Kobalt.io publishes its penetration testing prices, which almost nobody in Canadian offensive security does. Its penetration testing page lists a small web application test at $3,000, medium at $5,750 and a large grey box test at $7,500, with white box engagements "Typically $25,000+" and a retest at "20% of the original cost" inside 3 months. The footer reads "© 2026 Kobalt Security Inc. · Created in Vancouver, available worldwide", the firm states it has served "1,600+ organizations", and its testers are described as OSCP and GWAPT certified. That transparency is the reason Kobalt.io wins shortlists, and it is also the reason its numbers are easy to compare against.
This guide ranks nine alternatives and says plainly where Kobalt.io is still the right answer. Every claim about Kobalt.io below is drawn from Kobalt.io's own pages, and where a figure is not published we write "not published" rather than estimating.
At a Glance: Kobalt.io and the Best Alternatives in 2026
Vendor | HQ | Who tests | Published pentest price |
|---|---|---|---|
Kobalt.io (benchmark) | Vancouver | OSCP and GWAPT certified team | US$3,000 small, US$5,750 medium, US$7,500 large grey box |
1. Stingrai | Toronto, London | Snipe agent plus certified penetration testers | US$3,000 or US$6,800 per assessment |
2. GoSecure | North America | GoSecure consultants | Not published |
3. Cobalt | San Francisco | Cobalt Core, matched testers | Not published, credits only |
4. Forward Security | Vancouver, with a Toronto office | In-house application security team | Not published |
5. Mirai Security | Vancouver, with a Seattle office | In-house consultants | Not published |
6. Vumetric by TELUS | Toronto and Las Vegas | In-house team, no outsourcing | Range only, $5,000 to $100,000 |
7. OKIOK | Laval, Quebec | In-house Canadian consultants | Not published |
8. Intruder | London, UK | Platform plus AI pentesting | From US$3,500 per test |
9. Packetlabs | Toronto, with Calgary, San Francisco and Sydney offices | In-house consultants | Not published |
All cells were verified on each vendor's own pages on 5 September 2026. Source links appear in the full comparison table further down.
What Kobalt.io Sells in 2026
Kobalt.io is a managed security and compliance business with a penetration testing practice attached, not the other way round.
The compliance and managed security core. The services menu spans compliance and audit support for SOC 2, ISO 27001, CMMC, NIST, FedRAMP, GDPR, CCPA/CPRA, PIPEDA, HIPAA, HITRUST, Quebec's Law 25, PCI and CPCSC, plus GRC platform implementation for Vanta, Drata and Scrut Automation, vendor risk assessments, vCISO and data protection officer services, endpoint protection, managed threat detection, and incident response planning. The about page sets the positioning plainly: "Everyone deserves great cyber security. But it is harder than it needs to be."
The testing practice. Kobalt states its pentest team "combines automated scanning tools with hands-on expert analysis on every engagement, and delivers reports your auditor will accept on the first pass." Every engagement starts with automated reconnaissance and scanning, then adds expert analysis to "validate, chain, and exploit what the tools surface". Critical findings are reported the same day they are found rather than held for the final report. Three test types are offered with an explicit house recommendation: grey box "for most web application engagements", because it "provides the best balance of cost and security depth".
Specialised testing covers network, mobile against the OWASP Mobile Top 10, and AI or LLM testing mapped to the OWASP Top 10 for LLM Applications.
The process is published end to end: a 30-minute scoping call producing a fixed quote with "No variable billing", a testing window with same-day critical reporting, report delivery with CVSS scores and reproduction steps, an executive review with the team, and an optional retest. Most small to medium engagements run 2 to 3 weeks from scoping call to final report.
That combination is the product. One Canadian partner that takes a 20-to-500-person company from SOC 2 readiness through the test that the audit requires.
Why Buyers Look for Kobalt.io Alternatives
None of these are defects. They are consequences of a compliance-led business model serving small and mid-sized companies, and all four are verifiable on Kobalt.io's own pages.
1. The pentest is always a separate purchase. Kobalt says so itself: "If you are already running a Kobalt compliance program, a penetration test is the one piece that is always sold as a separate engagement." That is honest, and it means the testing budget does not benefit from the bundle you already bought.
2. Retesting is charged, and it expires. The retest runs at "20% of the original engagement cost" and is "Available within 3 months of the original test". On a US$5,750 medium test that is roughly US$1,150 more, and remediation cycles that stretch past a quarter fall outside the window. Kobalt is explicit that the retest "covers only the findings from the original engagement".
