Is Cobalt.io profitable in 2026?

Cobalt has not disclosed profitability. It has raised no new equity since a $29M Series B in August 2020, and no valuation or profit figures have been made public as of mid-2026, which is consistent with either quiet break-even or a company preparing for a sale.

Could AI replace Cobalt.io's human pentesters?

Partially. Agentic tools like XBOW, Synack's Sara, and Horizon3.ai already automate scoping and exploit discovery, shipped as of 2025-2026. Cobalt's compliance-driven human attestation for PCI DSS, HIPAA and SOC 2 still requires certified human testers, but that seal is narrowing as continuous-validation demand grows.

Cobalt.io, legal entity Cobalt Labs Inc, is privately held and venture-backed. Its last disclosed round was a $29 million Series B led by Highland Europe in August 2020. No new equity round has been publicly reported since then as of July 2026.

Who is Cobalt.io's biggest competitor?

Cobalt competes directly with HackerOne, Bugcrowd, Synack, NetSPI, and Pentera in crowdsourced pentesting-as-a-service. Newer AI-native entrants XBOW and General Analysis, shipped by 2026, target the same continuous-validation segment with fully agentic testing.

How many customers does Cobalt.io actually have?

Cobalt's own site claims over 1,500 customers as of January 2026, though the company's December 2025 press release reported only 7% customer growth that year, and third-party trackers put the figure closer to 600, an unreconciled discrepancy.

Has Cobalt.io raised any new funding recently?

No. Cobalt's most recent disclosed institutional round remains the $29 million Series B from August 2020, led by Highland Europe. As of July 2026 no new equity round has been publicly reported, a six-year gap.

Cybersecurity companies · United States

Cobalt.io

cobalt.io ↗

Cobalt.io sells human-run pentests as a service, used for compliance sign-off.

Losing its protection

Assessed 21 July 2026 · Evidence as of 21 July 2026

The structural protection is eroding.

On the recordSince 21 July 2026 · Checkable from within 6-12 months · Every call on the record Checkpoint: Any announcement of new equity funding, sale, or down-round for Cobalt

The call

Cobalt still leans on compliance rules that require a human tester's signature, but its growth has slowed while AI-native rivals scale faster and cheaper.

Cobalt.io lets companies hire vetted human testers to find security holes in their software and systems, with official paperwork (compliance signatures) that regulated industries need. The problem is that new AI-powered hacking tools like XBOW, Pentera, and Horizon3.ai can now do continuous, always-on testing cheaper and faster, which is what customers increasingly want instead of Cobalt's annual human-run tests. The company has not raised new money in six years and just replaced its CEO and top engineers, which suggests the business is either barely breaking even or being prepared for sale, and that outcome tells you whether the board thinks AI competitors have already won.

Why

AI pressure: XBOW, General Analysis, Horizon3.ai, Pentera. These agentic pentest tools run continuous automated attacks for a fraction of the cost of human testers, pulling budget from annual pentest contracts. Could AI do the core job? Only partly.

Bigger players: None apparent. No major cloud or security giant has announced a direct pentest-as-a-service push that targets Cobalt's customer base yet. Could a giant copy it? Yes, easily.

What protects it. Auditors for PCI DSS, HIPAA, and SOC 2 still want a human-signed pentest report, which AI tools cannot yet issue.

What would change this call

Cobalt announces a new equity raise, sale, or acquisition within 6 to 12 months. Terms would show whether investors view AI-native pentesting rivals as an existential threat.
A major compliance body (PCI, HIPAA auditor, SOC 2 assessor) formally accepts AI-augmented pentest reports. Would remove Cobalt's human-certification advantage over agentic competitors.
Cobalt's next customer count disclosure clarifies the 600 vs. 1,500+ figures reported across sources. Would confirm whether real growth is stronger or weaker than public claims suggest.

Key numbers

Est. $51M ARR in 2024, up from $28M in 2023 (2025-05-02)
Customer growth slowed to 7% in 2025 (2025-12-18)
No new funding round since $29M Series B in Aug 2020 (2026-07-08)

Named risks

No new equity round in six years since August 2020 Series B, unclear financial health. Severity: high
Agentic AI-native competitors (XBOW, General Analysis, Horizon3.ai) shipped and displacing demand toward continuous validation. Severity: high
Unreconciled discrepancies in customer counts (600 vs 1,500+) and tester counts (500 vs 4,000+) suggest data or marketing inflation. Severity: medium
Human-tester model (500 Core members) faces finite scaling versus AI-native competitors' lower cost base. Severity: medium

Rivals, as read in July 2026

Rival	Direction	Evidence
Synack	gaining on	Markets agentic AI pentesting tool 'Sara' as of 2026-06-30
Pentera	gaining on	Automated continuous-validation model shifting market from annual pentests, 2026-03-14
XBOW	gaining on	Fully agentic web/app pentesting shipped and marketed as substitute, 2026-05-21
HackerOne	contesting	Long-standing crowdsourced pentest and bug bounty rival at similar scale
Bugcrowd	contesting	Crowdsourced testing with managed triage, direct PtaaS peer
NetSPI	contesting	Enterprise-scale PTaaS and attack-surface management platform, named direct peer 2026-06-30

Questions people ask

Is Cobalt.io profitable in 2026?: Cobalt has not disclosed profitability. It has raised no new equity since a $29M Series B in August 2020, and no valuation or profit figures have been made public as of mid-2026, which is consistent with either quiet break-even or a company preparing for a sale.
Could AI replace Cobalt.io's human pentesters?: Partially. Agentic tools like XBOW, Synack's Sara, and Horizon3.ai already automate scoping and exploit discovery, shipped as of 2025-2026. Cobalt's compliance-driven human attestation for PCI DSS, HIPAA and SOC 2 still requires certified human testers, but that seal is narrowing as continuous-validation demand grows.
Who owns Cobalt.io?: Cobalt.io, legal entity Cobalt Labs Inc, is privately held and venture-backed. Its last disclosed round was a $29 million Series B led by Highland Europe in August 2020. No new equity round has been publicly reported since then as of July 2026.
Who is Cobalt.io's biggest competitor?: Cobalt competes directly with HackerOne, Bugcrowd, Synack, NetSPI, and Pentera in crowdsourced pentesting-as-a-service. Newer AI-native entrants XBOW and General Analysis, shipped by 2026, target the same continuous-validation segment with fully agentic testing.
How many customers does Cobalt.io actually have?: Cobalt's own site claims over 1,500 customers as of January 2026, though the company's December 2025 press release reported only 7% customer growth that year, and third-party trackers put the figure closer to 600, an unreconciled discrepancy.
Has Cobalt.io raised any new funding recently?: No. Cobalt's most recent disclosed institutional round remains the $29 million Series B from August 2020, led by Highland Europe. As of July 2026 no new equity round has been publicly reported, a six-year gap.

Timeline

2026-04-09Tony Spinelli, cybersecurity veteran and early investor, joins Cobalt board of directors
2025-12-18Cobalt reports 31,000+ testing days, 255,000+ hours, and 7% customer growth in 2025
2025Gunter Ollmann joins Cobalt as CTO
2024-08-28Sonali Shah becomes CEO, succeeding Chris Manton-Jones
2020-08-20Cobalt raises $29M Series B led by Highland Europe
2013Cobalt founded in San Francisco, pioneering the PtaaS category

Revision history

21 July 2026

First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.

In the same band

Seqrite Meiya Pico NSFOCUS