European Alternatives to Cobalt
Looking for a European alternative to Cobalt? Cobalt's terms name Cobalt Labs, Inc., a Delaware corporation based in San Francisco, as the company behind the service, and its pricing page sells pentests through a credit model in which one credit equals 8 hours of testing. Teams look elsewhere for a European contracting entity, per-test pricing or a self-service toolkit.
The European tools below cover pentest as a service with human validation, agentic AI pentests, and self-service scanners, from Ireland, the Netherlands, Belgium, France, Portugal, Switzerland, Sweden and Romania.
How we rank these tools — 4-step process
-
1
European ownership, verified
The company is headquartered and incorporated in the EU, EEA, the UK, Switzerland or Israel, and processes customer data in Europe or Israel. A US parent company disqualifies a tool from this page regardless of where its servers are.
-
2
Category fit and hands-on review
What the tool actually does, who it suits, and where it falls short — checked against the vendor’s own documentation, changelog and pricing page rather than its marketing copy.
-
3
Compliance and pricing check
GDPR posture, hosting location and the prices quoted on this page are verified against the vendor’s public pricing before publication, and re-checked when we revisit the category.
-
4
Position on this page
Placement on this page can be paid, and that can affect which tools appear here and the order they appear in. It never buys a good review: a tool that fails the checks above is not here at any price, and payment does not change the shortcomings we write about. A vendor can ask us to correct a factual error — not to remove a criticism.
Vendors can pay for visibility on this page. It never changes what an entry says about a product, including the criticism, and we earn nothing when you click through to a vendor. Vendors can pay for more visibility, higher up on the review pages; it never affects which tools are listed. Editorial policy
10 European Alternatives to Cobalt
Pentest-Tools.com
Cloud pentest toolkit with scanners, exploiters and reporting
Hadrian
Agentic pentests and attack surface management from Amsterdam
Intruder
Exposure management with AI web application pentests
Edgescan
Hybrid pentest as a service combining automation and human review
Aikido Security
Ghent security platform with same-day AI pentests
Ethiack
Agentic AI pentesting with proof of exploit on every finding
Escape
AI pentesting and business-logic DAST built in Paris
ImmuniWeb
Swiss web and mobile pentests that pair AI with human testers
Intigriti
Belgian crowdsourced platform adding a pentest-as-a-service offer
Detectify
External scanning and DAST that fills the gaps between pentests
Key takeaways
- Cobalt Labs, Inc. is a Delaware corporation in San Francisco, according to the privacy policy on cobalt.io.
- One Cobalt Credit equals eight hours of testing and credits do not roll over into the next contract year, according to Cobalt's pricing page.
- Hadrian in Amsterdam publishes a starting price of EUR 1,250 per Nova pentest, excluding VAT, where Cobalt quotes every tier.
- Edgescan in Dublin and ImmuniWeb in Geneva are the two European vendors on this page that keep human testers or reviewers behind the portal, which is the closest match to Cobalt's model.
- Detectify in Stockholm and Pentest-Tools.com in Bucharest publish plan prices, and neither replaces a human-led pentest on its own.
Why people leave Cobalt
Cobalt is a pentest-as-a-service platform from San Francisco. Its privacy policy names Cobalt Labs, Inc., a Delaware corporation at 575 Market Street, as the company behind the service. You scope a test in the portal, a pool of vetted freelance testers (Cobalt calls them Cobalt Core) works through it, and the findings arrive in the same portal with retests included. The menu now also lists an agentic PTaaS layer, DAST and an autonomous pentest next to the human-led work.
The commercial model is the first thing buyers question. Cobalt sells credits, and according to its pricing page one credit equals eight hours of offensive security testing, bought in annual packages that include scoping, retesting and platform access. Standard, Premium and Enterprise are all priced on quote. Credits are tied to the contract year, so a team that over-buys in January cannot carry the balance into the next contract, and a team that under-buys has to ask for more.
The second question is jurisdiction. A pentest report is a prioritised list of how your own systems can be broken, and the platform that stores it is a US corporation. Security teams in regulated European sectors, especially those preparing for DORA or NIS2 evidence, increasingly ask whether that list can sit with a vendor under their own legal system. The European field answers with human-validated services, agentic testers and self-service toolkits.
