October 2026

Release Notes: October 2026

:::info Explore What’s New from Cobalt This Month :::

Export Pentest Findings to Wiz

Cobalt now has a Wiz integration that sends your pentest findings to the Wiz Pentest Table automatically. Previously, findings had to be exported from Cobalt and re-entered in Wiz by hand, which duplicated effort and could leave Wiz missing findings or out of date.

Who it's for: customers who use both Cobalt and Wiz.

How it works

• Go to Integrations > Wiz.
• Connect your Cobalt organization to one Wiz tenant.
• Choose which pentests to sync.

What syncs

• Findings sync as soon as you select a pentest, then daily.
• Only published findings in a Pending Fix state are sent.
• When a finding is marked Fixed, it is dropped from the sync and removed from Wiz.
• Findings arrive in Wiz with what the vulnerability is, its severity, proof it's exploitable, and how to fix it.

For setup steps, see the Wiz setup guide.

Autonomous Pentest: Scope Increased to 50 Pages

We've raised the scope for Autonomous Pentest to 50 pages per test. Cobalt Autonomous Pentest pairs the speed of AI with elite pentester oversight.

For details, see Autonomous Pentests

Exploit and Threat Intelligence on Findings

Findings tied to a CVE now include exploit and threat intelligence from VulnCheck, so you can see the real-world risk of a vulnerability without searching external sources. This builds on the CVE data added to findings in May 2026.

Who it's for: anyone reviewing validated findings, including security and engineering teams deciding what to fix first.

What you'll see on a finding with a CVE

• EPSS score: the probability the vulnerability will be exploited in the wild within 30 days.
• KEV status: whether it is on CISA's Known Exploited Vulnerabilities list.
• MITRE ATT&CK techniques: how attackers use the vulnerability.
• Publicly available exploits: sources, PoC links, and dates.

No setup is required. If a CVE applies and intel is available, it appears on the finding.