Learn about the user roles and associated permissions.

Learn about the user roles and associated permissions.

Depending on your role, you may have access to an organization, specific pentests, or both.

|    | Roles and Key Permissions |
|:---|----|
| **User Roles**       \n             \n        \n | **Pentest level**:        \n• Pentest Team Member:        \n• Collaborates on a specific pentest.        \n• Has no access to organization users and settings, unless the user is also an Organization Owner or Member. |
|    | **Organization level:**        \n• Organization Owner:        \n• Can create assets and pentests.        \n• Manages organization users and settings.        \n• Can create and manage groups.        \n• Can’t collaborate on specific pentests, unless the user is also a Pentest Team Member on these pentests.        \n• Organization Member:        \n• Can create assets and pentests.        \n• Can view organization users and settings.        \n• Can view groups they are members of.        \n• Can’t collaborate on specific pentests, unless the user is also a Pentest Team Member on these pentests. |
|    | **Pentest + organization level**:        \n• Organization Owner + Pentest Team Member (on specific pentests)        \n• Organization Member + Pentest Team Member (on specific pentests) |
| **Pentester Roles**       \n             \n        \n        \n | **Cobalt pentesters**:        \n• Lead:Manages and directs a team of Pentesters while actively working on the test, typically reserved for leading tests that require two or more testers.        \n• Coordinator: Manages and directs testing efforts for [Agile pentests](https://cobalt-io.brainfish.ai/en-us/articles/glossary-YfTMKeZ1VM#h-agile-pentest) or single-tester (solo) testing.       \n• Pentester: Executes testing and supports the team under the direction of a Lead or Coordinator; they do not manage the team. |
|    | **Customer pentesters**:        \n• In-House Pentester: Performs pentests for their organization on the Cobalt [Pentest Management Platform.](https://cobalt-io.brainfish.ai/en-us/articles/in-house-pentests-HYNuapVOyk) |
| **Administrative Role**       \n       ![](https://docs.cobalt.io/illustrations/Cobalt-staff-role.svg " =120x120")        \n        \n        \n | • Cobalt Staff: Has administrative access to your pentests and organization. |

## Pentest Team Member

A Pentest Team Member is a customer (organization) representative during a specific pentest. In the UI, you see this role as “Team Member.”

* A Pentest Team Member does not have to be an Organization Owner or an Organization Member.
* When an Organization Owner [invites a user to an organization](https://cobalt-io.brainfish.ai/en-us/articles/manage-users-e390HqcTEl#h-invite-users), the use\`r also becomes a Pentest Team Member on all pentests of the organization.
  * An Organization Owner can [remove a Pentest Team Member from all pentests](https://cobalt-io.brainfish.ai/en-us/articles/manage-users-e390HqcTEl#h-remove-a-user-from-all-pentests) they collaborate on.
  * Any Pentest Team Member can [add users](https://cobalt-io.brainfish.ai/en-us/articles/manage-pentest-collaborators-2pjt0NS56E#h-add-a-pentest-team-member) to a specific pentest or [remove](https://cobalt-io.brainfish.ai/en-us/articles/manage-pentest-collaborators-2pjt0NS56E#h-remove-a-pentest-team-member) them.

A Pentest Team Member **has access to a specific pentest with the following permissions**:

* View and edit pentest details.
* Manage findings for a pentest.
* [Collaborate on a pentest](https://cobalt-io.brainfish.ai/en-us/articles/collaborate-on-pentests-ILbpm2juqQ) in the Cobalt app and in Slack.
* [Manage users](https://cobalt-io.brainfish.ai/en-us/articles/manage-pentest-collaborators-2pjt0NS56E) for a pentest.
* View pentest activity updates and pentester updates.
* Manage native Jira integrations for a pentest.

A Pentest Team Member has no access to any information related to the organization, unless they’re also an Organization Owner or Member.

### Learn more.

A Pentest Team Member has **no access** to the following pages, unless they’re also an Organization Owner or Member:

* **Assets**
* **Pentests** (except for pentests they collaborate on)
* **Findings**
* **Insights**
* **People**
* **Credits**
* **Integrations**
* **Settings**

## Organization Roles

When a customer starts their journey with Cobalt, we add an Organization Owner who then invites other users. Here is an overview of organization roles and permissions.