- A Delaware corporation holds the findings Cobalt's privacy policy identifies Cobalt Labs, Inc. in San Francisco as the controller for its own business data and refers to its affiliates. For a European customer that means a US contracting counterparty for a document set that maps your exploitable weaknesses. Every vendor on this page contracts from a country inside the EU, the UK or Switzerland, which changes which courts and which authorities are in play.
- Credits are annual and do not roll over Cobalt's pricing FAQ states that credits do not roll into the next contract and are specific to each contract year. Each credit is eight testing hours, and the number you need depends on the scope and delivery options of each test. Buyers who want a price per test they can read before talking to sales will find that Hadrian and Intruder publish one.
- No public price on any tier All three Cobalt tiers lead to a "get a quote" button. The pricing page tells you the start time (three, two or one business days) and how much support comes with each tier, but not the cost of a credit. Detectify and Pentest-Tools.com publish yearly or monthly figures, and Hadrian lists EUR 1,250 for a Nova pentest, so a budget conversation can start without a call.
- The model is built around a human tester pool Cobalt's promise is expert validation on top of automation, with testers drawn from a community of freelancers. If your real need is continuous coverage after every release, an agentic engine such as Ethiack, Aikido or Hadrian re-tests on a schedule or trigger without booking credit hours. Cobalt has added its own autonomous pentest, so this is a difference of emphasis, not of capability.
What you have to replace, not just match
Start with what you actually buy from Cobalt each year. The pricing page bundles four things into a credit: automated detection, expert human validation, test orchestration and findings delivery. A European replacement must supply the same four, or you must decide which you can drop. Edgescan and ImmuniWeb keep a person in the loop; Pentest-Tools.com drops the human and gives you the toolkit; Hadrian, Ethiack, Escape and Aikido replace the tester pool with agents.
Then list the engagement types you commission. Cobalt's catalogue runs from web, API and mobile pentests to external, internal and cloud network testing, red teaming, secure code review and AI and LLM pentests.
The European tools on this page are strongest on web applications, APIs and the external attack surface. If you rely on Cobalt for internal network tests, red teaming or code review, check each candidate's own service list before you cancel, because several of them do not offer those.
Finally, replace the workflow around the findings. Cobalt advertises native integrations with Jira and GitHub, Slack collaboration and an insights dashboard, plus SAML single sign-on and group access controls on the tiers. Your developers have learned to close tickets from that portal. Confirm that the replacement pushes findings into your tracker, supports SSO, and keeps retesting free or capped at a known price.
The alternatives compared
| Position | Tool | Headquarters | Pricing | Jurisdiction |
|---|---|---|---|---|
| #1 | Pentest-Tools.com | Bucharest, Romania | From $96/month (NetScan), $140/month (AppScan), $190/month (Exploit), by asset count | EU (Romania) |
| #2 | Hadrian | Netherlands | Atlas priced on total asset count (quote); Nova pentests from EUR 1,250 per test excluding VAT | EU (Netherlands) |
| #3 | Intruder | London, England | Free plan; Cloud, Pro and Enterprise by quote or checkout; AI pentests from USD 3,500 per test | United Kingdom |
| #4 | Edgescan | Dublin, Ireland | See website; no prices on the pages checked | EU (Ireland) |
| #5 | Aikido Security | Ghent, Belgium | Free Developer tier for 2 users; Basic is $300 monthly and Pro $600 monthly, each with 10 users; Enterprise is quoted; taxes are extra | EU (Belgium) |
| #6 | Ethiack | Coimbra, Portugal | Pricing on request | EU (Portugal) |
| #7 | Escape | Paris, France | Sales sets the price per scope; the page text shows no amounts | EU (France) |
| #8 | ImmuniWeb | Geneva, Switzerland | Free Community Edition; paid AI Platform (penetration testing, ASM, dark web monitoring) quoted by sales | Switzerland (adequacy decision, outside the EEA) |
| #9 | Intigriti | Antwerp, Belgium | Plans named Core, Premium and Enterprise; prices on request | EU (Belgium) |
| #10 | Detectify | Stockholm, Sweden | Starter free (up to 5 users, 100 assets) / Standard €2,500 / Professional €5,000 / Enterprise €15,000 per year | EU (Sweden) |
How each alternative compares to Cobalt
Best for: In-house security teams and MSSPs that want to run and document their own tests
Pentest-Tools.com, from PENTESTTOOLS S.A. in Bucharest, inverts the Cobalt model. Cobalt rents you tester hours; this vendor gives you scanners, exploiters and a report generator and lets your people operate them. The pricing page lists NetScan from $96 per month for 16 assets, AppScan from $140 per month for 5 assets and Exploit from $190 per month for 5 assets, with API access and unlimited rescans on all plans.
