# Cobalt Pricing

##### Modern security testing for all

Cobalt offers a flexible, on-demand [consumption model](https://www.cobalt.io/pricing#cobaltcredits) to meet the modern pentesting needs of all security and development teams. Explore Cobalt’s offerings below to determine the right package for your testing goals.

## Standard

For teams **in need of a speedy,**  
**annual pentest** to meet  
a compliance need  
or client request.

[get a quote](https://www.cobalt.io/get-started-quote)

## Premium

For teams **looking to build**  
**a structured pentest** **program**  
to meet compliance needs and  
improve overall security.

[get a quote](https://www.cobalt.io/get-started-quote)

## Enterprise

For teams **looking to scale their pentest programs** to meet compliance needs, increase testing frequency, and improve overall security.

[get a quote](https://www.cobalt.io/get-started-quote)

#### Compare What's Offered in Each Tier

| Features                                               | Standard        | Premium          | Enterprise        |
|-------------------------------------------------------|-----------------|------------------|-------------------|
| SAML-Based SSO                                       | Yes             | Yes              | Yes               |
| User and Group Access Controls                         | Yes             | Yes              | Yes               |
| best practice methodology + coverage checklist       | Yes             | Yes              | Yes               |
| detailed findings with recommended fixes              | Yes             | Yes              | Yes               |
| real-time collaboration via slack and the platform    | Limited         | Yes              | Yes               |
| Insights Dashboard                                    | Yes             | Yes              | Yes               |
| Attack Surface Monitoring (ASM)                       | Yes             | Yes              | Yes               |
| start pentest within \\* free retesting             | 3 Business Days  | 2 Business Days  | 1 Business Day     |
| customer success team                                  | Pool            | Named CSM       | Named CSM        |
| onboarding support method                              | Email           | Live            | Live              |
| Dynamic Application Security Testing (DAST)           | No              | Yes              | Yes               |
| strategic program planning                             | No              | Yes              | Yes               |
| native integrations (jira, github, etc.)              | No              | Yes              | Yes               |
| customizable reports                                   | No              | Yes              | Yes               |
| Custom Pentester Requests (Geo, Time Zone, Testing Windows) | No         | Yes              | Yes               |
| credit rollover                                       | No              | Yes              | Yes               |

\*Start times may vary depending on type of testing engagement.

## Cobalt Credits Provide a Flexible Consumption Model

A Cobalt Credit is a standardized unit of work that represents 8 pentesting hours. Credits provide flexibility in both [planning and executing pentests](https://www.cobalt.io/services/application-security/pentest). They are sold in annual packages that include asset scoping, retesting, unlimited platform access, and more.

You can think of a Cobalt Credit as a virtual voucher that you consume whenever a manual pentesting need arises, meaning you can get a pentest up and running within days, compared to weeks with traditional services. Instead of being tied to a traditional ‘all in scope’ assessment, you can tailor and distribute the amount of work based on the complexity of your asset(s).

[get a quote](https://www.cobalt.io/get-started-quote)

## FAQ

#### What is a "Cobalt Credit," and how do I know how many I need for a specific asset?

A Cobalt Credit is a standardized unit of work that represents 8 pentesting hours. Credits provide flexibility in both planning and executing pentests. They are sold in annual packages that include asset scoping, retesting, unlimited platform access, and more. The amount of credits required to test a specific asset will depend on the scope of the test. 1 Cobalt Credit equals 8 penetration testing hours.

#### Do credits expire, or can they be rolled over to the next contract year?

Credits do not roll over into the next contract. To keep your momentum going, credits are specific to each contract year. This structure ensures you have a dedicated budget to maximize your results every single year.

#### What is included in "Free Retesting," and are there limits on how many times we can retest?

Our PTaaS model provides unlimited on-demand retesting throughout your contract term. This ensures that every fix your team implements is rigorously validated and that your assets remain secure as you evolve.

#### Can we purchase additional credits mid-year if our attack surface grows unexpectedly?

Yes, credits are available throughout your contract which enables teams flexibility in case of last minute product launches or security concerns arise.

###### GET STARTED

## Ready to up-level your offensive security?

Empower your security and development teams with Cobalt’s unique combination of a modern SaaS platform and our community of vetted security experts. Trust the pioneers of PtaaS as your offensive security partner across your entire attack surface.

[Schedule a demo](https://www.cobalt.io/get-started)