Cobalt Features in 2026: PTaaS, DAST, ASM, AI & Integrations

Cobalt is a pentesting-as-a-service (PTaaS) platform with more moving parts than its category label suggests. It combines a managed human-pentester program with AI-assisted reconnaissance, web and API DAST, attack-surface monitoring, secure code review, integrations, planning, and reporting. The practical question is not whether Cobalt has features. It does. The useful question is which features are a platform capability, which are a separately scoped service, and which are gated by plan.

This guide explains Cobalt features as an operating system for an offensive-security program: what happens before testing starts, what engineers see while it is in flight, what can run continuously, and where the platform stops. The details below reflect Cobalt’s published materials as checked in July 2026.

TL;DR: Cobalt Features at a Glance

Cobalt is a credible option for organizations that want a managed PTaaS program with human testers and recurring runtime coverage in one place. CodeAnt AI is the clearer choice for teams that want code-aware, continuous offensive testing that starts from the repository and charges only when it produces a working proof-of-concept exploit.

What Are Cobalt’s Main Features?

Cobalt’s core feature is managed penetration testing delivered through a SaaS platform. Customers define an asset and its scope, Cobalt assigns a lead and specialists from its Cobalt Core network, findings arrive during the engagement, and the team remediates and sends a finding back for validation. Around that workflow, Cobalt sells automated scanning, monitoring, source-code review, integrations, reports, and planning.

That distinction matters because the feature list is not one uniform product bundle. A web-app pentest, a DAST target, a code review, and a red-team engagement are different kinds of work. The platform centralizes them; it does not erase their separate scope or commercial terms.

Cobalt PTaaS: The Engagement Workflow Behind the Platform

Cobalt organizes manual testing into a lifecycle: discover, plan, test, remediate, report, and analyze. The platform’s value is most visible in the handoffs between those steps, rather than in the final PDF alone.

Discover: assets, access, and the right testing team

Before the test, the customer maps the attack surface, supplies access and test accounts where necessary, and identifies the environment. Cobalt says its PenOps team assigns a Cobalt Core lead and domain experts matched to the technology stack. For an application test, that can include web applications, APIs, mobile apps, desktop applications, or AI and LLM systems; the broader service catalogue also covers internal and external networks, cloud, red teaming, and digital-risk work.

This is a material feature, not admin work. A thin scope creates a thin pentest, even when the tester is excellent. Buyers should ask how Cobalt counts an asset, whether APIs and supporting hosts fall inside the chosen scope, which environments are in bounds, and who owns credentials and testing windows.

Plan: scoping and scheduling without a procurement reset

Cobalt offers a planning wizard and calendar-style planning for pentest programs. Its platform data sheet frames this as a way to plan annual coverage, resources, and budget; its application-pentest page describes a kickoff that aligns timeline and final scope. Reusable asset data can reduce setup effort for a later engagement, which is helpful when a release changes a known application instead of creating a net-new target.

The limitation is straightforward: a planner makes a scheduled testing program easier to run, but it does not turn an annual cadence into continuous coverage. Teams that ship frequently should decide early whether their risk model needs a scheduled assessment, recurring runtime scanning, or continuous versus annual pentesting as complementary layers.

Test and remediate: live findings, not a report at the end

During a Cobalt PTaaS engagement, findings are posted in the platform as they are identified. The pentest lead can communicate with the customer’s security team, while integrations can send the issue into the engineering tracker. This means developers can begin remediation before the final report lands, rather than treating the report as the first time they hear about a critical vulnerability.

For a buyer, ask to see a real finding: severity, affected endpoint or component, proof, remediation guidance, discussion, status change, and ticket synchronization. A finding workflow is useful only if the evidence and ownership make it actionable for the people who will fix it.

Retest, report, and analyze

When a customer marks a finding ready for retest, Cobalt says the pentest lead verifies the remediation and updates the report. Its current platform data sheet advertises a seven-day retesting SLA. Reports can be prepared for technical teams, executives, auditors, and customers, while the Insights Dashboard is intended to show longer-term findings and remediation trends.

