Cobalt named a Sample Vendor for Penetration Testing as a Service in the Gartner Hype Cycle reports for Application Security, Security Operations, and XaaS, 2026
BOSTON, September 2, 2026 — Cobalt™, the pioneer in pentesting as a service (PTaaS) and a leader in continuous offensive security testing, today announced its recognition as a Sample Vendor in three 2026 Gartner® Hype Cycle™ reports: Hype Cycle for Application Security, 2026 (July 2026), Hype Cycle for Security Operations, 2026 (June 2026), and Hype Cycle for XaaS, 2026 (July 2026). In each report, Cobalt is listed as a Sample Vendor in the PTaaS category. This marks the fourth consecutive year Cobalt has been recognized across the three Gartner Hype Cycle reports for its Cobalt Offensive Security Platform™.
The 2026 Gartner Hype Cycle for XaaS highlights that: “organizations are turning to PTaaS to address expanding attack surfaces driven by public cloud adoption and the growth of internet‑facing digital assets.” Gartner notes that “most organizations maintain dedicated pentesting budgets and increasingly seek higher value for the same spend. Automation‑first, technology‑led PTaaS models can improve both testing frequency and deliverable quality without requiring significantly greater investment.”
“As AI transforms both software development and threat actor tactics, security teams need to test across a larger attack surface,” said Gunter Ollmann, CTO at Cobalt. “With the Cobalt Platform, organizations gain continuous offensive security testing that blends automation, AI, and elite human expertise to trigger validations the moment material risk changes, not when the calendar dictates. This market shift reflects the growing role of PTaaS as organizations move beyond traditional, point-in-time security testing toward faster, continuous approaches to validating risk.”
In the Hype Cycle for Application Security, 2026, Gartner recommends users “Favor hybrid models that combine automation with human expertise for more effective and efficient results.” and “seek vendors that deliver tailored guidance and integrate with DevOps, CI/CD and ticketing systems to streamline workflows and reduce skills‑gap pressures.”
According to the Hype Cycle for Security Operations, 2026, Gartner notes that “PTaaS supports continuous threat exposure management (CTEM) by enabling dynamic scoping, adaptive retesting and quicker mobilization of results. Automation‑first delivery improves consistency, accelerates remediation and integrates with DevOps and ticketing workflows to demonstrate progress to stakeholders.”
Cobalt believes these recommendations reinforce its continued focus on combining technology, AI and expert human testing rather than treating automation as a replacement for security expertise. The Cobalt Platform spans the full spectrum of continuous offensive security, from high-frequency, AI-driven autonomous security testing to targeted, human-led pentesting. By combining the industry’s largest dataset of real-world pentesting results with the Cobalt Core, an elite network of 500 vetted security experts, Cobalt enables organizations to continuously identify, prioritize, and remediate exploitable risk with the speed, flexibility, and precision modern security and development teams demand.
Cobalt continues to advance the Cobalt Platform to help organizations move from periodic testing toward continuous, scalable security validation across modern application environments.
Note:
Gartner, Hype Cycle for Application Security, 2026, Dionisio Zumerle, 21 July 2026.
Gartner, Hype Cycle for Security Operations, 2026, Darren Livingstone, Jonathan Nunez, 5 June 2026.
Gartner, Hype Cycle for XaaS, 2026, Jason Donham, 7 July 2026.
Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.
GARTNER and HYPE CYCLE are trademarks of Gartner, Inc. and/or its affiliates.
About Cobalt
Cobalt is the pioneer in pentesting as a service (PTaaS) and a leader in continuous offensive security testing grounded in human expertise. The Cobalt Offensive Security Platform spans the full spectrum of offensive security, from targeted, human-led pentesting to high-frequency, AI-driven autonomous security testing. Only Cobalt brings together the four critical elements of modern offensive security: elite human expertise, a context-aware platform, AI-powered orchestration, and the industry's largest dataset of real-world pentest results. Thousands of customers and hundreds of partners rely on Cobalt and its global network of 500+ vetted security experts to continuously identify, prioritize, and remediate exploitable risk with the speed, flexibility, and precision today's organizations require.
Cobalt maintains an outstanding NPS of 9, reflecting its dedication to customer satisfaction. Read our reviews on G2 to see why customers love us. More at https://www.cobalt.io. Follow Cobalt on LinkedIn and X.
Media Contact
Leslie Kesselring
Kesselring Communications for Cobalt
leslie@kesscomm.com