services from Cobalt test systems against the tactics and techniques of a sophisticated adversary. Cobalt's advanced services include Red Teaming, Digital Risk Assessment and Secure Code Review. Customers use Cobalt to test critical web applications and APIs in production, AI and LLM-based applications still in development, and globally distributed networks segmented by location and business unit. For code review, Cobalt uses SAST and SCA for automated scanning and then reviews the scanner output manually to validate the findings.

Cobalt offers two testing delivery models. Customers can choose one or mix and match depending on assets, environment, release cycles and goals. Human-led testing draws on purpose-built methodologies and 500+ vetted security experts in the Cobalt Core. Cobalt Autonomous Pentest delivers complete pentests in 24 hours with proof of exploit on every finding, overseen by Cobalt Core pentesters. Agentic Penetration Testing as a Service pairs AI-driven automation with human pentesters to deliver continuous offensive security. Cobalt says periodic penetration testing meets compliance deadlines and continuous testing gives coverage in between.

Cobalt pushes vulnerability data into Jira, GitHub, ServiceNow and more through 50+ integrations. Cobalt offers unlimited retesting with a seven-day SLA. Cobalt offers centralized management of parent and child organizations. Cobalt says its customizable reports are mapped to SOC 2, ISO 27001, HIPAA and PCI-DSS. A Cobalt Credit represents the equivalent of 8 hours of offensive security testing. Cobalt sells credits in annual packages that include asset scoping, testing, retesting and platform access. Credits do not roll over into the next contract.^{[1][2][3][4][7][8][9][10]}

Categories

• Penetration testing and red team services (primary category)
• Compare Cobalt with companies in the same categoryside by side

Headquarters

Not established from our sources

Founded

Not established from our sources

Ownership

Not established from our sources

CISO on record

Not yet on our record. Send a verified source

Website

cobalt.io

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

• Autonomous Pentest^[3][7]

  Complete pentests in 24 hours with proof of exploit on every finding.

  Cobalt Autonomous Pentest is overseen by Cobalt Core pentesters. Cobalt says it delivers complete pentests in 24 hours with proof of exploit on every finding.

• Cobalt Sage AI^[3][6][7]

  The intelligence Cobalt says powers every Cobalt pentest.

  Cobalt says Cobalt Sage AI is built on 13 years of expertise and informed by thousands of security engagements. Cobalt says it removes reconnaissance, scanning, triage and reporting work so human experts can focus on complex attack paths.

• Secure Code Review^[8]

  Human-led analysis of source code to find security vulnerabilities.

  Secure code review is described as human-led analysis of source code. Cobalt uses SAST and SCA for automated scanning and then manually reviews the output to validate findings.

• Internal Network Pentest^[10]

  Testing of internal systems by Cobalt experts.

  Cobalt says its experts use network scanning tools, exploit frameworks and manual techniques to find and exploit vulnerabilities in internal systems. Findings appear in real time on the Cobalt platform with remediation guidance.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Cobalt's categories, then alphabetical. A list from the record, never a ranking.

• On penetration testing and red team services, Cobalt competes with ABIR Networks, Astra Security, Bishop Fox, BreachLock, Halo Security, Millennium Corporation, NCC Group, NetSPI, Red Sentry, REDLattice and 36 more.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

• G2 · 4.5 out of 5^[5]seen November 5, 2026

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

1. [1]cobalt.ioCobalt · cobalt.io · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
2. [2]Cobalt Introduces New AI Capabilities for Continuous PentestingCobalt via Business Wire · businesswire.com · published March 19, 2026 · Tier A: the company, a regulator or a filing
3. [3]Cobalt: Continuous Offensive Security TestingCobalt · undated page, accessed October 23, 2026 · Tier A: the company, a regulator or a filing
4. [4]Cybersecurity Services | CobaltCobalt · undated page, accessed October 23, 2026 · Tier A: the company, a regulator or a filing
5. [5]Cobalt Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 23, 2026 · Tier C
6. [6]Modern Offensive Security Platform | CobaltCobalt · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
7. [7]Agentic PTaaS: Pentest as a Service | CobaltCobalt · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
8. [8]Secure Code Review Services | CobaltCobalt · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
9. [9]Pentest Pricing & Penetration Testing Costs | CobaltCobalt · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
10. [10]Internal Network Penetration Testing Services | CobaltCobalt · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing

Last verified September 27, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded September 27, 2026, expanded November 5, 2026 from the references above.

Work for Cobalt? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.