$ pricing --vendor=cobalt

Cobalt.io pen-test pricing for 2026. No public pricing. We do not invent a number. This page documents what is publicly stated and what to ask in the scoping call.

$ answer --question="What does Cobalt.io charge for a pen test?"

Cobalt.io does not publish a starting price. Quote only, contact vendor. Source: https://www.cobalt.io/pricing. Verified June 2026. Treat any third-party dollar figure attributed to Cobalt.io with caution.

Last verified June 2026

$ status --quote-only

Why this vendor is quote-only

Cobalt.io routes every published tier or product to a sales call. The reason varies by vendor: enterprise-only positioning, multi-asset scoping that resists line-item pricing, or compliance bundling where the pen test sits inside a wider SOW. Whatever the reason, no one outside Cobalt.io can quote you a number without that call. We will not invent one.

contact Cobalt.io →

$ list --tiers

Published tier structure. Prices shown only where Cobalt.io publishes a number. Quote-only tiers are labelled as such; we do not estimate.

$ tiers --vendor=cobalt

Tier	Price	Notes
Standard	quote	Annual pentest for compliance, 3-day start
Premium	quote	Structured programme, 2-day start
Enterprise	quote	Scaled programme, 1-day start

Source: https://www.cobalt.io/pricing · verified 2026-06-19

$ best-for --buyer

Mid-market and enterprise buyers running a continuous pen-test programme across multiple assets through one vendor.

Scope fit

web-app
api
mobile-app
cloud
network

$ hidden --costs

Line items that often do not appear in the headline Cobalt.io quote. Confirm each against the SOW before signing.

Retest fee
Whether retesting fixed findings is included in the headline price or charged as a separate engagement. Ask before signing.
Out-of-hours testing
If you need testing outside business hours to avoid production impact, that often carries a premium of 25 to 50%.
Report format and depth
Executive summary, full technical report, attestation letter for auditors. Some vendors bundle all three, some charge for the attestation separately.
Travel and on-site
Internal-network or physical pen test usually requires on-site days. Travel is normally billed at cost.
Bug-bounty payouts
Not applicable here. Bug bounty is not part of the standard engagement.
Re-scope mid-engagement
If discovery uncovers new in-scope assets, expect a change-order conversation. Cap the change-order rate in the master agreement.

$ vendor --notes

Cobalt publishes the credit unit but not the credit price. Any third-party estimate of credit cost is not a Cobalt figure.

$ nearest --alternatives

Closest comparable vendors to Cobalt.io. We pair on pricing model and product fit.

$ alt --slug=synack
Synack
PtaaS
Hybrid PtaaS plus managed-service vendor. Markets a 32% lower-cost claim against traditional pentest but publishes no rates.
open synack-pricing →
$ alt --slug=astra
Astra Security
PtaaS
PtaaS vendor with a fully published price card. One of the few firms in this index where the headline number does not depend on a sales call.
open astra-pricing →