3. No firm-level CREST accreditation is published. Its published tester qualifications block lists an extensive individual credential set including OSCP, OSCE, GWAPT, GMOB, CPTE, CRTP, eMAPT, BSCP and CompTIA PenTest+. It does not list a company-level accreditation, and Kobalt.io does not appear on the CREST Marketplace supplier listing. If firm-level accreditation is written into your requirement, check this first.
4. Remediation automation is not published. The report carries CVSS scores, reproduction steps and remediation guidance, and critical findings arrive the same day. What is not published on any Kobalt.io page is automatic generation of fix pull requests, or a gating check that blocks a vulnerable merge. Engineering-led teams increasingly want the patch proposed in the pull request rather than a finding in a queue.
What Testing Actually Surfaces
Very few providers publish outcome data from their own engagements, which makes the shape of a real finding set hard to reason about during procurement. Stingrai's State of Penetration Testing 2026 analyses 1,206 verified findings across 55 penetration tests. Three numbers matter for this comparison. 92.7% of tests surfaced at least one High or Critical finding, which is the practical argument against treating the annual compliance test as a formality. The false-positive rate across those findings was 0.74%, the benchmark to hold any vendor to when it tells you validation is handled. And the median time to fix a Critical was 10.5 days, which is exactly why a retest window measured in months matters less than how fast the fix reaches the pull request.
The 9 Best Kobalt.io Alternatives in 2026
1. Stingrai
Toronto, Ontario, Canada, with a London, UK office at 1 Coldbath Square, Farringdon. Founded 2021. Offensive security only: penetration testing, red teaming, adversary emulation and AI-augmented PTaaS. Web application and API testing is driven by Snipe, an autonomous web application pentest agent that runs black-box dynamic testing and white-box source review, hunts IDOR, business logic flaws and broken authorization, opens AutoFix pull requests and gates every pull request. Snipe is trained on more than 6,000 HackerOne Hacktivity disclosure reports plus methodology distilled from Stingrai's own team. Certified penetration testers work the same engagement as Snipe at the same time, directing where it focuses and extending the attack paths it opens. Stingrai delivers both annual one-time tests and continuous programs. Reports provide evidence for SOC 2, ISO 27001, PCI DSS 4.0, HIPAA, NIST SP 800-53 and 800-171, DORA and NIS2 programs. Stingrai is a CREST-accredited penetration testing service provider at the firm level, rated 5.0/5.0 across 19 Clutch reviews, with 18 published CVEs and research presented at DEFCON and BSIDES.
The direct comparison is close on price and different on terms: the same US$3,000 entry point, with retesting included in the engagement rather than charged at 20%, white-box source review inside the standard scope rather than a US$25,000-plus upgrade, and a firm-level CREST accreditation.
Published pricing: Autonomous at US$3,000 per assessment or US$450 per month, Hybrid at US$6,800 or US$1,275 per month, each covering exactly one web application and its APIs, retesting included. Every other scope goes through the Get a Quote form. A "No High or Critical Finding = Don't Pay" guarantee applies to the Autonomous tier. Best for: business logic and authorization depth at a published price, annual or continuous. Source: stingrai.io/pricing
2. GoSecure
A North American cybersecurity company whose about page states it has been "pioneering the integration of endpoint, network, and email threat detection into a single Managed Extended Detection and Response (MXDR) service" for "over 20 years". Its professional services line covers penetration testing, PCI DSS services, incident response, security maturity assessment, privacy services and security operations, plus tabletop exercises, threat intelligence briefings and threat emulation. This is the closest structural match to Kobalt.io on this list: testing sold next to continuously managed detection, with GoSecure positioning professional services as "finding the problems" while GoSecure Titan MXDR "make sure to solve them".
Published pricing: not published. Best for: growing Canadian companies that want testing and 24/7 managed detection and response from the same supplier. Source: gosecure.ai
3. Cobalt
San Francisco, US. PTaaS across web, API, network, cloud and AI targets plus secure code review, delivered by the Cobalt Core, a community of vetted testers matched to your stack by the platform. Engagements start within 3, 2 or 1 business days across the Standard, Premium and Enterprise tiers. Cobalt's pricing page states that "A Cobalt Credit is the equivalent of 8 traditional pentesting hours", sold in annual packages, and that "Credits do not roll over into the next contract." The retest term is the strongest published contrast with Kobalt.io: "Our PTaaS model provides unlimited on-demand retesting throughout your contract term."
