Cobalt Pricing 2026: Credits, Tiers and What a Pentest Costs

Cobalt publishes one dollar figure for its penetration testing in November 2026: US$3,500 per test for a Cobalt Autonomous Pentest, labelled a limited time offer for tests "initiated and completed before Dec 31st 2026," per the Cobalt pricing page. Every other purchase, including the Standard, Premium and Enterprise tiers, is priced in Cobalt Credits and sold by quote. One credit "represents the equivalent of 8 hours of offensive security testing," and the price of a credit is not on the page.

Quick answer: Cobalt pricing is credit-based. A buyer signs an annual contract for a number of Cobalt Credits on one of three tiers (Standard, Premium or Enterprise), and each test draws credits according to its scope. Cobalt publishes the unit (8 hours per credit), the scoping method and the tier features. It does not publish the price of a credit, the number of credits a typical test uses, or the price of any tier, so a human-led Cobalt pentest cannot be priced from the website. The only published price is US$3,500 per Autonomous Pentest, a promotion for tests completed before 31 December 2026.

This page covers Cobalt, the pentest as a service (PTaaS) provider at cobalt.io (Cobalt Labs, Inc.). It is built only from primary sources read on 12 and 13 November 2026: Cobalt's pricing page, its product documentation, its Platform Services Agreement (last updated 1 August 2026), archived copies of its pricing page, three cloud marketplaces and two public procurement databases. Where no public number exists, the page says so instead of estimating one.

Cobalt pentest pricing at a glance

How Cobalt credits work

A Cobalt Credit is a prepaid unit of testing effort. The pricing page defines it as "the equivalent of 8 hours of offensive security testing," delivered through a combination of AI-powered automation and human expertise, and says credits "are sold in annual packages that include asset scoping, testing, retesting, platform access, and more." Cobalt's documentation puts it more briefly: "1 credit = 8 pentesting hours."

Cobalt describes the credit as "a virtual voucher that you consume whenever a pentesting need arises." In practice the model has four moving parts:

1. A contract year. Credits are bought in advance through a Sales Order and appear in the account on the contract start date. The documentation notes that credits "are not available prior to that date."

2. A tier. Each account sits on one of three PTaaS tiers, which set the start time, the retest window, the support model and a handful of features. The tier is chosen on the Sales Order.

3. A credit count per test. When a team creates a pentest in the platform, it enters the size of the asset and Cobalt's calculator returns the credits required.

4. A rate per credit. The agreement states that "the price and Tier associated with a purchased Credit will be set forth in an applicable Sales Order."

The cost of a test is the third item multiplied by the fourth; the invoice is the credits bought for the year multiplied by the rate. Cobalt publishes the first three in some form. It does not publish the fourth.

More credits can be added during the year. The pricing page says "credits are available throughout your contract," and the documentation describes an Add Credits request inside the app or through the customer success manager. The agreement adds that credits "will be consumed on a first-in, first-out basis across all active Sales Orders."

What decides how many credits a Cobalt pentest uses

Cobalt's documentation is direct about the driver: "The complexity of your asset determines the number of credits required for a pentest. The bigger the pentest scope, the more credits you need." Complexity is measured with a short list of scoping parameters that differ by asset type.

Two details in the scoping guide affect cost. Backend API endpoints that only populate web pages are tested as part of the web asset, so they may not need a separate API asset. And a combined asset, such as Web plus API or Web plus Mobile, is scoped by adding the parameters of each type.

The second driver is the type of test. Cobalt's pentest setup guide offers three.

The Agile timeline row is the only place we found specific credit counts in the public documentation. At 8 hours per credit, a 3-credit Agile test is 24 hours of testing effort. Cobalt does not publish a typical credit count for a Comprehensive test today, so the number for your application has to come from the in-platform calculator or from a quote.

The report row matters as much as the credit count. An Agile test is cheaper in credits because it is narrower, and its automated report is intended for internal use. A buyer who needs a report for an auditor or a customer is buying a Comprehensive test, which is the configuration to price when comparing quotes.

Standard, Premium and Enterprise: what each tier includes

All three tiers are sold by quote. The differences Cobalt publishes are operational, not monetary.

Every tier includes SAML-based single sign-on, user and group access controls, a methodology and coverage checklist, detailed findings with recommended fixes, real-time collaboration through Slack and the platform, an insights dashboard and attack surface monitoring. The page footnotes the start times: they "may vary depending on type of testing engagement," and the documentation adds that a pentest submitted after 11 AM Pacific needs an additional business day.

The agreement sets two rules for tiers. An account "may only be associated with one Tier at a time," and tiers "may be upgraded, but not downgraded, prior to the end of the Service Period."