The trade is clear. You gain a Romanian contracting entity and a price you can read, and you can rerun a scan after every fix without a retest allowance. You lose the outside tester: the tool page notes there is no researcher crowd or triage service, and managed pentests are quoted on an estimate basis. Several features, such as AI pentests and an MCP server, are marked new on the site.
What Pentest-Tools.com does better than Cobalt
- Prices published by asset count, where Cobalt quotes every tier
- Unlimited rescans on every plan
- Romanian S.A. as the contracting entity
- Burp Suite import and a REST API on all plans
Where Pentest-Tools.com is a step down from Cobalt
- No independent human tester unless you buy the managed service
- Prices are shown in US dollars
- The report generator is an add-on
Standout against Cobalt. It sells the scanners and exploiters themselves, where Cobalt sells testing hours.
Best for: Teams that want a pentest price they can see and results mapped to DORA and NIS2
Hadrian, contracting as Hadrian Security B.V. in the Netherlands, splits its offer into Atlas for continuous attack surface validation and Nova for on-demand pentests run by AI agents. Where Cobalt prices in credits, Nova starts at EUR 1,250 per test excluding VAT, with bundles available. According to the vendor, results map to SOC 2, ISO 27001 and NIS2, and it offers a free external scan to start.
According to the vendor, Hadrian hosts in Scaleway data centres in the Netherlands and France by default. One clause needs reading: the terms allow England and Wales or New York law to be set in the order form, so a Dutch entity does not guarantee Dutch law. Its agentic claims about testing depth are vendor-stated, and Cobalt's catalogue lists more engagement types.
What Hadrian does better than Cobalt
- A published starting price per pentest
- Findings validated for exploitability before alerts go out
- DORA and NIS2 evidence mapping
- Default hosting in the Netherlands and France
Where Hadrian is a step down from Cobalt
- Atlas pricing is on request and based on asset count
- A narrower service menu than Cobalt's catalogue
- The order form can select non-EU governing law
Standout against Cobalt. Hadrian puts a per-test starting price and default European hosting on the same page.
Best for: Small and mid-sized teams that want hands-off exposure monitoring plus the occasional pentest
Intruder, run by Intruder Systems Ltd in London, approaches the problem from the other side of Cobalt. It is a monitoring subscription with change detection, cloud checks, container image scanning and DAST, and pentests are one product inside it. The pricing page lists a free plan with weekly external scans and a Cloud plan with a 14-day trial, and the AI pentests start from $3,500 per test.
That gives a smaller team a continuous baseline between pentests, something Cobalt's tier comparison lists as attack surface monitoring. The limits are the ones on the tool page: the free plan covers ports 80 and 443, paid plan prices were not visible, and pentests are priced in US dollars. The United Kingdom sits outside the EEA under an adequacy decision, so it is not EU law.
What Intruder does better than Cobalt
- A free plan with weekly external scans to start
- Real-time change detection for new assets
- A published starting price for AI pentests
- A UK company number published in the footer
Where Intruder is a step down from Cobalt
- No human tester pool comparable to Cobalt Core
- Pentests priced in US dollars
- Outside EU jurisdiction (UK adequacy decision)
Standout against Cobalt. It folds the baseline scanning that Cobalt sells as an extra into the same subscription.
Best for: Organisations that want automated breadth and expert-verified findings from an EU vendor
Edgescan is operated by BCC Risk Advisory Limited, trading as Edgescan, an Irish company in Dublin founded in 2017. Its platform covers attack surface management, DAST, API, network and mobile testing and pentest as a service, and the vendor says it combines vulnerability intelligence with human guidance and verification. That is the same bargain Cobalt makes, automation plus a person, delivered from inside the EU.
