Rheono vs Cobalt: a published flat price, or PTaaS credits for human-led tests

Verdict

Rheono wins when you want one web app and its API pentested every month or after every release, at a published price you can buy without a quote: €99 a month for one full pentest, or €499 a month for continuous coverage.

What Cobalt is

Cobalt calls itself a continuous offensive security testing platform and uses the term PTaaS, pentesting as a service. It tests web apps, APIs, mobile and desktop apps, external and internal networks, cloud environments and AI systems, and it also sells red teaming and secure code review.

Cobalt's testing is human-led. Its homepage describes the Cobalt Core as a network of more than 500 vetted security experts who work its engagements, and its autonomous pentest still lists direction from a Cobalt Core pentester on every test.

Cobalt's pricing runs on credits sold in annual packages. One credit equals 8 hours of offensive security testing, credits do not roll over into the next contract, and the Standard, Premium and Enterprise tiers are priced by quote. The one published figure is the autonomous pentest at $3,500 per test, a limited-time offer that has to be completed before 31 December 2026.

What Cobalt does better

Human testers on the engagement. Cobalt Core pentesters lead its tests, and even the autonomous pentest has one directing it. Rheono's pentests are run by agents, and a named signatory reviews the findings and signs the report.

Many kinds of test under one contract. Cobalt covers mobile, desktop, internal networks, cloud configuration, AI systems and red teaming. Rheono covers external web apps and APIs, and nothing else.

One budget for a large program. Annual credit packages let a security team spread testing across many assets and test types, with retesting included for the contract term. Rheono's plans count web and API surfaces (up to ten on Business) and cover nothing else.

Where Rheono differs

You can see the price and buy today. Rheono's plans are on the pricing page with a checkout: €99 a month for Starter, €499 a month for Growth. Cobalt's tiers start with a quote, and the work is counted in 8-hour credits that do not carry over into the next contract year.

Coverage follows your releases. On Growth and above, Rheono runs a pentest after each release you approve and keeps a quieter watch between releases, for the same monthly price. A Cobalt test draws down credits according to its scope and delivery options.

The scope is written down first. Before the first pentest you verify the domain with a DNS TXT record or a well-known file and sign an authorization with rules of engagement. The agents only touch the hosts that authorization names, and the authorization expires after 90 days unless renewed.

Three checks stand behind every finding. The agent that finds a flaw proves the exploit, a separate validator tries to break that proof in its own session, and a scripted replay reruns it where the bug class allows. What survives goes into a report signed with an advanced electronic signature, with NIS2 / ISO 27001-ready evidence mapping. The sample report shows the format.

Rheono is run from Germany, stores customer data in the EU and delivers the report and walkthrough in English or German.