# Cobalt Financial Model

SaaS-enabled marketplace for penetration testing - replaces legacy consulting with an on-demand platform connecting vetted pentesters to customers.

- Canonical: https://finamodel.com/startups/cobalt
- Excel download: https://finamodel.com/startup-models/cobalt.xlsx
- Category: Fintech
- Model type: Marketplace / GMV
- Funding round: Series B
- Funding: $29m
- Founded: 2020
- Geography: US-primary (SF and Boston offices) + Berlin office; globally distributed team [DECK, slide 20]. Customers appear US and European (HubSpot, Verifone, Axel Springer, GoDaddy, Palo Alto Networks) [DECK, slide 17].
- Customer: B2B

## About the company

Cobalt is a SaaS-enabled marketplace for penetration testing, giving companies on-demand access to vetted security testers through a software platform. It replaces slow, project-based consulting with a more repeatable and transparent testing workflow.

Customers purchase testing credits that are consumed as engagements are delivered, creating a recurring commercial relationship with a meaningful service-cost component. The company has targeted SMB customers while expanding toward mid-market and enterprise accounts.

The model should track new and retained customer ARR, credit purchases, expansion, churn, and testing engagement volume by segment. Tester payouts and other delivery costs must be forecast separately from platform costs, so the resulting gross margin reflects the blended SaaS and marketplace economics.

## What's included

- 5-year monthly revenue build with stage-appropriate growth assumptions
- Full P&L, headcount plan, and operating-expense schedule
- Cash-flow statement, runway, and burn-rate tracking
- Valuation via exit multiple with a DCF cross-check
- Returns analysis with MOIC and IRR
- Unit economics including CAC, LTV, payback, and cohort retention

## Product & value proposition

- Integrated pentest platform ("1-click pentesting") connecting customers to a curated community of vetted pentesters ("Cobalt Core").
- Four-step workflow - Plan (on-demand credits, streamlined procurement), Source (auto-matching, on-demand talent), Test (in-app delivery, real-time collaboration), Fix (Jira/GitHub/Slack integrations, find-to-fix analytics).
- Claimed benefits vs. legacy consultancies: 10x speed to deliver (weeks → 24 hours), +25% cost reduction, data-driven security analytics.
- Long-term vision: "From Pentest to Platform" - pentest is the wedge into a broader security platform.
- Legacy model priced at ~$20k per test / $250/hr with 2-week lead time; Cobalt disrupts on speed and price.

## Market

- Pentest market size: ~$10B.
- Automation/DAST/SAST market: ~$2B.
- Bug bounty market: ~$0.2B.
- DevOps market (proxy for secular tailwind): ~$857.7B in 2014 growing steeply to implied ~$4,500B+ by 2025 - note: units on chart labeled "Billions" but absolute values suggest this may be millions; treat as directional.
- Number of websites grew from near zero in 1991 to 1.76B peak (~2018), slightly declining to 1.72B - used as secular growth argument for attack surface expansion.

## Revenue model

- Credit-based consumption model: customers purchase pentest "credits" upfront; credits are consumed per engagement.
- Pricing: legacy benchmark ~$20k/test cited as comparison; Cobalt's own pricing not disclosed in deck.
- GTM: primarily SMB (0–200 employees) via high-velocity inbound/outbound; expanding into Mid-Market and Enterprise.
- Gross margin: redacted (shown as "XX%" in slides 14 and 24); described as "services at XX% gross margin" - blended service/SaaS model.
- Expansion motion: land with small credit package, expand over time (e.g., 6 credits → 32 credits; 15 credits → 70 credits).
- Shifting GTM from one-off pentest sales to "pentest programs" (recurring subscriptions/retainers) to improve retention.