| **Permission** | **[Organization Member](https://cobalt-io.brainfish.ai/en-us/articles/user-roles-and-permissions-oCij6uRrUR#h-organization-member)** | **[Organization Owner](https://cobalt-io.brainfish.ai/en-us/articles/user-roles-and-permissions-oCij6uRrUR#h-organization-owner)** |
|:---|:---|:---|
| Create [assets](https://cobalt-io.brainfish.ai/en-us/articles/assets-are-what-we-pentest-09RgsvQ7zv) and [pentests](https://cobalt-io.brainfish.ai/en-us/articles/pentests-t8vsKFfrV6), edit assets | ✓ | ✓ |
| Change the [group](https://cobalt-io.brainfish.ai/en-us/articles/groups-AFqkqDHbW6) an asset is associated with | — | ✓ |
| View [all findings](https://app.brainfi.sh/doc/findings-6prkG67iav) reported within an organization on the **Findings** page, within group permissions | ✓ | ✓ |
| View organization users and pentest collaborators on the **People** page | ✓ | ✓ |
| Manage [integrations](https://cobalt-io.brainfish.ai/en-us/articles/cobalt-integrations-t57LnbF8QD) for an organization | ✓ | ✓ |
| Edit the [organization profile](https://cobalt-io.brainfish.ai/en-us/articles/configure-organization-settings-AsPfjIf0Ht) | ✓ | ✓ |
| View the [credits ledger](https://cobalt-io.brainfish.ai/en-us/articles/track-your-credits-2HS0lqCRFt) | ✓ | ✓ |
| View the [Insights](https://docs.cobalt.io/en-us/articles/insights-r4Jw78EcgA) page | ✓ | ✓ |
| [Manage users](https://cobalt-io.brainfish.ai/en-us/articles/organization-wf0ajzqU7L) for an organization | — | ✓ |
| Create and manage [groups](https://cobalt-io.brainfish.ai/en-us/articles/groups-AFqkqDHbW6) | — | ✓ |
| Manage security settings for an organization: [two-factor authentication](https://docs.cobalt.io/en-us/articles/account-settings-8tW4UtYkk3?utm_source=brainfish&utm_medium=popup_widget#h-two-factor-authentication) and [SAML](https://cobalt-io.brainfish.ai/en-us/articles/configure-saml-sso-oT8Q3qO09D) | — | ✓ |
| Enable [co-branded reports](https://cobalt-io.brainfish.ai/en-us/articles/co-branded-reports-ss3J7UUcKN) (for Cobalt partners) | — | ✓ |

## Organization Owner

An Organization Owner is the administrator for a customer organization within the Cobalt app. In the UI, you see this role as “Owner.”

An Organization Owner has the following **permissions**:

* Create [assets](https://cobalt-io.brainfish.ai/en-us/articles/assets-are-what-we-pentest-09RgsvQ7zv) and [pentests](https://cobalt-io.brainfish.ai/en-us/articles/pentests-t8vsKFfrV6), edit assets.
* [Manage users for an organization](https://cobalt-io.brainfish.ai/en-us/articles/manage-users-e390HqcTEl) on the **People** page:
  * Invite and remove users.
  * Switch user roles.
  * View users’ email addresses.
  * Remove Pentest Team Members from all pentests they collaborate on.
* Create, edit, and manage [groups](https://cobalt-io.brainfish.ai/en-us/articles/groups-AFqkqDHbW6).
* Manage security settings for an organization: [two-factor authentication](https://docs.cobalt.io/en-us/articles/account-settings-8tW4UtYkk3?utm_source=brainfish&utm_medium=popup_widget#h-two-factor-authentication) and [SAML](https://cobalt-io.brainfish.ai/en-us/articles/configure-saml-sso-oT8Q3qO09D).
* Enable [co-branded reports](https://cobalt-io.brainfish.ai/en-us/articles/co-branded-reports-ss3J7UUcKN) (for Cobalt partners).
* Manage [integrations](https://cobalt-io.brainfish.ai/en-us/articles/cobalt-integrations-t57LnbF8QD) for an organization.
* Edit the [organization profile](https://cobalt-io.brainfish.ai/en-us/articles/configure-organization-settings-AsPfjIf0Ht).
* View the [credits ledger](https://cobalt-io.brainfish.ai/en-us/articles/track-your-credits-2HS0lqCRFt).
* View the [Insights](https://docs.cobalt.io/en-us/articles/insights-r4Jw78EcgA) page.

An Organization Owner may also be a [Pentest Team Member](https://cobalt-io.brainfish.ai/en-us/articles/user-roles-and-permissions-oCij6uRrUR#h-pentest-team-member).

## Organization Member

An Organization Member is a customer representative who manages pentests and assets for their organization on the Cobalt platform but has less permissions compared to an Organization Owner. In the UI, you see this role as “Member.”

An Organization Member has the following **permissions**:

* Create [assets](https://cobalt-io.brainfish.ai/en-us/articles/assets-are-what-we-pentest-09RgsvQ7zv) and [pentests](https://cobalt-io.brainfish.ai/en-us/articles/pentests-t8vsKFfrV6), edit assets, within group permissions.
* View users and pentest collaborators on the **People** page.
* Manage [integrations](https://cobalt-io.brainfish.ai/en-us/articles/cobalt-integrations-t57LnbF8QD) for an organization.
* Edit the [organization profile](https://cobalt-io.brainfish.ai/en-us/articles/configure-organization-settings-AsPfjIf0Ht).
* View the [credits ledger](https://cobalt-io.brainfish.ai/en-us/articles/track-your-credits-2HS0lqCRFt).
* View the [Insights](https://docs.cobalt.io/en-us/articles/insights-r4Jw78EcgA) page.

An Organization Member may also be a [Pentest Team Member](https://cobalt-io.brainfish.ai/en-us/articles/user-roles-and-permissions-oCij6uRrUR#h-pentest-team-member).

