Cobalt Financial Model
Fintech Startup Financials (Free Excel Download)
SaaS-enabled marketplace for penetration testing - replaces legacy consulting with an on-demand platform connecting vetted pentesters to customers.
professionals from Deloitte
Used by professionals from
About this model
Cobalt is a SaaS-enabled marketplace for penetration testing, giving companies on-demand access to vetted security testers through a software platform. It replaces slow, project-based consulting with a more repeatable and transparent testing workflow.
Customers purchase testing credits that are consumed as engagements are delivered, creating a recurring commercial relationship with a meaningful service-cost component. The company has targeted SMB customers while expanding toward mid-market and enterprise accounts.
The model should track new and retained customer ARR, credit purchases, expansion, churn, and testing engagement volume by segment. Tester payouts and other delivery costs must be forecast separately from platform costs, so the resulting gross margin reflects the blended SaaS and marketplace economics.
A turnkey financial model
Live formulas, no hardcoded values
Outputs are driven by live formulas, so the workbook updates from its assumptions instead of relying on hardcoded results.
All assumptions in one tab
Inputs are clearly marked in the Assumptions tab and separated from calculations, making it clear what to change and what to leave intact.
Statements always balancing
For integrated-statement models, the balance sheet, cash flow, and supporting schedules tie through properly.
Distinct schedules for clarity
Debt, working capital, taxes, and cash flow can get messy quickly. We group calculations in clear schedules, not across disconnected tabs.
No hidden macros or external links
There are no unexplained external workbook links or macros to undermine auditability or portability.
Changes flow through the model
Update a key driver and see the impact carry through the forecast, financing, and return outputs. We never use hardcoded numbers in formulas.
About Cobalt
cobalt.io
How to build a detailed financial model for Cobalt
A complete walkthrough of the business, drivers, and assumptions behind the downloadable Cobalt model - distilled from its pitch deck and publicly available information.
Product & value proposition
- Integrated pentest platform ("1-click pentesting") connecting customers to a curated community of vetted pentesters ("Cobalt Core").
- Four-step workflow - Plan (on-demand credits, streamlined procurement), Source (auto-matching, on-demand talent), Test (in-app delivery, real-time collaboration), Fix (Jira/GitHub/Slack integrations, find-to-fix analytics).
- Claimed benefits vs. legacy consultancies: 10x speed to deliver (weeks → 24 hours), +25% cost reduction, data-driven security analytics.
- Long-term vision: "From Pentest to Platform" - pentest is the wedge into a broader security platform.
- Legacy model priced at ~$20k per test / $250/hr with 2-week lead time; Cobalt disrupts on speed and price.
Market
- Pentest market size: ~$10B.
- Automation/DAST/SAST market: ~$2B.
- Bug bounty market: ~$0.2B.
- DevOps market (proxy for secular tailwind): ~$857.7B in 2014 growing steeply to implied ~$4,500B+ by 2025 - note: units on chart labeled "Billions" but absolute values suggest this may be millions; treat as directional.
- Number of websites grew from near zero in 1991 to 1.76B peak (~2018), slightly declining to 1.72B - used as secular growth argument for attack surface expansion.
Revenue model
- Credit-based consumption model: customers purchase pentest "credits" upfront; credits are consumed per engagement.
- Pricing: legacy benchmark ~$20k/test cited as comparison; Cobalt's own pricing not disclosed in deck.
- GTM: primarily SMB (0–200 employees) via high-velocity inbound/outbound; expanding into Mid-Market and Enterprise.
- Gross margin: redacted (shown as "XX%" in slides 14 and 24); described as "services at XX% gross margin" - blended service/SaaS model.
- Expansion motion: land with small credit package, expand over time (e.g., 6 credits → 32 credits; 15 credits → 70 credits).
- Shifting GTM from one-off pentest sales to "pentest programs" (recurring subscriptions/retainers) to improve retention.
Traction & metrics
- ARR: "$XXm ARR" - exact figure redacted; described as achieved in 3 years of exponential growth.
- Total cash spent to reach current ARR: $8m.
- Customers: 500+ as of deck date; ~1 new client per day.
- Revenue growth: "3 years of exponential ARR growth" with 5 quarters of net quarterly ARR contribution shown on bar chart (values redacted).
- Capital efficiency: 2x cash flow positive in 2020 while continuing to grow ARR.
- Team: 100+ FTEs; employee NPS (eNPS) of 75; Glassdoor rating 4.9.
- Headcount growth in 2019: 100%.
- Team breakdown: SF office 36 FTEs, Berlin office 50 FTEs, remainder distributed.
- Pentester community (Cobalt Core): 300+ vetted pentesters; 5% acceptance rate; 100 inbound applicants/month; avg. pentester lifetime 6+ years; Pentester NPS 80+.