## Traction & metrics

- ARR: "$XXm ARR" - exact figure redacted; described as achieved in 3 years of exponential growth.
- Total cash spent to reach current ARR: $8m.
- Customers: 500+ as of deck date; ~1 new client per day.
- Revenue growth: "3 years of exponential ARR growth" with 5 quarters of net quarterly ARR contribution shown on bar chart (values redacted).
- Capital efficiency: 2x cash flow positive in 2020 while continuing to grow ARR.
- Team: 100+ FTEs; employee NPS (eNPS) of 75; Glassdoor rating 4.9.
- Headcount growth in 2019: 100%.
- Team breakdown: SF office 36 FTEs, Berlin office 50 FTEs, remainder distributed.
- Pentester community (Cobalt Core): 300+ vetted pentesters; 5% acceptance rate; 100 inbound applicants/month; avg. pentester lifetime 6+ years; Pentester NPS 80+.
- Net Dollar Delivery Retention (pentester-side): redacted ("XX%") from 2016 cohort.
- Customer case study expansion multiples: one 500-FTE customer grew 4x in 13 months (6→32 credits); one 400-FTE Canadian customer grew 5x in 12 months (15→70 credits).
- Enterprise customers named: HubSpot, Verifone, Axel Springer, Zuora, GoDaddy, Palo Alto Networks.
- Target by 2023: $100m ARR, 2,500 customers, 400 employees, 1,000 pentesters.

## Unit economics

- Revenue churn by segment: SMB (0–200 empl.) XX%, Corporate (200–1,000 empl.) XX%, Enterprise (1,001+ empl.) XX% - all redacted. Qualitative: SMB has higher churn; episodic buying pattern noted.
- CAC <> LTV by segment: SMB "XXX", Corporate "XXX", Enterprise "XXX" - all redacted.
- CAC payback: "XX months" - redacted; described as recovering quickly.
- Gross margin: "XX%" - redacted; described as selling "services" at this margin.
- Capital efficiency ratio: 2x (implied: $2 of ARR generated per $1 of cash spent); $8m total cash spent to reach current ARR.

## Competition / moat

- Primary competitors:
  - Consultancies (NCC Group, PwC, Bishop Fox, Optiv, Cigital, IOActive): don't scale, too slow, no product, expensive.
  - Bug bounty platforms (Bugcrowd, HackerOne, Synack, Zerocopter): unpredictable, methodology gaps, reward quantity over quality.
  - Automation/DAST/SAST vendors (Checkmarx, Tenable, Qualys, WhiteHat, Veracode, Rapid7): ~$2B market, but automation alone is insufficient.
- Moat sources: curated and vetted pentester community (Cobalt Core) with 5% acceptance rate and 80+ NPS; platform integrations creating data stickiness (Jira, GitHub, Slack); find-to-fix analytics creating switching costs; brand and community flywheel.

## Team & funding ask / use of funds

- Founders: Jacob Hansen (CEO), Christian Hansen (CTO), Jakob Storm (Product Architect), Esben Friis Jensen (CCO) - all co-founders. Accenture and Chr. Hansen backgrounds noted.
- Executive team: Caroline Wong (CSO, ex-Symantec/eBay), Karen Nguyen (VP Sales, ex-Upwork), Matt Edwards (VP CS, ex-WhiteHat), Chris Tilton (VP Marketing, ex-Bugcrowd/WhiteHat), Georgi Staykov (VP Engineering), Penelope Yao (Director Product), Ray Espinoza (Director Security, ex-Cisco/Amazon), Martin Rannje (VP Finance, ex-EY/KPMG).
- Board: Eric Lagier (ByFounders, Series A), Michele Law (ex-OpenDNS/Cisco Umbrella/Castlight), Julie Cullivan (ex-Forescout/FireEye); new investor slot for Series B.
- Funding ask: ~$XXm Series B - exact amount redacted.
- Total cash raised/spent to date: $8m.

