How does Vulnix pricing compare with Cobalt?

Vulnix starts with a free trial, then plans from $99/mo. Each action costs a flat number of credits: a quick scan is 25, a deep pentest 100, a whitebox pentest 150 and a PR review 15. Cobalt: web app pentests from about $8,500.

Can I use Vulnix and Cobalt together?

Yes, and it's a common setup: a human-led pentest for the compliance report once or twice a year, with Vulnix covering every release in between.

Vulnix vs Cobalt

Cobalt matches your scope with vetted human pentesters for scheduled engagements. Vulnix is an autonomous pentester you can run yourself, any time and on every pull request.

Start free See pricing

Choose Vulnix if

You want continuous testing between engagements, results in hours instead of weeks, and a predictable flat price per run.

Choose Cobalt if

You need a scheduled, human-delivered pentest with an auditor-ready report signed off by testers.

Side by side

How Vulnix and Cobalt compare

Capability

Vulnix

Cobalt

Delivery model
Self-serve SaaS: sign up and launch a pentest in minutes
Pentest-as-a-service delivered by human testers
Delivery model
Self-serve SaaS: sign up and launch a pentest in minutes
Pentest-as-a-service delivered by human testers
Starting price
Free trial, then from $99/mo, with flat credits per action
Web app pentests from about $8,500
Starting price
Free trial, then from $99/mo, with flat credits per action
Web app pentests from about $8,500
When tests run
On demand at any time, plus on every pull request
Scheduled engagements, launching in about 24 hours
When tests run
On demand at any time, plus on every pull request
Scheduled engagements, launching in about 24 hours
Exploit-validated findings
YesEvery finding ships with reproduction evidence
YesProofs of concept from human testers
Exploit-validated findings
YesEvery finding ships with reproduction evidence
YesProofs of concept from human testers
Live web app & API testing
YesAuthenticated blackbox runs against your verified domains
YesWeb, mobile, API, network and cloud, by scope
Live web app & API testing
YesAuthenticated blackbox runs against your verified domains
YesWeb, mobile, API, network and cloud, by scope
Fix pull requests
PartlyOne-click fix PR for whitebox findings that carry a patch
NoNo
Fix pull requests
PartlyOne-click fix PR for whitebox findings that carry a patch
NoNo
Re-test a fix with the original exploit
YesValidate-Fix replays the exploit against that one finding
PartlyFree retests within six months
Re-test a fix with the original exploit
YesValidate-Fix replays the exploit against that one finding
PartlyFree retests within six months
Human pentesters
NoFully autonomous agent
Yes400+ vetted pentesters
Human pentesters
NoFully autonomous agent
Yes400+ vetted pentesters
Auditor-ready compliance reports
NoExportable findings reports, not an audit attestation
YesSOC 2, PCI DSS, ISO 27001
Auditor-ready compliance reports
NoExportable findings reports, not an audit attestation
YesSOC 2, PCI DSS, ISO 27001
Self-hosted or on-prem
NoManaged cloud; every run in its own isolated sandbox
NoNo
Self-hosted or on-prem
NoManaged cloud; every run in its own isolated sandbox
NoNo
Best for
Product teams testing web apps, APIs and code on every release
Scheduled, human-signed compliance pentests
Best for
Product teams testing web apps, APIs and code on every release
Scheduled, human-signed compliance pentests

Cobalt details are taken from its public product pages and published pricing, reviewed September 2026. Rows we couldn't confirm are left out rather than guessed. Cobalt are trademarks of their respective owners.

Where Vulnix goes further