- Net Dollar Delivery Retention (pentester-side): redacted ("XX%") from 2016 cohort.
- Customer case study expansion multiples: one 500-FTE customer grew 4x in 13 months (6→32 credits); one 400-FTE Canadian customer grew 5x in 12 months (15→70 credits).
- Enterprise customers named: HubSpot, Verifone, Axel Springer, Zuora, GoDaddy, Palo Alto Networks.
- Target by 2023: $100m ARR, 2,500 customers, 400 employees, 1,000 pentesters.
Unit economics
- Revenue churn by segment: SMB (0–200 empl.) XX%, Corporate (200–1,000 empl.) XX%, Enterprise (1,001+ empl.) XX% - all redacted. Qualitative: SMB has higher churn; episodic buying pattern noted.
- CAC <> LTV by segment: SMB "XXX", Corporate "XXX", Enterprise "XXX" - all redacted.
- CAC payback: "XX months" - redacted; described as recovering quickly.
- Gross margin: "XX%" - redacted; described as selling "services" at this margin.
- Capital efficiency ratio: 2x (implied: $2 of ARR generated per $1 of cash spent); $8m total cash spent to reach current ARR.
Competition / moat
- Primary competitors:
- Consultancies (NCC Group, PwC, Bishop Fox, Optiv, Cigital, IOActive): don't scale, too slow, no product, expensive.
- Bug bounty platforms (Bugcrowd, HackerOne, Synack, Zerocopter): unpredictable, methodology gaps, reward quantity over quality.
- Automation/DAST/SAST vendors (Checkmarx, Tenable, Qualys, WhiteHat, Veracode, Rapid7): ~$2B market, but automation alone is insufficient.
- Moat sources: curated and vetted pentester community (Cobalt Core) with 5% acceptance rate and 80+ NPS; platform integrations creating data stickiness (Jira, GitHub, Slack); find-to-fix analytics creating switching costs; brand and community flywheel.
Team & funding ask / use of funds
- Founders: Jacob Hansen (CEO), Christian Hansen (CTO), Jakob Storm (Product Architect), Esben Friis Jensen (CCO) - all co-founders. Accenture and Chr. Hansen backgrounds noted.
- Executive team: Caroline Wong (CSO, ex-Symantec/eBay), Karen Nguyen (VP Sales, ex-Upwork), Matt Edwards (VP CS, ex-WhiteHat), Chris Tilton (VP Marketing, ex-Bugcrowd/WhiteHat), Georgi Staykov (VP Engineering), Penelope Yao (Director Product), Ray Espinoza (Director Security, ex-Cisco/Amazon), Martin Rannje (VP Finance, ex-EY/KPMG).
- Board: Eric Lagier (ByFounders, Series A), Michele Law (ex-OpenDNS/Cisco Umbrella/Castlight), Julie Cullivan (ex-Forescout/FireEye); new investor slot for Series B.
- Funding ask: ~$XXm Series B - exact amount redacted.
- Total cash raised/spent to date: $8m.
Recommended financial model
- Archetype + why: SaaS-enabled marketplace / ARR model with a blended service-margin P&L. The business is fundamentally ARR-driven (credit subscriptions + expansions) but has a service-cost layer (pentester payouts), so a pure SaaS template understates COGS complexity. Best modelled as a marketplace ARR model: track new logo ARR, expansion ARR, churn ARR, and net new ARR cohort by segment (SMB / Corporate / Enterprise), with a separate supply-side cost model for pentester payouts.
- Forecast horizon & granularity: Monthly for Year 1–2 (given fast new-logo velocity of ~30/month), quarterly roll-up for Years 3–5. Horizon through 2025 to bridge to stated $100m ARR target by 2023.
