Cobalt Pentest Pricing in 2026
Cobalt does not publish a price for its credit tiers. Its pricing page shows three tiers (Standard, Premium, Enterprise), defines 1 credit as 8 hours of testing, and sends every tier to a quote. The one figure Cobalt does publish is for its Autonomous Pentest: $3,500 per test, a limited time offer for tests initiated and completed before 31 December 2026.
What Cobalt publishes, and what it does not
- Three credit tiers and what each includes
- 1 credit = 8 hours of testing
- Credits sold in annual packages
- Start times, retest windows and support level by tier
- Autonomous Pentest at $3,500 per test (promo)
- A price for any credit tier
- A price per credit
- How many credits a given asset needs (set per scope)
- Any volume or multi-year discount
Cobalt’s three credit tiers, as published
| Standard | Premium | Enterprise | |
|---|---|---|---|
| Who Cobalt says it is for | A speedy, annual pentest to meet a compliance need or client request | A structured pentest program for compliance and overall security | Scaling pentest programs, more testing frequency |
| Price | Get a quote | Get a quote | Get a quote |
| Start pentest within | 3 business days | 2 business days | 1 business day |
| Free retesting | 6 months | 12 months | 12 months |
| Customer success team | Pool | Named CSM | Named CSM |
| Onboarding support | Live | Live | |
| DAST | 1 target included | 1 target included | 1 target included |
| Strategic program planning | Not listed | Annual | Quarterly |
| Credit rollover (tier table) | Not listed | Not listed | Up to 10% |
Source: cobalt.io/platform/pricing, tier comparison table, read 1 October 2026. Cobalt footnotes the start times: “Start times may vary depending on type of testing engagement.”
Autonomous Pentest: $3,500 per test
Cobalt lists its Autonomous Pentest at $3,500 per test and labels it a limited time offer. Cobalt describes it as pairing AI systems with Cobalt Core pentesters, and lists what is included: web application testing scoped and launched through the Cobalt Platform, findings in 24 hours with proof of exploit and remediation guidance, and Cobalt Core pentester direction on every engagement.
Terms on the page: new customers and existing customers on any credit tier are eligible, and the test must be initiated and completed before 31 December 2026. Cobalt adds that the exact number of credits debited may vary with your contracted rate per credit, which indicates that an existing credit customer pays for the test from its credit balance.
Source: cobalt.io/platform/pricing, Autonomous Pentest section, read 1 October 2026.
How the credit model works
- Unit: one Cobalt Credit is the equivalent of 8 hours of offensive security testing, delivered through AI-powered automation and human expertise.
- Packaging: credits are sold in annual packages that include asset scoping, testing, retesting and platform access.
- Cost per credit: not published. Cobalt says credit cost is set by engagement complexity.
- Credits per asset: not published. Cobalt says it depends on the scope and delivery options of each test.
- Retesting: Cobalt’s FAQ promises unlimited on-demand retesting throughout the contract term; the tier table lists free retesting for 6 months (Standard) or 12 months (Premium, Enterprise).
- Rollover: the FAQ says credits do not roll over into the next contract. The tier table lists rollover of up to 10% on Enterprise only.
- Top-ups: extra credits can be bought mid-year.
Source: cobalt.io/platform/pricing, credit section and FAQ, read 1 October 2026.
Where Cobalt sits: PTaaS, not a consulting SOW
Cobalt sells pentesting as a platform subscription paid in hours of testing, the PTaaS shape. A traditional consultancy instead scopes one engagement and prices it as a project. Our PTaaS vs traditional consulting page sets out when each shape suits a buyer. Because Cobalt prices in 8-hour credits, the useful way to sanity-check a Cobalt quote is to divide it by the credits offered and compare the result with market day rates.
Among the platform vendors we track, three publish prices: Synack (packages from $4,181) and Bugcrowd (standard units from $5,000 on AWS Marketplace) and Astra (pentest plans from $2,999 a year). HackerOne publishes none.
Questions buyers ask
Does Cobalt publish prices for its pentest credits?
No. Cobalt's pricing page lists three credit tiers, Standard, Premium and Enterprise, and every one of them routes to a 'get a quote' button. No dollar figure is attached to a tier or to a credit. Cobalt says credit cost is set by engagement complexity and that the number of credits an asset needs depends on the scope and delivery options of each test.
How much is Cobalt's Autonomous Pentest?
$3,500 per test, shown on Cobalt's pricing page as a limited time offer. New customers and existing customers on any credit tier qualify, and the test must be initiated and completed before 31 December 2026. Cobalt notes that the exact number of credits debited from your account may vary based on your contracted rate per credit. It covers web application testing with findings in 24 hours and Cobalt Core pentester direction on every engagement.
What is a Cobalt credit?
Cobalt defines one credit as the equivalent of 8 hours of offensive security testing, delivered through a combination of AI-powered automation and human expertise. Credits are sold in annual packages that include asset scoping, testing, retesting and platform access, and extra credits can be bought during the contract year.
Do Cobalt credits roll over?
Cobalt's pricing page answers this two ways. Its FAQ says credits do not roll over into the next contract and are specific to each contract year. Its tier comparison table lists credit rollover of up to 10% for the Enterprise tier only. If rollover matters to your budget, get the term written into the order form.
How fast can a Cobalt pentest start?
Cobalt's tier table says a pentest starts within 3 business days on Standard, 2 on Premium and 1 on Enterprise, with a footnote that start times may vary depending on the type of testing engagement.
Sources
- Cobalt pricing pageread 1 October 2026
Credit tiers, tier comparison table, credit definition, FAQ (rollover, retesting, mid-year credits) and the Autonomous Pentest $3,500 offer. cobalt.io/pricing redirects here.
Only the vendor’s own pages and listings are used here. This page carries no estimates from buyer marketplaces, review sites or competitor blogs. See the site-wide sources and methodology.