Cobalt

Cobalt operates an offensive security testing business built around pentesting as a service (PTaaS). Customers define a scope, testing type and cadence, and Cobalt delivers application pentesting, network and cloud pentesting, and red teaming through a mix of human-led, autonomous, continuous and on-demand engagements. Delivery is organized around four components the company describes as elite human expertise, a context-aware platform, AI-powered orchestration, and a dataset of historical pentest results.

The Cobalt Offensive Security Platform lets customers launch tests within hours, view findings in real time, communicate directly with testers, and pull reports on demand; it offers more than 50 integrations for automating remediation workflows. An AI layer marketed as Cobalt Sage AI supports scoping through remediation and powers autonomous pentest agents trained on the company's accumulated pentest data. Testing is performed by the Cobalt Core, a community of vetted security practitioners that the company states numbers more than 500 globally, with a 5% acceptance rate and 11 years of average experience.

The company positions its services around three buyer needs: broad coverage of an expanding attack surface, continuous risk reduction to close the exposure windows left by point-in-time testing, and evidence for audit, regulatory and customer compliance requirements. It also publishes recurring research, including a State of Pentesting Report and an AI and Pentesting Pulse Report.

Founding story

Cobalt was launched in 2013 by co-founders Jacob Hansen, Esben Friis-Jensen, Jakob Storm and Christian Hansen around the premise that traditional penetration testing was slow and siloed. The initial offering was a SaaS platform connecting businesses directly to a crowd of vetted security researchers who submitted vulnerabilities through security programs at a lower cost than traditional security testing. In its first year the company hosted more than 90 application security programs, and researchers in its bug bounty programs disclosed vulnerabilities in the Web2py and Tornado web application frameworks.

Business model

Cobalt sells offensive security testing services delivered through its own SaaS platform. Engagements are scoped by asset criticality, testing type and cadence, and can be purchased as on-demand pentests or as ongoing continuous testing programs, with Cobalt building and managing the program and delivering results.

Revenue comes from customer-purchased penetration testing engagements and continuous testing programs delivered via the Cobalt platform; one customer reported reducing annual testing costs by 44% while increasing coverage.

Traction

The company reports conducting more than 5,000 pentests annually, surfacing over 10,000 critical and high severity findings, maintaining a community of more than 500 Cobalt Core pentesters, and holding 13 years of real-world exploit data. In its first year of operation it hosted more than 90 application security programs.

Latest developments

Cobalt has extended its portfolio from human-led, point-in-time pentesting to continuous and autonomous AI-driven testing under the Cobalt Offensive Security Platform and Cobalt Sage AI, and published the State of Pentesting Report 2026 and the AI and Pentesting Pulse Report 2026 alongside a webinar on the limitations of traditional pentesting.