Published pricing: not published. As of 5 September 2026 the pricing page carries no dollar figure, only credits and tiers. Best for: teams whose remediation runs long and who want retesting uncapped across the year. Source: cobalt.io/platform/pricing
4. Forward Security
Vancouver, British Columbia, with a Toronto office. Its contact page states "We are headquartered in beautiful Vancouver, Canada with reach across North America and Europe", listing 555 W Hastings St, Suite 1200 in Vancouver and 1655 Dupont St, Suite 101 in Toronto. The practice is application and cloud security first: penetration testing for application and cloud, code security and vulnerable dependency analysis, security design review and threat modelling, AI security services against the OWASP LLM Top 10, plus the Eureka DevSecOps platform. Its headline framing is a four-stage application security risk assessment covering discovery, threat modelling, penetration testing and finalisation.
Published pricing: not published. Best for: Vancouver software teams who want threat modelling and code review around the pentest rather than a scoped test on its own. Source: forwardsecurity.com
5. Mirai Security
Vancouver, British Columbia, at 757 West Hastings Street, Suite 142, with a Seattle office at 600 Stewart Street. The nearest local like-for-like to Kobalt.io: incident response, security awareness and human risk, and governance, risk and compliance sit alongside the testing work, with published case studies in payments and manufacturing and sector pages spanning healthcare, mining, logistics, technology, retail and finance. It publishes an incident hotline.
Published pricing: not published. Best for: British Columbia buyers who want a GRC program and an incident contact in the same time zone as the testers. Source: miraisecurity.com
6. Vumetric by TELUS
Toronto and Las Vegas. Vumetric's contact page lists a "Canada - HQ" at 25 York Street, Toronto and a "USA - HQ" in Las Vegas, and the footer describes the business as "Vumetric by TELUS", an "ISO9001-certified platform powered by TELUS security professionals", following the acquisition TELUS announced in May 2024. The catalogue is unusually wide: network, web, mobile and API testing plus cloud, SCADA and ICS, medical device and IoT product testing, red team assessment and social engineering. It states that "All our projects are executed internally", that "A typical project is delivered within 2 weeks", and that its PTaaS platform is available on the AWS and Azure Marketplaces.
Published pricing: a range rather than a price. Vumetric states that "Projects can range from $5,000 for simple tests to $100,000 for larger multi-phase pentests." Best for: Canadian buyers needing regulated hardware and industrial scopes, or bilingual delivery, from one supplier. Source: vumetric.com
7. OKIOK
Laval, Quebec, at 655 Promenade du Centropolis. OKIOK markets itself as "PROUDLY CANADIAN", offering "Products and services that reflect the authentic quality and spirit of Canada's finest engineering", and its history page runs a company timeline back to 1973. Services cover penetration testing and vulnerability assessment, identity compliance as a service, strategic consulting, computer forensics, incident response and governance and compliance, alongside its own RAC/M Identity and S-FILER Portal products, with sector depth in finance, energy, transport and gaming and lotteries.
Published pricing: not published. Best for: Quebec buyers who need French-language delivery and identity governance depth. Source: okiok.com
8. Intruder
London, UK. Its about page states that "Intruder was founded in 2015 to help solve the information overload crisis in vulnerability management", that it was selected for GCHQ's Cyber Accelerator and named on Deloitte's Tech Fast 50 2023 list as the fastest-growing cybersecurity company in the UK, and that it now has "over 3,000 happy customers". The homepage describes "A single platform for AI pentesting, attack surface monitoring, cloud security and vulnerability management. Built for lean security and IT teams." For a Kobalt.io customer, this is the always-on scanning layer between annual tests rather than a replacement for the audit report.
Published pricing: AI-powered web application pentests "Starting from $3,500 / test" on the pricing page. Platform tier prices are not shown. Best for: lean teams that want continuous external scanning with an on-demand test attached. Source: intruder.io/pricing
9. Packetlabs
Toronto, Ontario, with its about page listing a Toronto HQ at 401 Bay Street, Suite 1600 and further offices in Calgary, San Francisco and Sydney. The catalogue is testing-first: web application, API, mobile, AI and LLM and thick client testing, infrastructure, cloud, IoT, attack surface and continuous penetration testing, red teaming, purple teaming, assumed breach and social engineering, plus OT and CIS benchmark assessments. Packetlabs markets a CREST testing service line and states its testing "aligns with frameworks such as PCI DSS, SOC 2, ISO 27001".
Published pricing: not published. Best for: Canadian buyers who have outgrown a scoped SMB test and want a broad manual catalogue including OT and thick client work. Source: packetlabs.net
How It Compares: Kobalt.io Side by Side
Kobalt.io is compared here rather than ranked, because the post is about alternatives to it and a self-referential rank would be meaningless. Every cell below was read from the linked page on 5 September 2026.
