Inside the 2.7x Problem: Vulnerability Discovery Is No Longer the Bottleneck | Cobalt

Cobalt Platform AI-powered offensive security platform for continuous risk mitigation Integrations Automate workflows to remediate vulnerabilities faster Artificial Intelligence Cobalt Sage AI is the intelligence that powers every pentest Pricing Explore the flexible Cobalt credit model that scales to your needs Agentic PTaaS Human-led, AI-powered pentesting that scales with your attack surface DAST Continuously monitor web applications and APIs for vulnerabilities

Secure every application with flexible pentesting that combines expert-led testing, autonomous validation, and actionable results

Autonomous Pentest Fast, autonomous pentests for every release and every new threat AI & LLM Pentest Targeted testing to protect your AI systems and models Web Application Pentest Ensure your mission-critical applications are secure API Pentest Identify exploits for endpoints and microservices

Offensive Security Program Go beyond one-off pentests with continuous testing, fix validation, and strategic guidance Continuous Pentesting Program Go beyond on-demand pentests with a continuous pentesting program Enterprise Consolidate pentesting into a centrally managed, continuous program that scales with your business Compliance Meet ever-evolving governance, risk, and compliance requirements with expert-led pentesting Small Business Comprehensive pentesting to meet compliance requirements Secure SDLC Embed proactive security practices across the entire software development lifecycle

Resource Library Essential reading and toolkits for modern cybersecurity professionals Blog Sharpen your skills with expert commentary and practical security advice Demo Center Explore the features, insights, and automation that help teams deliver high-impact pentests Customer Stories Learn how real customers benefit from the Cobalt Offensive Security Platform Webinars & Events Live and on-demand events and training for today's most pressing security challenges Learning Center Learn the fundamentals of offensive security and strengthen your cyber defenses Partners Explore the Cobalt partnership network and apply to become a partner today Newsroom Read the latest news stories and press coverage

About Us Learn how Cobalt infuses manual security testing with speed, simplicity, and transparency Contact Us Get in touch with a member of our team Leadership Meet the executive leadership team driving our mission Cobalt Core Meet the community of skilled and highly vetted pentesting experts Careers Join Cobalt to help us redefine and reimagine offensive security Become a Pentester Apply to join our elite community of freelance pentesters

LLM applications generate serious vulnerabilities at 2.7x the rate of any other asset type, a ratio unchanged across two years of pentest data. Meanwhile, automated agents now reach initial access in under seven minutes at the cost of an API call. Discovery is no longer the bottleneck, and the security programs built around that assumption are exposed. Joe Brinkley (Head of Security Research) and Luke Doherty (Head of Customer Engagement) at Cobalt unpack new findings from thousands of AI and LLM application pentests and 450 security leaders.

What you'll learn:

How attackers chain prompt injection, now 37.6% of LLM findings, into multi-step exploits against production AI systems
How frontier models like Claude Mythos collapsed the skill barrier to sophisticated offense, and what to do about it
How to read the adversary patterns behind the numbers, and where they point next for your program

Joe Brinkley, also known in the community as BlindHacker, serves as the Director of Offensive Security Research & Community at Cobalt. Bringing over 20 years of "in the trenches" experience to the offensive security space, Joe’s career began in 2005 with a decade as a high-level government consultant before he transitioned into commercial penetration testing in 2016. He joined Cobalt in late 2025, drawn by a mission to evolve traditional Pentesting into a more dynamic, community-driven research model. When he isn't obsessing over cybersecurity, you’ll likely find him tinkering in his home lab or perfecting a smoked brisket.