Prices are not shown on the pages we checked, so cost comparison needs a quote, just as with Cobalt. Edgescan also has an office in New York, and the privacy policy we read covers the website; we did not see the entity that signs service contracts, so confirm that in the order form. Cobalt has the larger public catalogue of engagement types, including red teaming and code review.
What Edgescan does better than Cobalt
- An Irish contracting entity with a registration number
- Attack surface management and testing in one platform
- Human verification aimed at false positives
- DAST, API, network and mobile coverage under one vendor
Where Edgescan is a step down from Cobalt
- No public prices, the same as Cobalt
- A US office alongside Dublin
- Fewer listed engagement types than Cobalt
Standout against Cobalt. It keeps Cobalt-style human validation but moves the contract to Ireland.
Aikido Security
Same-day AI pentests inside a developer security platform from Ghent
Best for: Developer teams that already scan code and cloud and want pentests from the same vendor
Aikido Security, contracting as Aikido Security BV in Ghent, is a developer security platform that has added AI pentests. According to the vendor, the tests run in whitebox, greybox or blackbox mode, attach proof of exploit to findings, and produce reports for SOC 2 and ISO 27001. A test can pause for a human to review a possible escalation, which gives agent speed with a person on the risky step.
Against Cobalt the difference is where pentests sit. Cobalt is a pentest company; Aikido scans dependencies, secrets, containers and cloud configuration as its core product and pentests the running application on top. The scanner page on this site lists published platform plans from a free two-user tier, but we did not verify what a pentest costs, and the footer lists US and UK offices next to the Belgian company.
What Aikido Security does better than Cobalt
- Pentests from the same vendor that already scans your code and cloud
- A Belgian BV as the contracting entity
- A free developer plan for the surrounding platform
- Pentest reports aimed at SOC 2 and ISO 27001 evidence
Where Aikido Security is a step down from Cobalt
- Not a network or host testing specialist
- Pentest pricing was not verified on its pages
- No pool of named human testers like Cobalt Core
Standout against Cobalt. The pentest comes from the same vendor that already holds your code and cloud scan results.
Best for: Teams with NIS2 or DORA duties that want repeatable automated testing with evidence
Ethiack, from Ethiack, S.A. in Coimbra, runs an engine called Hackian instead of booking tester hours. The vendor says every confirmed risk carries a proof of exploit and remediation guidance, and that testing triggers on code pushes, infrastructure changes and new threat knowledge. A Cobalt credit is a unit of time you spend; here the unit is a continuous programme.
The site lists a 30-day free trial and live reports for NIS2, DORA, SOC 2, ISO 27001 and PCI as outputs. Prices are not published and the privacy policy page we checked is dated 2022. It is a testing engine, not a platform that invites outside researchers, and its performance figures are vendor claims. Cobalt remains stronger where a named human tester must sign the work.
What Ethiack does better than Cobalt
- Testing triggered by changes instead of scheduled credit hours
- Proof of exploit on every confirmed finding, according to the vendor
- Third-party and unknown assets included in the attack surface map
- A Portuguese S.A. with a published registration number
Where Ethiack is a step down from Cobalt
- No prices published
- Hosting location not stated on the pages checked
- No tester community or reward grid
Standout against Cobalt. Testing starts when your code or infrastructure changes, not when a booked window opens.
Escape
AI pentesting and business-logic DAST for API-heavy applications, from Paris
Best for: API-heavy engineering teams that need business-logic flaws found, not only known CVEs
Escape, run by Escape Technologies SAS in France, positions its in-house AI-powered DAST against legacy scanners and now sells AI pentesting as well. The scanner page on this site describes testing aimed at business-logic flaws in web applications and APIs, which is the class of finding where an automated tool usually needs a person. Cobalt answers that with human testers; Escape answers with an agent that understands the application flow.