Kobalt.io | Stingrai | Source | |
|---|---|---|---|
HQ | Kobalt Security Inc, "Created in Vancouver, available worldwide" | Toronto, Ontario, with a London, UK office at 1 Coldbath Square, Farringdon | |
Core business | Managed security and compliance, with a penetration testing practice | Offensive security only | |
Who tests | "OSCP and GWAPT-certified" team | Certified penetration testers working concurrently with Snipe | |
Published price | US$3,000 small, US$5,750 medium, US$7,500 large grey box; white box "Typically $25,000+" | US$3,000 Autonomous, US$6,800 Hybrid, or US$450 and US$1,275 per month | |
Scope covered by the published price | Web application by size band, black box or grey box | One web application and its APIs | |
White-box source review | Priced separately, "Typically $25,000+", scoped on a call | Included: Snipe reads application source alongside dynamic testing | |
Retesting | 20% of the original cost, within 3 months, original findings only | Included in the engagement; automated retests on the Autonomous tier | |
Turnaround | "most engagements complete in 2 to 3 weeks" | Scoped per engagement; Autonomous returns same-day results once launched | |
Critical finding reporting | Same day, not held for the final report | Live findings in the PTaaS portal | |
Fix automation | Not published | AutoFix pull requests | |
Merge protection | Not published | Gating check on every pull request | |
Findings guarantee | Not published | "No High or Critical Finding = Don't Pay" on the Autonomous tier | |
Firm-level accreditation | Not published; individual credentials only | CREST-accredited penetration testing service provider | |
Adjacent services | SOC 2, ISO 27001, CMMC, FedRAMP, HIPAA, PCI, Law 25 support; Vanta, Drata and Scrut implementation; vCISO; managed threat detection | Penetration testing, red teaming and adversary emulation | |
Scale claim | "1,600+ organizations served" | 18 published CVEs, 5.0/5.0 across 19 Clutch reviews |
Where Kobalt.io Is the Better Choice
Honest answer, and it is a strong one for a specific buyer.
You are buying a compliance program, not a test. If your real project is "get to SOC 2 Type II", the pentest is one artifact among many. Kobalt.io implements Vanta, Drata or Scrut, runs the readiness work, supplies a vCISO, answers the security questionnaires and books the test. Coordinating that across four vendors costs more than the discount you would gain by buying testing separately.
You want threat detection running afterwards. Managed threat detection, endpoint protection and an incident response plan sit in the same catalogue. A specialist testing firm hands you a report and leaves.
Published pricing without a sales call. Three test types, three size bands, a stated recommendation of grey box for most applications, and a fixed quote with "No variable billing". Very few firms in Canada put that on a public page, and it is genuinely useful even if you buy elsewhere.
Canadian and Quebec regulatory breadth for an SMB. PIPEDA, Law 25, CPCSC and HITRUST appear next to SOC 2 and ISO 27001. That is unusual coverage at this company size.
If your constraint is instead depth on one application's authorization model, retesting that does not expire or carry a surcharge, source review inside the standard price, or fixes that arrive as pull requests, the firms above are built for that.
Buyer Checklist
Run these against every quote, including Kobalt.io's. Ask for written answers.
Is the retest included, charged, or time-limited? A retest at 20% with a 3-month window is a different product from retesting included in the engagement.
Is source code in scope at the published price? White box priced as a separate tier changes the comparison entirely.
Who performs the test, and are they employees? Get the staffing model, not just the certification list.
What does the AI actually do? Scanning and triage, or exploitation and chaining. Our AI pentesting tools comparison sets out how to tell.
How do fixes reach engineering? A ticket, or a pull request with a patch and a gate on the next merge.
Is the firm accredited, or are individuals certified? Different claims. Read our guide to verifying CREST accreditation.
Which exact control does the report satisfy? Match it to the clause your assessor will cite, whether that is PCI DSS 4.0 Requirement 11.4 or SOC 2 CC4.1.
What happens at renewal? Ask for the second-year price in writing before you sign the first.
Run your scope through the penetration testing cost calculator before you collect quotes, and see our average cost of a pentest in Canada for the wider benchmark.
Frequently Asked Questions
What are the best Kobalt.io alternatives in 2026?
The nine strongest alternatives are Stingrai, GoSecure, Cobalt, Forward Security, Mirai Security, Vumetric by TELUS, OKIOK, Intruder and Packetlabs. Stingrai ranks first for buyers who want business logic and authorization depth at a published price, matching Kobalt.io's US$3,000 entry point while including retesting and white-box source review in the engagement. GoSecure is the pick for buyers who want testing beside managed detection and response, and Cobalt for teams whose remediation cycles run long enough that unlimited retesting matters.
How much does a Kobalt.io penetration test cost?
