Cobalt’s Series B pitch deck is a masterclass in category creation. By coining the term 'Pentest as a Service' (PtaaS), they successfully distanced themselves from low-margin manual consultancies and high-noise automated scanners. The deck focuses heavily on the inefficiencies of the 'Legacy Pentesting' model—citing $20k per test costs and 2-week lead times—to highlight Cobalt's 10x speed improvement. While the deck redacts specific revenue figures, it provides a transparent look at unit economics, specifically addressing the higher churn inherent in the SMB segment. With a team featuring vet…
Key takeaways
- Cobalt identifies a $10B market for Pentesting, dwarfing the $2B automation and $0.2B bug bounty sectors (Slide 5).
- The company positions its solution as a 10x improvement in delivery speed, moving from weeks to 24 hours (Slide 9).
- Cobalt admits to higher churn in the SMB segment (0-200 employees) and outlines a strategy to shift toward 'pentest programs' for better retention (Slide 15).
- The deck highlights a lean capital efficiency, stating they spent only $8M in cash to reach their current (redacted) ARR (Slide 2).
- Enterprise traction is validated through logos and video testimonials from HubSpot, Verifone, and Axel Springer (Slide 17).
- The executive team is built with deep industry experience from companies like Upwork, Amazon, and Google (Slide 20).
- Cobalt frames its journey as a transition 'From Pentest to Platform,' signaling a long-term SaaS play rather than a pure service business (Slide 24).
- The deck explicitly calls out the friction in legacy models, such as planning in Excel and results delivered via static PDFs (Slide 7).
The Pentest as a Service (PtaaS) Narrative
Cobalt’s pitch deck for their $37 million Series B is a study in how to frame a hybrid business model. In 2013, the security market was bifurcated between automated scanners and manual, high-cost consultancies. Cobalt entered the fray by defining a new category: Pentest as a Service. The deck focuses on the friction of the status quo to justify why a platform-based approach is not just a feature, but a fundamental shift in how security is bought and managed.
Introduction and High-Level Traction
Slide 1 introduces the brand with the clear tagline: "Pentest as a Service." This immediately tells the investor that this is not a tool, but a managed solution delivered through a platform. Slide 2, titled "Cobalt.io - Quick Glance," provides the high-level metrics that Series B investors look for. While the ARR is redacted as "+$XXm," the slide makes a strong case for capital efficiency, noting they spent only $8M in cash to reach that milestone. They also highlight a team of 100+ FTEs and a massive eNPS of 75, suggesting a healthy internal culture during rapid scaling. The traction metric of "~1 new client a day" and a total of 500+ customers sets a baseline of high-velocity sales.
Market Segmentation and the Legacy Problem
Slide 5 provides a "Market Overview" that is critical for their positioning. They segment the industry into Automation (~$2B), Pentest (~$10B), and Bug Bounty (~$0.2B). By placing themselves in the Pentest bucket, they are targeting the largest pool of capital. They list heavyweights like Accenture, PwC, and Optiv as the incumbents they intend to disrupt. Slide 7, "Consultancies - Legacy Pentesting," is the 'villain' slide. It details the pain points of the current model: planning in Excel, sourcing local consultants at $250/hr, receiving results in static PDFs, and manually logging issues in Jira. This slide effectively builds the 'why now' by showing how outdated the standard process is for modern, agile development teams.
The Cobalt Solution: Automation Meets Human Talent
Slide 9, "Automate the Pentest," introduces the Cobalt PtaaS Platform. The visual shows a circular ecosystem where the Cobalt Customer Success Manager, the Pentester, and the Customer all interact within a single platform integrated with Jira, Slack, and GitHub. The "Delivery Improvement" column claims a 10x increase in speed (from weeks to 24 hours) and a 25% cost reduction. The most interesting metric here is the "0-1" for Data and Analytics, emphasizing the move from a 'no-data' environment to data-driven security. This transition from a one-off service to a continuous data stream is the core of their SaaS-like valuation argument.
Competitive Landscape and Strategic Achievement
Slides 11 and 12 serve as transition points, asking "Who are we competing against?" and "What we have achieved." While the specific competitive matrix slides are not included in this set of 13, the framing suggests they are prepared to defend their middle-ground position between pure automation and pure manual labor. The deck moves quickly from the problem to the proof of their execution.
Unit Economics and Churn Management
Slide 15, "Blended Service/SaaS Unit Economics," is perhaps the most honest slide in the deck. It breaks down revenue churn and CAC/LTV ratios across three segments: SMB (0-200 employees), Corporate (200-1000 employees), and Enterprise (1001+ employees). The deck admits that the SMB segment has higher churn, which they attribute to the "episodic buying patterns" of the service industry. To combat this, they outline a strategy to shift from selling individual "pentests" to "pentest programs." This is a classic move to increase stickiness and move closer to a recurring revenue model. They also mention "integrations and data-stickiness" as levers for improving retention.
