Cobalt Offensive Security Platform

What it does

The Cobalt Offensive Security Platform is a penetration testing as a service (PTaaS) platform for launching pentests of web applications, APIs, networks, cloud environments and AI applications, tracking findings in real time and routing them into remediation tools. Its distinguishing mechanism pairs the Cobalt Core, a vetted community of more than 500 pentesters, with Cobalt Sage AI, which automates reconnaissance, scanning, triage and report writing. Cobalt Autonomous Pentest adds AI-executed web application pentests that return proof-backed findings within 24 hours under Core pentester oversight.

How it works

Customers buy Cobalt Credits in annual packages, each worth 8 hours of testing, and spend them on Comprehensive, Agile or Autonomous pentests scoped through an in-platform wizard without a new statement of work. Pentesters post findings with proof of exploitation as they go in a Slack or Microsoft Teams channel, and a no-code Integration Builder pushes them into Jira, GitHub, ServiceNow and more than 50 tools. Fixed findings are retested within seven days, free for six or twelve months, while a Dynamic Application Security Testing (DAST) scanner and an Attack Surface monitor cover web applications and APIs between manual tests.

Credentials and traction

Cobalt is SOC 2 Type II and ISO 27001 certified and holds CREST penetration testing accreditation. GigaOm named Cobalt a 2025 Radar Leader for Pentest as a Service (PTaaS) for the fourth consecutive year, and Gartner listed it as a PTaaS Sample Vendor in three 2026 Hype Cycles. Thousands of customers, from startups to enterprises, including Pendo and Vonage, use the platform, which won the 2026 Fortress Cybersecurity Award for Continuous Exposure Management and delivers more than 5,000 pentests annually.