A Cobalt alternative built for continuous, steerable testing
Cobalt delivers scheduled, human-run pentests through a marketplace of testers. Operator is a steerable, autonomous agent that runs continuously between engagements, returns exploit-proven findings, and offers a self-serve start with a free first scan so you can begin without a scoping call.
Marketplace engagements versus a steerable agent
Cobalt is a Pentest-as-a-Service marketplace: you buy time-boxed engagements delivered by human testers. Operator is a continuous agent you can steer. The two answer different questions, and the difference shows up in cadence, pricing, and how findings arrive.
| Operator | Cobalt | |
|---|---|---|
| Delivery model | Steerable autonomous agent, human-on-the-loop | Marketplace of human pentesters |
| Cadence | Continuous re-testing | Time-boxed, scheduled engagements |
| Getting started | Self-serve, free first scan | 8-hour credit model, generally a scoping call to convert to scope |
| Pricing | Self-serve on-ramp, free first scan, plans scale by domain & depth | Engagement median ~$30k (third-party estimate) |
| Findings | Exploit-proven: request/response, repro, CVSS v3.1 | Human report per engagement |
| Compliance letter | Human validation on demand | Signed letter per engagement |
Cobalt has also launched Cobalt Autonomous, an AI pentest offering priced around ~$3,500 (third-party estimate). Operator differs in being steerable and human-on-the-loop with a self-serve on-ramp rather than a scoping-call credit model.
Deep, human-delivered engagements with a compliance letter
Cobalt built a mature marketplace of vetted human pentesters, and that is a real strength. When you need a scheduled, deep engagement with a named human team and a signed compliance letter at the end, a PTaaS marketplace is a proven way to get one.
For teams whose primary need is a point-in-time assessment on a fixed calendar, delivered by people, Cobalt is a credible choice. We do not position Operator as a replacement for that work. We position it as the continuous, steerable layer that runs alongside it.
- Vetted human testers. A marketplace of practitioners for scheduled, human-delivered engagements.
- Compliance letters. A signed letter per engagement for auditors and customers who require one.
- Deep point-in-time work. A strong fit when the need is periodic depth on a fixed calendar.
- Established process. A known scoping and delivery workflow many security teams already run.
Continuous coverage between the deep engagements
The gap a scheduled pentest leaves is time. Your attack surface changes every deployment; an engagement every few months cannot see the exposure shipped last Tuesday. Operator closes that gap.
- Continuous, not time-boxed. Operator re-tests as your surface changes, so exposure from drift and routine deploys is caught that week, not at the next scheduled engagement.
- Steerable and human-on-the-loop. A named third category between fully-autonomous and human-validated. It runs on its own for breadth, and a human can steer it at business logic and edge cases when you want.
- Self-serve on-ramp. Start on the free first scan and move up through plans that scale by endpoint volume. No scoping call to convert credits into scope.
- Exploit-proven findings. Every finding ships with the request and response, reproduction steps, and CVSS v3.1 severity. Proof, not probability.
- Recognized method. Structured against OWASP WSTG, API Top 10, and ASVS, PTES, NIST SP 800-115, MITRE ATT&CK, and CVSS v3.1.
- Human validation on demand. Route any finding, or a full run, through a senior practitioner when you want a person's signature on the result.
Common questions
Is Operator a replacement for a Cobalt pentest engagement?
For continuous coverage, yes. Operator runs autonomously and continuously between the deep, scheduled engagements a human marketplace like Cobalt delivers. Many teams keep a periodic human pentest for a signed compliance letter and run Operator to hold the line every day in between.
How does pricing differ from Cobalt?
Operator offers a self-serve on-ramp with a free first scan, then paid plans that scale by endpoint volume. Cobalt's human PTaaS engagements have a median around $30,000 per engagement (third-party estimate) and generally begin with a scoping call to convert credits into scope.
Does Cobalt have an autonomous offering?
As of 2026 Cobalt has launched Cobalt Autonomous, an AI pentest offering priced around $3,500 (third-party estimate). Operator differs in being steerable and human-on-the-loop, with exploit-proven continuous findings and a self-serve on-ramp rather than a scoping-call credit model.
What does steerable mean here?
Operator sits between fully-autonomous and human-validated testing. It runs on its own for breadth, but a human can stay on the loop, directing it at specific business logic, edge cases, and priorities. You keep autonomy's constancy without giving up the ability to steer.
Do I still get evidence I can act on?
Yes. Every Operator finding is exploit-proven and ships with the request and response, reproduction steps, and a CVSS v3.1 severity. It is proof, not probability, so your engineers can confirm and fix without re-triage.
Other alternatives, compared
Every comparison on this site is judged on one thing first: whether each finding ships a runnable proof-of-concept you can re-run yourself. See how Operator tests for BOLA and BFLA.
Add continuous, steerable testing to your program
Keep your deep engagements. Add an agent that holds the line between them, with proof attached to every finding.