Integrate Cobalt with Vulnetix. Use the Cobalt REST API v2 to pull pentest findings across your assets and engagements, then upload to Vulnetix.
Run Cobalt in CI
Scan on every push and upload the report as a workflow artifact:
- name: Export Cobalt findings
env:
COBALT_TOKEN: ${{ secrets.COBALT_TOKEN }}
COBALT_ORG: ${{ secrets.COBALT_ORG }}
run: |
curl -s "https://api.us.cobalt.io/findings" -H "Accept: application/vnd.cobalt.v2+json" -H "Authorization: Bearer $COBALT_TOKEN" -H "X-Org-Token: $COBALT_ORG" | jq '.data' > cobalt-findings.json
- name: Upload to Vulnetix
run: vulnetix upload --file cobalt-findings.json
How Vulnetix compares: better together
Vulnetix does not replace Cobalt. Keep running it. Vulnetix sits on top of Cobalt (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Cobalt is strongest at its core category and also carries features in DAST, Network & Vulnerability Scanners, MAST, Cloud Security & CSPM, just as Vulnetix spans categories.
| Capability | Vulnetix | Cobalt |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✓ Dedicated Cobalt DAST product scans web apps and APIs across domains/subdomains, authenticated behind login, scheduled or ad-hoc |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ~ Cloud configuration pentesting across AWS, Azure and GCP; engagement-based, not continuous CSPM |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ~ Mobile application pentesting offered via the Cobalt Core community |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ~ External and internal network pentesting incl. IoT/OT and embedded firmware as engagement scopes |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✓ Core PtaaS via Cobalt Core crowd with credit-based, quick-launch engagements |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ~ Findings from manual pentests and DAST surface in one platform with events/API, but not cross-SAST/SCA scanner dedup |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Cobalt does well
- Pentest-as-a-Service with the vetted Cobalt Core community, credit-based purchasing and fast launch (tests spun up in ~24-48 hours) to avoid per-engagement procurement
- Genuine in-platform DAST engine that scans web apps and APIs across all domains and subdomains, with authenticated scanning behind login forms, ~2-hour average scans on ad-hoc or scheduled cadence, and free remediation-validation retests
- Wide manual testing scope: web, mobile, API, cloud config (AWS/Azure/GCP), external and internal networks, and IoT/OT/embedded firmware
- Developer-friendly delivery: well-documented REST API v2 (personal + org tokens) exposing assets, pentests, findings and events, plus Jira and GitHub integrations for fast remediation handoff
Where Vulnetix adds to it: Vulnetix ingests and orchestrates Cobalt's manual pentest and DAST findings through its REST API v2. It does not run the pentests or the dynamic scans itself. Vulnetix layers on the static and supply-chain coverage outside Cobalt's scope (native SAST, SCA across 40+ ecosystems with transitive/reachability analysis, IaC, container, secrets, license, malware/package-firewall, SBOM) and consolidates Cobalt output into one deduplicated, exploit-intel-prioritised queue (EPSS, CISA KEV, ESS, LEV) with versioned VEX, SSVC and EOL policy.
No migration, no rip-and-replace. Cobalt keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Cobalt results in Vulnetix
Upload Cobalt JSON, CSV output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.