That closes the loop for a managed engagement. It is worth separating this from automated DAST validation: both can help verify a fix, but a manual retest can reassess the exploit path and compensating controls that a scanner cannot reliably infer.

Human-Led, AI-Powered Pentesting: What the AI Actually Does

Cobalt describes its approach as human-led and AI-powered. On its AI-powered pentesting page, it says automation handles early attack-chain work: reconnaissance, asset discovery, credential validation, active scanning, and finding triage. The stated goal is to give pentesters more time for complex exploitation, creative adversarial techniques, and business-logic abuse.

Attack-surface discovery and route enumeration

Cobalt says its autonomous reconnaissance maps hidden APIs, subdomains, externally exposed assets, old endpoints, administrative portals, backup files, and JavaScript-rendered routes. This is the kind of wide enumeration that benefits from automation: the candidate target set can be large and change faster than a human can manually inventory it.

Discovery improves coverage, but it is still a starting point. A discovered endpoint needs context: whether it is in scope, whether it is reachable in the intended environment, and whether it creates a meaningful attack path. That is where a human tester’s judgment and a customer’s application knowledge remain essential.

Scanning and triage before exploitation

Cobalt’s AI materials position scanning and triage as acceleration layers. Automation can check common exposure patterns, validate credentials, and gather evidence; the pentester decides whether a finding is real, exploitable, and material. This is the right way to evaluate the feature. Ask about validation, false-positive handling, and who owns the final severity—not whether the tool uses the word AI.

Autonomous Pentest

Cobalt also markets an Autonomous Pentest offering for broader application coverage. Its application-pentest page says customers can launch it in minutes, get findings in 24 hours, and have Cobalt Core pentesters direct each engagement. Treat the exact launch, reporting, asset eligibility, and human-review terms as product-specific questions during evaluation; they are not automatically the terms of a standard human-led pentest.

Cobalt DAST: Continuous Scanning for Web Applications and APIs

Cobalt DAST is the platform’s continuous runtime-testing layer. It scans web applications and APIs while they are running, including domains, subdomains, and standalone API targets. Cobalt lists authenticated scans, application and API fingerprinting, crawl reports, finding APIs, remediation validation, and an average scan time of about two hours.

Authenticated scanning and modern application paths

Authenticated DAST matters because the highest-value application surface is often behind login. Cobalt supports authenticated scanning and has introduced workflow features such as sequence recording and recurring scan scheduling. In practice, buyers should test this against their own login method, MFA constraints, tenant boundaries, API authentication, and single-page application behavior. “Supports authenticated scans” is not the same as “will cover our most complex user journey without configuration.”

DAST and manual pentesting are complementary

DAST is best at repeating runtime checks at a frequency a human engagement cannot match. A manual pentest is best at analyzing authorization, business logic, chained weaknesses, and unusual attack paths in a defined scope. Cobalt explicitly positions its DAST alongside PTaaS, not as a replacement for it. The same distinction applies to source-code tools: SAST and DAST answer different security questions, so a serious application-security program normally needs a deliberate blend.

Remediation validation and target economics

Cobalt says DAST can retest a specific vulnerability without an additional charge. Its pricing comparison includes one DAST target, with extra targets available for purchase. The commercial question is therefore not just “does DAST come with Cobalt?” It is how Cobalt defines a target: whether production and staging are separate, whether an API is an additional target, how many domains are attached to one application, and what happens when the asset inventory grows.

Attack Surface Monitoring: Inventory First, Testing Second

Cobalt’s Attack Surface Monitoring (ASM) gives customers continuous visibility into external assets. Its product update describes visibility across external-facing web assets and security checks for exposed credentials, generic tokens, weak cipher suites, missing security headers, and takeover risk. The platform data sheet places ASM beside DAST as automated coverage around the human testing program.

What ASM is good at

ASM is a practical way to identify unknown or neglected externally exposed systems, then prioritize the ones that should receive DAST or a deeper pentest. It can also make a planning conversation more honest: a team cannot credibly claim full test coverage if it does not know what it exposes.

What ASM is not

ASM does not replace a manual assessment of authorization, business logic, or internal trust boundaries. It does not prove that a critical asset is safe merely because basic checks are clean. Think of it as the map and the alarm system; the pentest is the focused investigation.