The one published price: Cobalt Autonomous Pentest at US$3,500

Cobalt announced its Autonomous Pentest on 23 July 2026, with general availability in August 2026. The pricing page carries a price for it, "$3,500 per test," marked "Limited time offer," and the earliest archived copy of the page that shows it is dated 30 August 2026. The fine print says that "new customers and existing customers on any credit tier are eligible for the promotional $3,500 per test offer," and that an "Autonomous Pentest must be initiated and completed before Dec 31st 2026 in order to qualify."

Four things about that figure are worth knowing before it goes into a budget.

• It is still a credit purchase. A second line of fine print says "the exact number of credits debited from your account may vary based on your contracted rate per credit." The offer fixes the dollar value of a test; the account is debited in credits.

• It expires. The product page answers its own cost question with "Cobalt Autonomous Pentest uses a credit-based pricing model" and "For current pricing, contact the Cobalt sales team." No price is published for tests completed after 31 December 2026.

• The scope is bounded. The documentation lists the prerequisites: an externally facing web application, a small to medium asset of fewer than 50 pages, up to 2 user roles, and username and password authentication without MFA or a magic link. The October 2026 release notes record the page limit rising to 50 pages per test (one documentation page still shows the earlier limit of 25). Only web assets are supported.

• It is not the audit artifact. Cobalt says so plainly: "Cobalt Autonomous Pentest does not produce compliance attestation reports," and "Most major frameworks, including PCI-DSS, SOC 2, ISO 27001, and HIPAA, require human-led pentesting with formal attestation." The documentation for creating an autonomous test adds that the Compliance Audit test goal is not available for it. The documentation does list AI-generated letters and reports for the autonomous option, including an attestation letter, with internal stakeholders as the audience.

What the price includes, per the pricing page: web application testing scoped and launched through the platform, findings in 24 hours with proof of exploit and remediation guidance, direction by Cobalt Core testers on every engagement, results in the platform, integrations with Jira, GitHub, Slack and 50+ tools, and a structured report generated at engagement close. Cobalt notes that many teams use both: autonomous tests for coverage between compliance cycles, human-led tests for attestation. Our guide to whether an auditor will accept an AI pentest covers what examiners ask for.

What Cobalt has published in the past

Cobalt's pricing page has not always been quote-only. The Internet Archive holds dated copies of the page, and they show Cobalt's own published figures changing form several times since 2022.

• April and May 2022. The page listed Standard at "$6,000/Credit" and Premium at "$6,500/Credit" and said "The average Cobalt pentest requires 3 credits." The April captures also defined a credit as "33 pentesting hours" (capture of 15 April 2022).

• June to early December 2022. The credit was redefined to "8 pentesting hours" and the prices became "$1,500/Credit" on Standard and "$1,650/Credit" on Premium. The page said "The average Cobalt pentest requires 12 credits" and "Discounts are available for purchases of 40+ credits or multi-year deals" (capture of 17 August 2022).

• December 2022 to mid 2023. Per-credit prices left the page, replaced by one sentence: "Receive a full compliance test in two weeks by the leading PtaaS authority for as little as $7,500" (capture of 15 December 2022).

• Autumn 2023 to May 2024. The same sentence read "$8,475" in the captures of 23 September and 1 October 2023, then "$8,500 with Starter Packs" from 31 October 2023 to the capture of 20 May 2024.

• June to October 2024. The "as little as" sentence left the page, and a banner advertised a promotion in its place: "start your first pentest on The Cobalt Offensive Security Testing Platform for only $4,950" (capture of 24 June 2024). The archived promotion page described a "Targeted 24 hour (3 credit) pentest," valid only for new customers or customers who had not bought from Cobalt in the prior 18 months.

• December 2024 to May 2026. No dollar figure appears in any capture we read, from 10 December 2024 to 19 May 2026.

• Since August 2026. The US$3,500 Autonomous Pentest offer is the only figure.

Two cautions keep this history useful instead of misleading. First, these are superseded list prices. They say nothing certain about what a credit costs in a 2026 Sales Order, and Cobalt's agreement leaves future prices to "a mutually executed Sales Order." Second, the arithmetic belongs to 2022: both 2022 versions of the page put the average pentest at roughly the same effort and list price, 3 credits of 33 hours at US$6,000 or 12 credits of 8 hours at US$1,500, which is 96 to 99 hours and US$18,000 at Standard list before any discount. Use that as context for a conversation with Cobalt, not as a quote.