## Recommended financial model

- **Archetype + why:** SaaS-enabled marketplace / ARR model with a blended service-margin P&L. The business is fundamentally ARR-driven (credit subscriptions + expansions) but has a service-cost layer (pentester payouts), so a pure SaaS template understates COGS complexity. Best modelled as a marketplace ARR model: track new logo ARR, expansion ARR, churn ARR, and net new ARR cohort by segment (SMB / Corporate / Enterprise), with a separate supply-side cost model for pentester payouts.

- **Forecast horizon & granularity:** Monthly for Year 1–2 (given fast new-logo velocity of ~30/month), quarterly roll-up for Years 3–5. Horizon through 2025 to bridge to stated $100m ARR target by 2023.

- **Key drivers & assumptions:**

| Driver | Value / Source |
| -- | -- |
| ARR at model start | $XXm - redacted; use placeholder, note as data gap |
| New logos / month | ~30 (implied: "~1 new client a day") |
| New logo growth rate | ~5% MoM tapering to ~2% as base grows; consistent with 500+ customers in ~3 years |
| Avg. ACV at land - SMB | ~$10k–$15k (6 credits at legacy $20k/test benchmark implies smaller initial deal; Cobalt likely prices at discount) |
| Avg. ACV at land - Corporate | ~$25k–$40k |
| Avg. ACV at land - Enterprise | ~$75k–$150k |
| Customer segment mix | ~70% SMB / 20% Corporate / 10% Enterprise at current stage; shifting toward Corporate/Enterprise over time |
| Net Revenue Retention (NRR) | ~110–120% blended (expansion multiples of 4–5x shown in case studies suggest strong upsell; SMB churn drags blended NRR down) |
| Revenue churn - SMB | Redacted; ~20–30% gross revenue churn for SMB given episodic service nature |
| Revenue churn - Corporate | Redacted; ~10–15% |
| Revenue churn - Enterprise | Redacted; ~5–8% |
| Gross margin | Redacted; ~50–65% (service-layer cost = pentester payouts; platform overhead lower) |
| CAC payback - SMB | Redacted; ~6–9 months |
| CAC payback - Corporate/Enterprise | Redacted; ~9–15 months |
| Headcount growth | 100+ FTEs today; target 400 by 2023; linear scale-up tied to ARR milestones |
| DevOps market CAGR | ~18–20% (consistent with chart trajectory shown on slide 4) |
| Series B raise size | $XXm - redacted |

- **Scenarios (Base / Bull / Bear - which variables flex):**
  - Base: ~1 new logo/day maintained; NRR ~115%; gross margin ~58%; reach $100m ARR by 2024–2025.
  - Bull: Successful upmarket shift to Enterprise accelerates ACV and NRR; GMV/test count scales with 1,000-pentester community; $100m ARR by 2023 as stated.
  - Bear: SMB churn bites harder than modelled (30%+ gross); Enterprise motion slow to materialise; CAC rises as market gets competitive; $100m ARR pushed to 2026+.
  - Flex variables: new logo rate, ACV by segment, churn rate by segment, gross margin, headcount/opex ratio.

- **Required sheets / outputs:**
  1. Inputs & Assumptions (toggle for Base / Bull / Bear)
  2. ARR Waterfall (by segment: new logo ARR, expansion ARR, churn ARR, net new ARR, ending ARR)
  3. Revenue & COGS (ARR → recognised revenue bridge if applicable; pentester payout model for COGS)
  4. Customer Cohort Table (logo count by cohort; NRR tracking)
  5. P&L (Revenue, Gross Profit, S&M, R&D, G&A, EBITDA)
  6. Headcount Plan (by function, tied to opex)
  7. Cash Flow & Runway (uses Series B proceeds; bridge to cash-flow positivity)
  8. KPI Dashboard (ARR, NRR, new logos/month, CAC payback, gross margin, burn multiple)

## Frequently asked questions

### Is the Cobalt financial model free?

Yes. The Cobalt model is a free Excel download with live formulas.

### Can I change the assumptions?

Yes. The workbook is editable and its live formulas recalculate when assumptions change.