Kobalt.io publishes the figures. Black box and grey box web application tests are priced by scope size at US$3,000 small, US$5,750 medium and US$7,500 for a large grey box test, with a "Plus" band and white box, network, mobile and AI or LLM tests scoped individually. White box work is described as "Typically $25,000+". Kobalt states that "All pricing is fixed. No variable billing", and that a retest inside 3 months costs 20% of the original engagement.
Is Kobalt.io CREST-accredited?
Kobalt.io does not publish a firm-level CREST penetration testing accreditation on its own pages. Its published tester qualifications block lists individual credentials including OSCP, OSCE, GWAPT, GMOB, CPTE, CRTP, eMAPT, BSCP and CompTIA PenTest+. Check the CREST Marketplace directly before treating any accreditation claim as verified. Among the alternatives here, Stingrai holds a firm-level CREST accreditation as a penetration testing service provider, and Packetlabs markets a CREST testing service line.
Where is Kobalt.io based?
Vancouver, British Columbia. The site footer reads "© 2026 Kobalt Security Inc. · Created in Vancouver, available worldwide", and the same line appears on the contact page. Kobalt.io does not publish a founding year on its own pages, so treat any year you see quoted elsewhere as unverified.
Does Kobalt.io include retesting?
Not in the engagement price. Kobalt.io offers a retest at "20% of the original engagement cost", "Available within 3 months of the original test", covering only the findings from the original engagement rather than a re-scoped assessment. By comparison, Stingrai includes retesting in both published tiers, and Cobalt commits to "unlimited on-demand retesting throughout your contract term".
Which alternative is best for a company running SOC 2 and ISO 27001 at the same time?
If you want one partner across readiness, tooling and testing, Kobalt.io itself is hard to beat and GoSecure is the closest alternative with the same shape. If the compliance work is already covered and you need the test to be the strongest artifact in the file, buy testing from a specialist: Stingrai's penetration testing supports SOC 2, ISO 27001, HIPAA, PCI DSS 4.0, NIST SP 800-53 and 800-171, DORA and NIS2 programs, whether you buy a single annual engagement or a continuous program. Our guide to the pentest evidence auditors accept sets out what to check in either case.
Which Kobalt.io alternative publishes a fixed price?
Two, plus one range. Stingrai publishes US$3,000 per Autonomous assessment and US$6,800 for Hybrid, each covering exactly one web application and its APIs, with monthly equivalents of US$450 and US$1,275 and retesting included. Intruder publishes AI-powered web application pentests "Starting from $3,500 / test". Vumetric publishes a $5,000 to $100,000 range as guidance rather than a price. GoSecure, Cobalt, Forward Security, Mirai Security, OKIOK and Packetlabs all quote every engagement.
Do I need grey box or white box testing?
Kobalt.io's own recommendation is a good default: grey box "for most web applications", because credentials and documentation let a tester reach authenticated vulnerabilities, privilege escalation and broken authorization, which is where most real breaches start. White box adds source code and finds design-level flaws, but at Kobalt.io it moves you from a US$5,750 line item to a "Typically $25,000+" engagement. Worth knowing that some vendors include source review inside the standard price: Stingrai's Snipe reads application source alongside dynamic testing at the published US$3,000 and US$6,800 tiers.
What should a Canadian SMB budget for its first penetration test?
Published numbers give you a defensible range. Kobalt.io lists US$3,000 for a small grey box web application test, Stingrai lists US$3,000 for an Autonomous assessment of one web application and its APIs and US$6,800 for the Hybrid tier, and Intruder lists AI pentesting from US$3,500 per test. Vumetric publishes a $5,000 to $100,000 range across all project types. Anything materially below those figures is usually a vulnerability scan rather than a penetration test, and our Canadian pentest cost guide breaks down what drives the difference.
Related Reading
The Bottom Line
Kobalt.io does something most Canadian security firms will not: it puts its prices on a public page, recommends the cheaper test type for most buyers, and says out loud that the pentest is a separate purchase even inside a compliance program. For a 20-to-500-person company trying to reach SOC 2 without hiring a security team, that honesty plus the surrounding vCISO, GRC and threat detection work is a genuinely good deal.
Buyers keep comparing because the retest carries a 20% surcharge and a 3-month clock, source review sits behind a much larger price band, and fix automation is not part of the service. For business logic and authorization depth at the same US$3,000 entry point, with source review and retesting inside the price, the patch proposed in the pull request and a guarantee on the Autonomous tier, Stingrai is the closest like-for-like upgrade. Compare packages on the Stingrai pricing page, book a free scoping call, or send your scope through the Get a Quote form.
