The State of Pentesting 2025: What 10 Years of Data Tells Us About Real Risk

Cobalt Platform AI-powered offensive security platform for continuous risk mitigation. Integrations Automate workflows to remediate vulnerabilities faster. Artificial Intelligence Cobalt Sage AI is the intelligence that powers every pentest. Pricing Explore the flexible Cobalt credit model that scales to your needs. Agentic PTaaS Human-led, AI-powered pentesting that scales with your attack surface. DAST Continuously monitor web applications and APIs for vulnerabilities.

Secure every application with flexible pentesting that combines expert-led testing, autonomous validation, and actionable results.

Autonomous Pentest Fast, autonomous pentests for every release and every new threat. AI & LLM Pentest Targeted testing to protect your AI systems and models. Web Application Pentest Ensure your mission-critical applications are secure. API Pentest Identify exploits for endpoints and microservices.

Offensive Security Program Go beyond one-off pentests with continuous testing, fix validation, and strategic guidance. Continuous Pentesting Program Go beyond on-demand pentests with a continuous pentesting program. Enterprise Consolidate pentesting into a centrally managed, continuous program that scales with your business. Compliance Meet ever-evolving governance, risk, and compliance requirements with expert-led pentesting. Small Business Comprehensive pentesting to meet compliance requirements. Secure SDLC Embed proactive security practices across the entire software development lifecycle.

Resource Library Essential reading and toolkits for modern cybersecurity professionals. Blog Sharpen your skills with expert commentary and practical security advice. Demo Center Explore the features, insights, and automation that help teams deliver high-impact pentests. Customer Stories Learn how real customers benefit from the Cobalt Offensive Security Platform. Webinars & Events Live and on-demand events and training for today's most pressing security challenges. Learning Center Learn the fundamentals of offensive security and strengthen your cyber defenses. Partners Explore the Cobalt partnership network and apply to become a partner today. Newsroom Read the latest news stories and press coverage.

About Us Learn how Cobalt infuses manual security testing with speed, simplicity, and transparency. Contact Us Get in touch with a member of our team. Leadership Meet the executive leadership team driving our mission. Cobalt Core Meet the community of skilled and highly vetted pentesting experts. Careers Join Cobalt to help us redefine and reimagine offensive security. Become a Pentester Apply to join our elite community of freelance pentesters.

What you don’t know can put you at risk. Most security teams trust their defenses, until pentesting reveals the gaps. The State of Pentesting Report 2025 exposes the vulnerabilities, and shows you how to build a more effective security program.

Join Cobalt Chief Technology Officer Gunter Ollmann and Cyentia Co-Founder and Partner Wade Baker, as they discuss the key trends from our research and, most importantly, explain how to turn insight into action.

You'll learn:

Why 94% of security leaders say pentesting is foundational to their programs, and what real-world pentesting data reveals about the true state of security.
The AI security gap: How pentesting shows serious flaws in LLM applications, amid the race to adopt AI faster.
The biggest concerns of security leaders, how teams are prioritizing threats, and how your security measures up.
Plus, go beyond the headlines with the experts, as they seek answers to the tough questions.

As Cobalt's Chief Technology Officer, Gunter brings decades of experience and innovation to the forefront of information security. A seasoned veteran in the field, he has defined, delivered, and trailblazed cutting-edge security innovations to protect organizations worldwide. Gunter has built and led high-performing SecOps, engineering, and research teams while guiding the invention of groundbreaking technologies, including multiple patents in cyber threat detection and mitigation. He has been instrumental in bringing advanced security solutions to market through startups, market leaders, and household-name brands.

Dr. Wade Baker is a Co-Founder of the Cyentia Institute, which focuses on improving cybersecurity knowledge and practice through data-driven research. He’s also a professor in Virginia Tech’s College of Business, working to prepare the next generation of industry leaders. Prior to this, Wade held positions as the VP of Strategy at ThreatConnect and was the CTO of Security Solutions at Verizon, where he had the great privilege of leading Verizon’s Data Breach Investigations Report (DBIR) research team for 8 years.