Secure Code Review: Where Cobalt Uses SAST and SCA

Cobalt’s Secure Code Review is a human-led examination of source code supported by automated static application security testing (SAST) and software composition analysis (SCA). The automated layer can surface patterns and dependencies at scale; the human reviewer can evaluate exploitability, application context, and code paths that would be hard to judge from a rule match alone.

The buying boundary is important. Secure Code Review is a service in the Cobalt catalogue, not a standalone self-serve SAST tool that continuously comments on pull requests. That makes it useful for a focused review, a sensitive release, or a compliance-driven assessment. It is a less direct match for a team that wants code security, quality feedback, and offensive testing to operate continuously in the developer workflow.

That is where CodeAnt has the clearer advantage. CodeAnt connects code-aware security review to the repositories where developers already work, then backs it with offensive testing rather than making source-code review a separately scoped engagement. For the direct feature and workflow comparison, see CodeAnt AI vs Cobalt.

Cobalt Integrations, API, and Developer Workflow

Cobalt’s collaboration features are designed to avoid a separate vulnerability inbox. The company lists integrations with systems such as Jira, GitHub, Azure DevOps, ServiceNow, and Slack, alongside API access. Its Integration Builder is a low-code or no-code workflow tool for sending Cobalt findings to external systems; Cobalt’s 2024 release notes said it supported 50-plus integrations plus webhooks and direct API access.

Ticket routing and collaboration

For a security team, the integration feature matters when it preserves context: a ticket should include enough evidence, ownership, severity, and remediation detail that engineering does not have to switch back and forth between systems. Cobalt supports real-time communication with testers and its platform materials describe native connections to work-management and developer tools. Confirm the behavior that matters in your process, especially bidirectional updates, duplicate handling, status mapping, and whether a ticket stays synchronized after a retest.

API access and programmatic reporting

Cobalt documents API access for platform data such as assets, pentests, and findings. This can be useful for teams that need to feed a vulnerability program, reporting pipeline, or internal dashboard. It should be evaluated like any other integration: inspect the endpoints, event/webhook behavior, authentication model, rate limits, and the fields that are actually available for your plan.

Plan gates are features too

Cobalt’s pricing tiers qualify the integration story. Its public comparison shows native integrations and customizable reports on higher tiers, while base platform capabilities such as role access controls, SSO, detailed findings, real-time collaboration, Insights, ASM, and one DAST target appear more broadly. The exact entitlement can change, so make the sales team put the required integrations and report format in the order form rather than treating a product-page logo as a guarantee.

Reporting, Compliance, and Program Management

Reporting is more than a PDF in Cobalt’s model. The platform aggregates findings, supports status changes and retesting, and offers program-level insight through its dashboard. Cobalt also describes report formats for executive, auditor, and customer audiences, plus attestations for relevant pentest work.

For compliance-focused buyers, that makes Cobalt a sensible managed-program option. The decision should still start with the actual requirement: which framework needs evidence, which assets need testing, whether a letter of attestation is required, how often coverage must be renewed, and who will own remediation. Compliance does not make a shallow test deeper; it simply makes the output easier to organize.

Where Cobalt Fits—and Why CodeAnt Is the Stronger Choice for Product Teams

Cobalt is a neutral, capable fit for an organization that wants an external PTaaS provider to coordinate human pentesters, schedule scoped work, monitor its attack surface, add DAST, and route results into established security operations.

CodeAnt AI is the obvious winner for product teams that want security to begin with code context and end with demonstrated risk. CodeAnt’s AI pentesting offer has a $0 engagement fee, payment only when a working proof-of-concept exploit is delivered, an audit-grade report in 48 hours, and free unlimited rescans. That ties commercial value to an exploitable result, rather than to a separate scoped code-review service or a broad credit model.

The choice is not “Cobalt has features, CodeAnt has features.” It is a workflow decision. Choose Cobalt when the operating model is a managed human-pentester program. Choose CodeAnt when your team needs code-aware, continuous security work that fits how software actually ships—and wants a provider to prove an exploit before charging for it.