## Cobalt Pentesters

When you run pentests using the Cobalt Pentest as a Service (PtaaS) platform, Cobalt pentesters participate in the process. This group includes the following roles:

* Pentester
* Lead
* Coordinator

### **Lead**

Manages the testing team while actively executing the test. Reserved for tests with two or more testers.

### **Coordinator**

Manages the testing effort while actively executing the test. Reserved for Agile Tests or tests involving a single tester.

### **Pentester**

Individual contributor who executes testing under the direction of a Lead or Coordinator; does not manage the team.

## **In-House Pentester**

### **In-House Pentester**

An In-House Pentester is a pentester invited by a customer (organization) to perform In-House pentests on the Cobalt [Pentest Management Platform (PMP)](https://cobalt-io.brainfish.ai/en-us/articles/in-house-pentests-HYNuapVOyk). An In-House Pentester role has the same privileges as a Pentest Team Member, with additional access to pentester functionality.

A customer can invite pentesters from their organization, a third-party company, or both to complete In-House pentests on the Cobalt [Pentest Management Platform (PMP)](https://cobalt-io.brainfish.ai/en-us/articles/in-house-pentests-HYNuapVOyk).

Learn [how to complete an In-House pentest](https://cobalt-io.brainfish.ai/en-us/articles/complete-an-in-house-pentest-for-pentesters-y7RCf5izE6).

## **Cobalt Staff**

Select Cobalt Staff members have administrative access to your organization and tests. If needed, they can help you:

* Manage users in your organization
* Manage work on your tests




User Roles and Permissions

Collaboration Overview

Collaborate on Pentests

Groups

Manage Pentest Collaborators

Manage Notifications

Collaboration

How to get started with Cobalt

Getting Started

Risk Advisories

Assets are what we pentest

Asset Types

Create an Asset

Assets

Pentests

Overview

Asset Details

Pentest Details

Scope & Test Period

Preparation

Create a Pentest

Pentest Process

Pentest States

Coverage Checklist

Pentest Expectations

Set Up an In-House Pentest

Complete an In-House Pentest (For Pentesters)

In House Pentests

Finding States

Severity Levels

Remediate Findings

Findings

Customize Your Report

Co-branded Reports

Contents of a Pentest Report

Reports

Engagements Overview

Digital Risk Assessment

Secure Code Review

Engagements

Insights

Planning

Cobalt Methodologies Overview

Web Methodologies

API Methodologies

External Network Methodologies

Internal Network Methodologies

Mobile Methodologies

Cloud Configuration Review Methodologies

Cloud Pentest Methodology

Desktop Methodologies

AI/LLM Methodologies

Digital Risk Assessment Methodology

Secure Code Review Methodologies

Methodologies

Attack Surface Monitoring (ASM)

Attack Surface

DAST Scanner Overview

Best Practices

Integrations

Partial Scans: Reduced Scope

Scans

Sequence recorder

Targets

Target Authentication

Extra Hosts

Blackout Period

DAST Scanner

Account Overview

Account Settings

Password Best Practices

Sign In to Cobalt

Troubleshoot Sign-in Issues

User Account

Organization Overview

Manage Users

Your Cobalt Contract

Configure SAML SSO

How to Configure SAML 2.0 for Cobalt 

SAML Migration: Update Your Configuration

SCIM Provisioning Setup Guide

Configure Organization Settings

Organization

Track Your Credits

Cobalt Credits

Cobalt PtaaS Tiers

Credits

Cobalt Integrations Overview

Troubleshooting

Create Jira tickets for Findings

Send email notifications for Findings from Outlook

Create GitLab tickets for Findings

Create GitHub tickets for Findings

HTTP Connector

Import Assets from Google Sheets

Map Cobalt Pentest Finding Severity to Jira Issue Priority

Modify Jira Issue Summary to contain Pentest Title

Create Azure DevOps Work Item for Findings

Send MS Teams notifications for Findings

How to Guides

Connect your applications

Integration Builder

Synchronize Cobalt Severity Levels with Jira

Push Cobalt Findings to Jira

Jira Cloud Integration

Jira Data Center Integration

Troubleshoot Your Jira Integration

Switching to a New Jira Instance

Integrate Jira with Cobalt

Slack

Microsoft Teams

Webhooks

DefectDojo

Kenna Security

Vanta

Carried Over Findings

Create Test Finding

Cobalt API Overview

Create a Personal Cobalt API Token

Get an Organization Token

Revoke Your Personal Cobalt API Tokens

Create or Modify an Asset

Import Findings to Google Sheets

Cobalt API

Glossary

March 2026

February 2026

January 2026

November 2025 

August 2025

July 2025

June 2025

May 2025

April 2025

March 2025

January 2025

December 2024

November 2024

October 2024

September 2024

August 2024

July 2024

June 2024

May 2024

April 2024

March 2024

January 2024

What's New

Guide

Cobalt Product Documentation

User Roles and Permissions

Share

Share

User Roles and Permissions

Share

Share