Enterprise Validation and Social Proof
Slide 17, "Early signs of Enterprise Traction," uses social proof to mitigate the risk of the hybrid model. It features three video-style testimonials from security leaders at HubSpot, Verifone, and Axel Springer. By including the names and faces of their champions, Cobalt demonstrates that they have moved beyond the early-adopter phase and are successfully selling into large, complex organizations. The bottom of the slide lists Zuora, GoDaddy, and Palo Alto Networks, further cementing their credibility in the tech sector.
The Team and the Vision
Slide 20 introduces the "Executive Team." The pedigree here is high, with logos from eBay, Symantec, Upwork, Amazon, and Google. This is not a team of first-time founders; it is a group of operators who have seen scale at major tech companies. Caroline Wong (CSO) and Ray Espinoza (Director of Security) provide the necessary security domain expertise, while Karen Nguyen (VP of Sales) brings marketplace experience from Upwork. Slide 22 and 24 wrap up the narrative with a focus on execution. The phrase "Path to $100m is about execution" signals to investors that the product-market fit is solved, and the capital will be used primarily for scaling the existing machine. The final vision, "From Pentest to Platform," reinforces the goal of becoming the central hub for all security testing data.
What Works in the Cobalt Deck
Category Creation: By coining "Pentest as a Service," they avoid being compared directly to low-margin consultancies or commoditized software scanners. · Honesty on Churn: Addressing the higher churn in SMBs (Slide 15) builds trust with investors. It shows the management team understands their weaknesses and has a plan (shifting to "programs") to address them. · Efficiency Metrics: Highlighting that they only spent $8M to reach their current scale (Slide 2) is a powerful indicator of a sustainable business model. · Integration Focus: Showing the platform as a hub for Jira, Slack, and GitHub (Slide 9) proves they understand the developer workflow, which is a major pain point in legacy pentesting.
What is Missing from the Cobalt Deck
Specific Revenue Figures: While this is a public version of the deck, the redaction of ARR and specific CAC/LTV multiples makes it harder to judge the actual health of the business. · Talent Pool Details: Cobalt relies on a "global talent pool of certified freelancers." The deck does not explain how they vet, retain, or manage the quality of these freelancers at scale, which is a significant operational risk. · Product Screenshots: For a company claiming to be a "platform," there are very few actual screenshots of the software interface. Most of the product explanation is done through abstract diagrams. · Detailed Use of Funds: The deck mentions the path to $100M but does not provide a specific breakdown of how the $37M Series B will be allocated between R&D, Sales, and Marketing.
What a Founder Should Copy
The 'Villain' Slide: Slide 7 is a perfect example of how to illustrate the pain of a legacy process. Use specific examples (Excel, PDFs, $250/hr) to make the problem feel visceral. · Segmented Unit Economics: Don't just show one blended churn rate. Breaking it down by customer size (Slide 15) shows a sophisticated understanding of your market. · Social Proof with Context: Instead of just a wall of logos, Cobalt uses testimonials that explain why the customer switched (Slide 17). This is much more persuasive for investors. · Clear Category Labeling: If you are doing something new, give it a name. "Pentest as a Service" is easy to remember and immediately differentiates the company.
Frequently asked questions
- What is Cobalt's core value proposition according to the deck?
- Cobalt's core value proposition is 'Pentest as a Service' (PtaaS). As shown on Slide 9, they aim to modernize the traditional model by providing 10x faster delivery (moving from weeks to 24 hours), a 25% reduction in costs, and a shift from static PDF reports to a data-driven platform integrated with tools like Jira and Slack.
- How does Cobalt categorize its competition?
- Slide 5 breaks the market into three tiers: Automation (e.g., Tenable, Qualys) at ~$2B, Pentest (e.g., NCC Group, Accenture) at ~$10B, and Bug Bounty (e.g., HackerOne, Bugcrowd) at ~$0.2B. Cobalt targets the largest segment—Pentest—by offering a more agile, platform-based version of what legacy consultancies provide.
- What transparency does the deck provide regarding unit economics?
- Slide 15 is unusually transparent for a pitch deck. It acknowledges that the SMB segment (0-200 employees) suffers from higher revenue churn compared to Corporate and Enterprise segments. It also notes that the service industry has 'episodic buying patterns,' which Cobalt plans to fix by shifting to 'pentest programs' and pricing incentives for recurrence.
- Who are the key members of the Cobalt leadership team?
- Slide 20 lists an experienced executive team, including Caroline Wong (Chief Strategy Officer) with a background at eBay and Symantec, Karen Nguyen (VP of Sales) from Upwork/Elance, and Ray Espinoza (Director of Security) from Amazon and Cisco. This mix of security expertise and marketplace experience supports their crowdsourced talent model.
- What are the primary 'early signs' of enterprise traction mentioned?
- Slide 17 highlights 'Early signs of Enterprise Traction' through specific case studies and testimonials. It features Ryan Stinson from HubSpot, Dimitri Binazzi from Verifone, and Henning Christiansen from Axel Springer. Other major logos displayed include Zuora, GoDaddy, and Palo Alto Networks, demonstrating broad market acceptance.