Pricing is scoped by sales and the pricing page shows no amounts, so cost comparison needs a call, as it does with Cobalt. Escape is a specialist for modern application stacks and will not map an old internal network, and Cobalt's catalogue of internal, cloud and red-team work is broader. We did not verify its hosting region, so ask before contracting.
What Escape does better than Cobalt
- Business-logic-aware testing built for APIs
- A French SAS as the contracting entity
- Continuous DAST between pentests
Where Escape is a step down from Cobalt
- No prices shown, the same as Cobalt
- No internal network testing
- Narrower engagement catalogue
Standout against Cobalt. It targets the business-logic flaws that signature-based scanners miss.
Best for: Buyers who want human-led web, API and mobile pentests with an accreditation to show
ImmuniWeb SA in Geneva sells the model closest in spirit to Cobalt: human penetration testers assisted by AI models. According to the vendor, it holds a CREST accreditation that includes AI-enabled penetration testing, and the tool page records ISO 9001:2015 certification. The platform bundles penetration testing, attack surface management and dark web monitoring, and a free Community Edition runs a large volume of tests daily.
The trade against Cobalt is jurisdiction and price clarity. Switzerland sits outside the EEA under an adequacy decision, so it is not EU law, and the paid AI Platform is quoted by sales with nothing published. The free tier is a lighter product than the paid testing service. Cobalt offers more listed engagement types and a bigger public tester community.
What ImmuniWeb does better than Cobalt
- A free Community Edition to try the approach
- Data location stated as Switzerland (Geneva)
- An external accreditation for AI-enabled testing, according to the vendor
- Pentesting, attack surface and dark web monitoring in one suite
Where ImmuniWeb is a step down from Cobalt
- Paid pricing requires a sales conversation
- Switzerland is outside the EEA
- Smaller engagement catalogue than Cobalt
Standout against Cobalt. A free Community Edition lets you run real tests before you speak to sales.
Best for: Companies that want a bounty programme and a pentest offer from one Belgian vendor
Intigriti NV in Antwerp is a bug bounty platform that has added pentest as a service in three types, Focused, Comprehensive and Certified. The Certified type targets regulated buyers with CREST-accredited deliverables, and the vendor offers a letter of attestation. The platform pages mention access to more than 150,000 independent researchers and an in-house triage team that vets incoming reports.
Cobalt ties its testers to a vetted pool and a credit contract; Intigriti starts from a crowd and a bounty model. The product page marks the PTaaS offer as beta, plan names are Core, Premium and Enterprise with no published prices, and hosting is not stated on the pages checked. Staff and offices also sit in the US and UK, so read the signing entity.
What Intigriti does better than Cobalt
- A Belgian NV as the platform operator
- Bounty, disclosure programme and PTaaS on one platform
- In-house triage of incoming reports
- AI security programmes for LLM features
Where Intigriti is a step down from Cobalt
- The PTaaS offer is listed as beta
- No prices published and hosting not stated
- Less mature pentest workflow than Cobalt
Standout against Cobalt. It is the one vendor here that adds a bounty crowd to a pentest offer on one platform.
Best for: Teams that want published prices and continuous external scanning between annual pentests
Detectify AB in Stockholm combines external attack surface management with DAST, using payloads partly from a network of more than 400 ethical hackers. It does not replace a Cobalt engagement; the vendor describes it as complementing penetration testing programs. What it can replace is the attack surface monitoring that Cobalt lists in its tier comparison.
Prices are public: a free Starter tier for up to five users and 100 assets, then Standard at €2,500, Professional at €5,000 and Enterprise at €15,000 per year. CI/CD integration starts at Professional, and the tool finds exposure but does not block it. Against Cobalt the gap is plain: no human-led test, no retest by a tester, no red teaming.
What Detectify does better than Cobalt
- Prices published down to a free Starter tier
- Continuous scanning rather than test windows
- REST and GraphQL API scanning from Standard
- ISO 27001 and Swedish company under EU law
Where Detectify is a step down from Cobalt
- Not a pentest and no human tester
- CI/CD integration reserved for Professional and above
Standout against Cobalt. Its price list runs from €0 to €15,000 a year, which Cobalt does not publish at all.