Third-party review and procurement sites publish per-credit and per-contract figures for Cobalt today. Those are estimates of what some buyers paid, not Cobalt list prices, and none is repeated here.

Contract terms that change the real cost

The price of a credit is one input. The terms around it decide how many credits you actually get to use. All quotations in this section are from Cobalt's Platform Services Agreement (last updated 1 August 2026), its pricing page or its documentation.

Credits belong to a contract year. The agreement says that unless a Sales Order states otherwise, "Credits must be used by the end of the applicable Service Period, or annual term within a multi-year Service Period." The pricing page FAQ agrees: "Credits do not roll over into the next contract." The tier table lists credit rollover of "Up to 10%" for Enterprise only. If carry-over matters to you, get the percentage and the conditions written into the Sales Order.

The last month is shorter than it looks. Cobalt's contract guide tells customers to "start your pentests at least 30 days before your contract expires," notes that "the standard testing period is 14 days," and asks for findings to be submitted for retest at least 10 days before expiry. After the end date platform access continues for about two weeks (the contract guide says a 15-day grace period, the agreement says fourteen days), but "your remaining credits expire."

Retesting is free inside a window. The pricing page promises "unlimited on-demand retesting throughout your contract term." The documentation gives the window: 6 months on Standard and 12 months on Premium and Enterprise for Agile and Comprehensive tests, "provided your contract is active." The retest end date is either the tier duration or 10 days before the contract end date, and retests are completed within seven days of submission. This is a strong term, and it should be weighed against any quote that charges per retest.

Payment is up front and fast. Cobalt invoices as set out in the Sales Order, and "Customer will pay all fees within fifteen (15) days of the date of the invoice, unless otherwise set forth in the Sales Order," by ACH or wire transfer. Fees exclude taxes.

Renewal and exit. A Sales Order renews automatically for one-year periods only if it "contains auto-renewal triggering language," so read yours for that clause. The agreement provides termination for cause: an individual Sales Order "shall not be subject to termination" except for an uncured material breach, and when a customer terminates for cause Cobalt refunds "any prepaid fees for unused Credits." Future prices are whatever the next mutually signed Sales Order says.

DAST is metered separately. Each tier includes one DAST target. Customers with a DAST subscription are held to the usage limits in their Sales Order, and the agreement allows Cobalt to invoice immediately for overages.

Marketplace listings and public contract records

Cloud marketplaces and government contract databases sometimes show a list price that a vendor's own site does not. For Cobalt, the checks made on 12 November 2026 found none.

• AWS Marketplace. Searches for "Cobalt Labs," "cobalt pentest" and "cobalt.io PtaaS" returned no listing sold by Cobalt.

• Microsoft Marketplace. A search for "cobalt pentest" returned two listings from Cobalt Offensive Security, both for the free Microsoft Teams app that connects a team to its Cobalt pentest. Neither sells testing.

• Google Cloud Marketplace. A search for "cobalt pentest" returned no Cobalt listing.

• US federal contracts. Recipient and keyword searches of USAspending.gov for Cobalt Labs returned no contract awards.

• UK public sector. The G-Cloud catalogue returned 0 results for "cobalt labs."

A search that finds nothing is not proof that nothing exists: private offers on a marketplace are not public, and state, local and reseller contracts are recorded in many places. The practical point is that we found no public price list for Cobalt outside its own website.

How to compare a Cobalt quote with a fixed-price quote

A credit quote and a fixed-price quote describe the same purchase in different units. Converting one into the other takes five steps.

1. Get the credit count per test in writing. Ask Cobalt for the calculator output for each asset: the number of user roles, pages or routes, endpoints or IP addresses it assumed, and the credits that result. Check that the test type is Comprehensive if the report is for an auditor.

2. Multiply by your contracted rate. Credits per test times the rate per credit is the price of that test. Do it for every test planned in the year, then compare the total with the credit package on the Sales Order. Any gap is either headroom or credits at risk of expiring.

3. Convert to hours. Credits times 8 is the testing effort Cobalt has allotted. A fixed-price proposal should state its own effort in tester-days. Our guide to decoding two pentest quotes into scope, days and day rate shows the arithmetic.

4. Match the deliverables. Line up the report type, the attestation letter, the retest window, the start time and the support model. A cheaper Agile test with an internal report is not the same product as a human-led test with an attestation letter.

5. Price the year, not the test. Add mid-year top-ups, the value of unused credits and the cost of retests under each model. For a portfolio, the enterprise PTaaS quote worksheet lays out the columns.

Questions worth sending to Cobalt before signing:

• What is the rate per credit on each tier at our volume, and what discount applies to a multi-year term?

