Cobalt Pitch Deck: Slide-by-Slide Breakdown

The Pentest as a Service (PtaaS) Narrative

Cobalt’s pitch deck for their $37 million Series B is a study in how to frame a hybrid business model. In 2013, the security market was bifurcated between automated scanners and manual, high-cost consultancies. Cobalt entered the fray by defining a new category: Pentest as a Service. The deck focuses on the friction of the status quo to justify why a platform-based approach is not just a feature, but a fundamental shift in how security is bought and managed.

Introduction and High-Level Traction

Slide 1 introduces the brand with the clear tagline: "Pentest as a Service." This immediately tells the investor that this is not a tool, but a managed solution delivered through a platform. Slide 2, titled "Cobalt.io - Quick Glance," provides the high-level metrics that Series B investors look for. While the ARR is redacted as "+$XXm," the slide makes a strong case for capital efficiency, noting they spent only $8M in cash to reach that milestone. They also highlight a team of 100+ FTEs and a massive eNPS of 75, suggesting a healthy internal culture during rapid scaling. The traction metric of "~1 new client a day" and a total of 500+ customers sets a baseline of high-velocity sales.

Market Segmentation and the Legacy Problem

Slide 5 provides a "Market Overview" that is critical for their positioning. They segment the industry into Automation (~$2B), Pentest (~$10B), and Bug Bounty (~$0.2B). By placing themselves in the Pentest bucket, they are targeting the largest pool of capital. They list heavyweights like Accenture, PwC, and Optiv as the incumbents they intend to disrupt. Slide 7, "Consultancies - Legacy Pentesting," is the 'villain' slide. It details the pain points of the current model: planning in Excel, sourcing local consultants at $250/hr, receiving results in static PDFs, and manually logging issues in Jira. This slide effectively builds the 'why now' by showing how outdated the standard process is for modern, agile development teams.

The Cobalt Solution: Automation Meets Human Talent

Slide 9, "Automate the Pentest," introduces the Cobalt PtaaS Platform. The visual shows a circular ecosystem where the Cobalt Customer Success Manager, the Pentester, and the Customer all interact within a single platform integrated with Jira, Slack, and GitHub. The "Delivery Improvement" column claims a 10x increase in speed (from weeks to 24 hours) and a 25% cost reduction. The most interesting metric here is the "0-1" for Data and Analytics, emphasizing the move from a 'no-data' environment to data-driven security. This transition from a one-off service to a continuous data stream is the core of their SaaS-like valuation argument.

Competitive Landscape and Strategic Achievement

Slides 11 and 12 serve as transition points, asking "Who are we competing against?" and "What we have achieved." While the specific competitive matrix slides are not included in this set of 13, the framing suggests they are prepared to defend their middle-ground position between pure automation and pure manual labor. The deck moves quickly from the problem to the proof of their execution.

Unit Economics and Churn Management

Slide 15, "Blended Service/SaaS Unit Economics," is perhaps the most honest slide in the deck. It breaks down revenue churn and CAC/LTV ratios across three segments: SMB (0-200 employees), Corporate (200-1000 employees), and Enterprise (1001+ employees). The deck admits that the SMB segment has higher churn, which they attribute to the "episodic buying patterns" of the service industry. To combat this, they outline a strategy to shift from selling individual "pentests" to "pentest programs." This is a classic move to increase stickiness and move closer to a recurring revenue model. They also mention "integrations and data-stickiness" as levers for improving retention.

Enterprise Validation and Social Proof

Slide 17, "Early signs of Enterprise Traction," uses social proof to mitigate the risk of the hybrid model. It features three video-style testimonials from security leaders at HubSpot, Verifone, and Axel Springer. By including the names and faces of their champions, Cobalt demonstrates that they have moved beyond the early-adopter phase and are successfully selling into large, complex organizations. The bottom of the slide lists Zuora, GoDaddy, and Palo Alto Networks, further cementing their credibility in the tech sector.

The Team and the Vision

Slide 20 introduces the "Executive Team." The pedigree here is high, with logos from eBay, Symantec, Upwork, Amazon, and Google. This is not a team of first-time founders; it is a group of operators who have seen scale at major tech companies. Caroline Wong (CSO) and Ray Espinoza (Director of Security) provide the necessary security domain expertise, while Karen Nguyen (VP of Sales) brings marketplace experience from Upwork. Slide 22 and 24 wrap up the narrative with a focus on execution. The phrase "Path to $100m is about execution" signals to investors that the product-market fit is solved, and the capital will be used primarily for scaling the existing machine. The final vision, "From Pentest to Platform," reinforces the goal of becoming the central hub for all security testing data.

What Works in the Cobalt Deck

Category Creation: By coining "Pentest as a Service," they avoid being compared directly to low-margin consultancies or commoditized software scanners. · Honesty on Churn: Addressing the higher churn in SMBs (Slide 15) builds trust with investors. It shows the management team understands their weaknesses and has a plan (shifting to "programs") to address them. · Efficiency Metrics: Highlighting that they only spent $8M to reach their current scale (Slide 2) is a powerful indicator of a sustainable business model. · Integration Focus: Showing the platform as a hub for Jira, Slack, and GitHub (Slide 9) proves they understand the developer workflow, which is a major pain point in legacy pentesting.

What is Missing from the Cobalt Deck

Specific Revenue Figures: While this is a public version of the deck, the redaction of ARR and specific CAC/LTV multiples makes it harder to judge the actual health of the business. · Talent Pool Details: Cobalt relies on a "global talent pool of certified freelancers." The deck does not explain how they vet, retain, or manage the quality of these freelancers at scale, which is a significant operational risk. · Product Screenshots: For a company claiming to be a "platform," there are very few actual screenshots of the software interface. Most of the product explanation is done through abstract diagrams. · Detailed Use of Funds: The deck mentions the path to $100M but does not provide a specific breakdown of how the $37M Series B will be allocated between R&D, Sales, and Marketing.

What a Founder Should Copy

The 'Villain' Slide: Slide 7 is a perfect example of how to illustrate the pain of a legacy process. Use specific examples (Excel, PDFs, $250/hr) to make the problem feel visceral. · Segmented Unit Economics: Don't just show one blended churn rate. Breaking it down by customer size (Slide 15) shows a sophisticated understanding of your market. · Social Proof with Context: Instead of just a wall of logos, Cobalt uses testimonials that explain why the customer switched (Slide 17). This is much more persuasive for investors. · Clear Category Labeling: If you are doing something new, give it a name. "Pentest as a Service" is easy to remember and immediately differentiates the company.