What actually breaks when you switch
The biggest break is the report archive. Your past Cobalt findings, retest evidence and auditor-facing PDFs live in its portal, and the credit contract ends on a date. Export every report and its remediation history before the term closes, because a new vendor will not import them. Keep the old PDFs as audit evidence for the years they cover, and tell your auditor which vendor produced which test.
The second break is ownership of scope and credentials. Cobalt testers work against the test accounts, VPN access and allow-lists you set up, and a new vendor needs the same, plus fresh IP allow-listing for agents that test from their own ranges. Plan one dry run with a low-risk application first. Contracts also change shape: credit packages become per-test fees, subscriptions or quotes, so match renewal dates and do not pay twice for the same quarter.
Can a European tool give us the same human-validated pentest as Cobalt?
Edgescan and ImmuniWeb come closest. Edgescan, an Irish platform, says it combines automated testing with human guidance and verification and sells pentest as a service. ImmuniWeb in Geneva pairs human testers with AI models and, according to the vendor, holds a CREST accreditation for AI-enabled penetration testing. Intigriti adds a Belgian crowd of researchers and a PTaaS offer, though its product page marks that offer as beta.
What you will not find is a copy of the Cobalt Core pool. Each European vendor staffs differently, so ask who performs the test, whether they are employees or freelancers, and which accreditation the deliverable carries. Ask for a sample report before you compare prices, because the report is what your auditor reads.
How do we compare pricing when Cobalt sells credits?
Convert your last contract into tests. Take the credits you bought, the number of assets you scoped and the retests you used, then ask each European vendor for a quote on the same scope. Cobalt defines a credit as eight testing hours with the credit cost set by engagement complexity, so two similar web apps can cost different amounts.
Published prices give a floor to check against. Hadrian lists Nova pentests from EUR 1,250 per test and Intruder lists AI pentests from $3,500 per test, both from their own pages. Edgescan, ImmuniWeb, Escape, Ethiack and Intigriti quote on request, so expect the same sales loop you have with Cobalt, but with a European order form.
Which one to pick
If your need is a human-validated annual or quarterly pentest for compliance, shortlist Edgescan and ImmuniWeb, and add Intigriti if a bounty crowd also interests you. If you want a visible price per test, Hadrian and Intruder are the two to quote first. If you release often and want testing tied to changes, Ethiack, Aikido and Escape fit better, with Escape strongest on APIs and Aikido strongest when you already want code and cloud scanning.
Keep Cobalt when you need red teaming, internal network tests, secure code review or a tester pool you can request by region or time zone, because those are listed in its catalogue and are thin elsewhere on this page. Choose Pentest-Tools.com when your own testers do the work, and add Detectify when the gap is monitoring between tests rather than the test itself.
Frequently Asked Questions
For human-validated pentest as a service, Edgescan from Ireland and ImmuniWeb from Switzerland are the closest fits. For pentests priced per test, look at Hadrian in the Netherlands or Intruder in the United Kingdom. Agentic AI testing comes from Ethiack in Portugal, Aikido in Belgium and Escape in France, and Pentest-Tools.com in Romania suits teams that run their own tests.
No. Cobalt's privacy policy names Cobalt Labs, Inc., a Delaware corporation doing business in San Francisco, together with its affiliates. We could not read its Platform Services Agreement as plain text, so check the order form for the contracting entity, governing law and data location before assuming anything for your own contract.
According to Cobalt's pricing FAQ, its PTaaS model provides unlimited on-demand retesting throughout the contract term. We did not verify retest terms for the European vendors, so confirm in writing what a retest costs, how many you get and whether it needs the same tester.
Only if your auditor or customer accepts it. Detectify describes its product as a complement to penetration testing programs. Pentest-Tools.com and Aikido publish reports aimed at SOC 2 and ISO 27001 evidence, and Intigriti offers attestation with its certified pentests. Ask the party that requested the pentest which format and accreditation they require.
Hadrian and Ethiack both state that their results map to NIS2 and DORA, and Hadrian also lists SOC 2 and ISO 27001. Those are vendor statements, so ask for a sample report and have your compliance owner check the mapping against the exact articles you must evidence.
Related comparisons
About the author
Explore More European Alternatives
Discover privacy-focused European alternatives to other popular US tech services.