• How many credits does each of our assets consume as a Comprehensive test, and what happens if the scope proves larger during testing?

• What will an Autonomous Pentest cost after 31 December 2026?

• Does our Sales Order include credit rollover, and on what conditions?

• Does our Sales Order contain auto-renewal language, and what is the notice period?

For published prices across the wider PTaaS market, see PTaaS pricing compared. For the penetration testing market as a whole, see the 2026 penetration testing cost guide.

When the credit model is the better buy

Credits are a reasonable answer to a real problem, and a fair comparison says where.

• Many small tests across a portfolio. One annual contract and a self-service platform replace a purchase order per test, and a test can start within 1 to 3 business days.

• Mixed asset types. The same credits pay for web, API, mobile, network, cloud, desktop and AI and LLM tests, so a team does not need a separate statement of work for each.

• Release-driven testing. Agile tests of 3 or 4 credits fit a new feature or a delta test in a 7-day window.

• Long remediation cycles. A 12-month free retest window on Premium and Enterprise suits teams that fix findings over several quarters.

The model fits less well when the testing plan is one or two applications a year, when the scope is hard to forecast twelve months ahead, or when a finance team needs a number before any sales conversation. Those are the cases where a published fixed price is easier to buy.

Stingrai's published prices for the same decision

Stingrai is a CREST-accredited penetration testing company offering fully human-led and hybrid (human penetration testers plus AI agents) penetration tests, delivered by experienced penetration testers who are also world-class security researchers and bug bounty hunters. Its prices for web application testing are fixed and public on the pricing page, and each covers one web application and associated APIs.

• Autonomous Pentest. US$3,000 per assessment, or US$650 a month on a 12-month plan. Testing is run by Snipe, Stingrai's autonomous AI agent for web applications and associated APIs, across up to 200 API endpoints or dynamic pages and up to 3 user roles, with same-day results, automated retests and AutoFix pull requests. The deliverable is a pentest report.

• Hybrid Pentest. US$6,800 per assessment, or US$1,275 a month on a 12-month plan. Snipe and Stingrai's penetration testers test the same application together throughout, adding manual testing, human context for hunting novel bugs and vulnerability chaining to everything in the Autonomous Pentest. The one-time engagement includes 12 monthly vulnerability scans after the pentest; the continuous plan runs monthly Snipe testing, human-verified, with a quarterly deep dive by human penetration testers. The deliverable is a human-validated pentest report and an attestation letter that supports SOC 2, HIPAA and PCI DSS programs.

• Enterprise. Custom quote for a full attack surface: mobile, AI and LLM, cloud, internal and external network, Active Directory, Wi-Fi, phishing, physical and red team work is scoped per engagement, human-led or hybrid, one-time or continuous.

On human-led engagements two named penetration testers, from a team holding OSCE³, OSWE, OSEP and CREST CRT certifications with 18 published CVEs, post each finding to the PTaaS portal as it is confirmed, with a working proof of concept, and stay reachable by live chat during the test. Retesting of remediated findings is included. Both one-time tests and continuous programs are sold, so the choice follows the release rate and the audit calendar instead of the pricing model. The web application penetration testing page describes the method.

Sources: Cobalt's pricing page, documentation and Autonomous Pentest product page, and Stingrai's pricing page, read 13 November 2026. The two autonomous products are built differently, so the row compares published price and scope, not depth. For a fuller side by side, see Cobalt vs Stingrai, and for other platforms, Cobalt alternatives.

Frequently Asked Questions

How much does Cobalt cost in 2026?

Cobalt publishes one price: US$3,500 per test for a Cobalt Autonomous Pentest, a limited time offer for tests initiated and completed before 31 December 2026. Human-led pentests on the Standard, Premium and Enterprise tiers are sold in Cobalt Credits by quote, and Cobalt does not publish the price of a credit or of any tier. The cost of a human-led Cobalt pentest is the number of credits the scope requires multiplied by the rate in your Sales Order.

What is a Cobalt credit?

A Cobalt Credit is a prepaid unit of testing effort. Cobalt defines it as the equivalent of 8 hours of offensive security testing, delivered through a combination of AI-powered automation and human expertise. Credits are sold in annual packages that include asset scoping, testing, retesting and platform access, and each pentest draws down credits according to its scope.

How much does a Cobalt credit cost?

Cobalt does not publish a price per credit. Its Platform Services Agreement says the price and tier of a purchased credit are set out in the Sales Order. Archived copies of Cobalt's pricing page last showed per-credit list prices in 2022, at US$1,500 on Standard and US$1,650 on Premium for an 8-hour credit; those figures are superseded and should not be read as current rates.