- Key drivers & assumptions:
| Driver | Value / Source |
|---|---|
| ARR at model start | $XXm - redacted; use placeholder, note as data gap |
| New logos / month | ~30 (implied: "~1 new client a day") |
| New logo growth rate | ~5% MoM tapering to ~2% as base grows; consistent with 500+ customers in ~3 years |
| Avg. ACV at land - SMB | ~$10k–$15k (6 credits at legacy $20k/test benchmark implies smaller initial deal; Cobalt likely prices at discount) |
| Avg. ACV at land - Corporate | ~$25k–$40k |
| Avg. ACV at land - Enterprise | ~$75k–$150k |
| Customer segment mix | ~70% SMB / 20% Corporate / 10% Enterprise at current stage; shifting toward Corporate/Enterprise over time |
| Net Revenue Retention (NRR) | ~110–120% blended (expansion multiples of 4–5x shown in case studies suggest strong upsell; SMB churn drags blended NRR down) |
| Revenue churn - SMB | Redacted; ~20–30% gross revenue churn for SMB given episodic service nature |
| Revenue churn - Corporate | Redacted; ~10–15% |
| Revenue churn - Enterprise | Redacted; ~5–8% |
| Gross margin | Redacted; ~50–65% (service-layer cost = pentester payouts; platform overhead lower) |
| CAC payback - SMB | Redacted; ~6–9 months |
| CAC payback - Corporate/Enterprise | Redacted; ~9–15 months |
| Headcount growth | 100+ FTEs today; target 400 by 2023; linear scale-up tied to ARR milestones |
| DevOps market CAGR | ~18–20% (consistent with chart trajectory shown on slide 4) |
| Series B raise size | $XXm - redacted |
- Scenarios (Base / Bull / Bear - which variables flex):
- Base: ~1 new logo/day maintained; NRR ~115%; gross margin ~58%; reach $100m ARR by 2024–2025.
- Bull: Successful upmarket shift to Enterprise accelerates ACV and NRR; GMV/test count scales with 1,000-pentester community; $100m ARR by 2023 as stated.
- Bear: SMB churn bites harder than modelled (30%+ gross); Enterprise motion slow to materialise; CAC rises as market gets competitive; $100m ARR pushed to 2026+.
- Flex variables: new logo rate, ACV by segment, churn rate by segment, gross margin, headcount/opex ratio.
- Required sheets / outputs:
- Inputs & Assumptions (toggle for Base / Bull / Bear)
- ARR Waterfall (by segment: new logo ARR, expansion ARR, churn ARR, net new ARR, ending ARR)
- Revenue & COGS (ARR → recognised revenue bridge if applicable; pentester payout model for COGS)
- Customer Cohort Table (logo count by cohort; NRR tracking)
- P&L (Revenue, Gross Profit, S&M, R&D, G&A, EBITDA)
- Headcount Plan (by function, tied to opex)
- Cash Flow & Runway (uses Series B proceeds; bridge to cash-flow positivity)
- KPI Dashboard (ARR, NRR, new logos/month, CAC payback, gross margin, burn multiple)
Frequently asked
Is the Cobalt financial model free?+
Yes. The Cobalt model is a free Excel (.xlsx) download with live formulas. Sign up with your email and the workbook is yours to keep, review, and edit.
What's included in the model?+
A 5-year monthly forecast with P&L, cash flow and runway, valuation (exit multiple plus a DCF cross-check), MOIC/IRR returns, and unit economics, with live formulas throughout.
How was this model built?+
It was built from Cobalt's pitch deck and publicly available information, then structured to investment-banking standards as a fully editable Excel model.
Can I change the assumptions?+
Yes. You can change assumptions and the live formulas will recalculate in the downloadable Excel model.
Have more financial modelling questions? Contact us
Created by ex-finance professionals
Hey, I’m Alex and I created Finamodel.
Over my years in the finance industry I kept building the same models over and over again. Same structure, same assumptions, different logo. So I started building frameworks to turn them into clean, reusable templates.
Every model here is one I’d actually use for a client, and I personally vet each one before it goes up.
I’m not an expert in every industry, but I’ve built enough models to know what belongs in one. And when something is completely foreign to me, I reach out to my network for experts to work on our models with us.
Having a template library on hand cuts a first build from hours to minutes.
Need help finding your model? You’ll find me in the Finamodel app!
Other Fintech Startup Financial Models
Browse another startup in the same category.
Acin
SaaS and data subscription network for operational risk management at Tier 1 financial institutions
Ageras Group
B2B SME ecosystem - marketplace connecting SMEs with accountants + cloud accounting/payroll software + embedded financial services (lending, factoring, banking)
Airbase
Unified non-payroll spend management platform (corporate cards, AP/bill pay, expense reimbursement, approval workflows) for mid-market companies.
Altruist
Vertically integrated all-in-one platform for registered investment advisors (RIAs) - combining custodial, portfolio management, practice management, and client acquisition tools.
Amenitiz
All-in-one hotel management SaaS platform ("Shopify for hotels") for independent hoteliers - PMS, booking engine, channel manager, website builder, payments, and AI-driven revenue management.
Anrok
SaaS sales tax compliance platform - nexus monitoring, calculation, registration, filing, and remittance - built specifically for SaaS companies.
Arrival
Arrival is an EV manufacturer of commercial vans and buses using proprietary Microfactories and vertically integrated components, going public via SPAC merger with CIIG Merger Corp.
AtoB
AtoB is building financial infrastructure for commercial fleets, starting with a no-fee Visa fleet card for fuel and expanding into payroll, BNPL, and international.
