What is Cobalt?
Cobalt is a Boston-based pentest as a service (PTaaS) platform with a community of 500+ vetted pentesters, Cobalt Core. It tests web apps, APIs, networks, cloud and AI systems, and in 2026 added Autonomous Pentest, an AI-run test with Core pentesters involved in every engagement.
Comparison at a glance
| Aspect | Barrion | Cobalt |
|---|---|---|
| What it tests | Web apps and APIs, including authenticated testing as several users in named roles. 8 testing areas and all 97 OWASP WSTG v4.2 cases | Web apps, APIs, external and internal networks, cloud, AI and LLM apps, red teaming and secure code review |
| How it validates findings | Every finding is checked against the live app. Confirmed ones come with the request and response that prove them. Anything unconfirmed is clearly marked and capped in severity | Human pentesters confirm findings. Autonomous Pentest delivers findings with proof of exploit in 24 hours |
| Continuous and scheduling | On a schedule you set (daily to yearly, or a custom rhythm), every time or only when the app has changed, or on demand. Each run labels findings new, still open, resolved or regressed | Engagements booked from an annual credit package, starting within 1 to 3 business days by tier. Autonomous Pentest priced per test |
| Human involvement | AI agents do the testing. From Standard level up a security engineer reviews the findings, and deeper tests come with a report signed off by that engineer. Retests of found issues are free | Cobalt Core pentesters (500+) do the testing. On Autonomous Pentest they review the execution plan and manage scope |
| Pricing model | Plans and per-run prices are public on the pricing page. Continuous programs are priced through sales | Annual credit packages by quote, one credit being 8 hours of testing. Autonomous Pentest at $3,500 per test, an offer running to 2026-12-31 |
| Self-serve or sales | Self-serve for single pentests. Continuous programs through sales | Sales-led, through a quote or demo |
| Data residency | Stored and hosted in Sweden. AI processing in the EU | Not stated on the pages we checked |
| What it doesn't do | No internal network, Active Directory, mobile, physical or social engineering testing | No self-serve start. Credits don't roll over to the next year |
Cobalt facts checked 2026-09-26 on the vendor's own site: Cobalt, Cobalt pricing, SD Times on Cobalt Autonomous Pentest (2026-07-27).
Who Barrion is best for
Choose Barrion if you want pentests to rerun on your release rhythm rather than once or twice a year, if you want to start a test yourself without buying a credit package, or if you want data stored in Sweden. A common setup is a yearly human pentest with Barrion runs in between, so the months after the report aren't untested.
Who Cobalt is best for
Choose Cobalt if you need human pentesters on the work itself, testing beyond web apps (networks, cloud, AI and LLM apps), red teaming, or a PTaaS contract that auditors and enterprise customers already know. All Cobalt tiers include free, unlimited retesting during the contract term.
Frequently asked questions
Is Barrion a Cobalt alternative?
Partly. For frequent testing of web apps and APIs, yes. For a human-led pentest of networks, cloud or AI systems, or red teaming, no: that's Cobalt's strength. A common setup is a yearly Cobalt engagement with Barrion pentests in between.
How does Cobalt's pricing work compared with Barrion's?
Cobalt sells annual credit packages by quote, where one credit is 8 hours of testing, and its Autonomous Pentest is offered at $3,500 per test until 2026-12-31 (checked 2026-09-26). Barrion's Essential plan starts at €199/month with per-run prices on the pricing page. Scheduled pentests are on the Business plan, priced through sales.
Do both include retests?
Yes. Cobalt includes unlimited retesting during the contract term. Barrion retests of found issues are free: a retest reuses the original scope and stored credentials and holds no credits.
Can a Barrion report replace a Cobalt pentest for compliance?
Sometimes, but it's your auditor's call. Barrion's deeper tests come with a report signed off by a security engineer. Some auditors and enterprise customers still ask for a human-led test, which is where Cobalt fits.
Summary
Cobalt is the stronger pick for human-led pentests across many asset types, bought as an annual credit package. Barrion is the stronger pick for frequent AI pentests of web apps and APIs that you can start yourself, with engineer review from Standard level up. Some teams use both: a Cobalt engagement once a year and Barrion in between.
Explore Barrion further
See how Barrion's AI pentest works on the AI pentesting page, compare more vendors in best AI pentesting tools, or check what each plan includes on the pricing page.