How many Cobalt credits does a pentest need?

It depends on the scope. Cobalt sizes a web application by user roles and dynamic pages or routes, an API by user roles and endpoints, a network by active IP addresses and a cloud environment by accounts, unique services and hostnames, and a calculator in the platform returns the credits required. The public documentation gives timelines for Agile tests of 3 or 4 credits and from 5 credits, and no credit count for a Comprehensive test.

Do Cobalt credits expire or roll over?

Credits are specific to each contract year. Cobalt's pricing page says credits do not roll over into the next contract, and its agreement says credits must be used by the end of the service period unless a Sales Order states otherwise. The Enterprise tier lists credit rollover of up to 10%. After a contract ends, platform access continues for about two weeks and remaining credits expire.

Is retesting free with Cobalt?

Yes, inside a window. Cobalt's documentation gives free retesting for 6 months on the Standard tier and 12 months on the Premium and Enterprise tiers for Agile and Comprehensive pentests, provided the contract is active. Findings must be submitted for retest at least 10 days before the contract ends, and retests are completed within seven days of submission.

Can a Cobalt Autonomous Pentest be used for SOC 2 or PCI DSS?

Not as the audit evidence, according to Cobalt. Its product page states that Cobalt Autonomous Pentest does not produce compliance attestation reports and that organizations needing audit-ready proof should use human-led pentesting on the Cobalt platform. The Autonomous Pentest is positioned for coverage between compliance cycles, on web applications of up to 50 pages and 2 user roles.

Is Cobalt on AWS Marketplace?

Searches of AWS Marketplace on 12 November 2026 returned no listing sold by Cobalt, and a search of Google Cloud Marketplace returned none either. Microsoft Marketplace lists a free Cobalt app for Microsoft Teams, which does not sell testing. We found no Cobalt price list outside its own website.

How does Cobalt pricing compare with Stingrai pricing?

Cobalt sells annual packages of credits by quote, with one published price of US$3,500 per Autonomous Pentest for tests completed before 31 December 2026. Stingrai publishes fixed prices for one web application and associated APIs: the Autonomous Pentest is US$3,000 one-time or US$650 a month, and the Hybrid Pentest, with human penetration testers and Snipe testing together, is US$6,800 one-time or US$1,275 a month. Other scopes are quoted by both companies.

Related reading

• Cobalt vs Stingrai: credits vs fixed-price, autonomous testing and retest terms

• Cobalt alternatives: PTaaS platforms compared

• PTaaS pricing compared: published prices and credit models

• Two pentest quotes, 3x apart: decode any proposal into scope, days and day rate

• Enterprise PTaaS pricing for application portfolios: a quote worksheet

• Penetration testing cost: prices by scope and compliance driver

• Web application penetration testing: scope, cost and what you get

• Continuous penetration testing: how it works and cost

• HackerOne Pentest Pricing 2026: Hours, Tiers and the Prices in Public Records

• NowSecure Alternatives (2026): Pricing and Mobile App Penetration Testing Companies

• Best Web Application Penetration Testing Companies (2026): Services Compared

Sources

1. Cobalt. Cobalt Pricing. Read 13 November 2026. cobalt.io/platform/pricing

2. Cobalt. Cobalt Credits, Cobalt PtaaS Tiers, Scope and Test Period, Overview, Remediate Findings, Your Cobalt Contract, Create an Autonomous Pentest and Release Notes: October 2026. Product documentation, read 13 November 2026. docs.cobalt.io

3. Cobalt Labs, Inc. Platform Services Agreement, last updated 1 August 2026. Read 13 November 2026. cobalt.io/terms

4. Cobalt. Cobalt Autonomous Pentest product page. Read 13 November 2026. cobalt.io/services/application-security/autonomous-pentest

5. Cobalt. Cobalt Launches Autonomous Pentest press release, 23 July 2026. cobalt.io/press-release

6. Internet Archive. Captures of Cobalt's pricing page from 13 April 2022 to 6 November 2026, starting with the capture of 13 April 2022.

7. AWS Marketplace, Microsoft Marketplace and Google Cloud Marketplace searches, 12 November 2026.

8. USAspending.gov and the UK G-Cloud catalogue, searched 12 November 2026.

9. Stingrai. Plans and Pricing. stingrai.io/pricing

Talk to Stingrai

Bring the credit quote you are comparing. On a free scoping call Stingrai will size the same application by roles, pages and endpoints, say whether an Autonomous Pentest, a Hybrid Pentest or a human-led engagement fits the audit and the release rate, and put a fixed price next to the credit math. Get a quote or read the published pricing.