RowShield vs Cobalt: point-in-time pentests vs continuous checks

Head to head: Cobalt vs RowShield

Column claims about Cobalt are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.

What Cobalt does

Cobalt, associated with Cobalt Labs, Inc., helped define pentest-as-a-service: customers scope an engagement through a platform, matched vetted testers conduct the assessment collaboratively, and findings arrive in structured reports with remediation tracking and retest options. The model compresses logistics that traditionally delayed assessments and widens access to competent human testing for companies without in-house red teams.

Reports integrate with compliance narratives, and the collaborative platform keeps communication between customer and testers unusually fluid. For periodic, professionally conducted human assessment, the offering is coherent and well regarded, and nothing on this page disputes the value of skilled testers.

Where the scopes differ

Even excellent testers examine the system as it exists during the engagement. Supabase applications change on every merge, and authorisation posture changes with them: policies rewritten, protections dropped, grants widened, keys redistributed. Findings therefore begin decaying the moment the next migration lands.

Within the window itself, testers probing PostgREST must infer authorisation semantics from responses where filtered and empty results are identical, spending scarce hours reconstructing facts a catalog query states plainly. RowShield removes reconstruction: it reads definitions, applies rules such as RLS_DISABLED, ANON_TABLE_READABLE and SERVICE_ROLE_KEY_EXPOSED mechanically, and repeats the process with every change thereafter.

Why Supabase teams choose RowShield over Cobalt

The choice is rarely exclusive; it is about what holds the line daily. Human engagements recur seasonally at meaningful expense; migrations ship weekly regardless. RowShield installs permanent verification at that higher frequency: posture checked at every merge, drift reported as named-rule findings referencing the responsible commit, latency-to-alert measured in minutes.

Annualised, continuous coverage costs substantially less than repeated engagements while eliminating the unobserved intervals where regressions incubate. Engineers act on findings without translation, and the accumulating verification timeline doubles as governance evidence.

For the standing question of RLS integrity, persistence outperforms periodic brilliance.

Where Cobalt is the right choice

Some assurances require people. Customer contracts and audit programmes frequently specify a recent human-led penetration test, and Cobalt satisfies such requirements credibly. Business-logic flaws, chained abuses and creative misuse resist rule engines and reward skilled curiosity, which its tester community supplies.

The concession is structural, not qualitative: engagement-shaped assurance cannot police ongoing change, however talented its authors. Value concentrates when the system under test is verified sound beforehand and monitored faithfully afterwards, which is precisely the role RowShield plays around each engagement.

Using both

Orchestrate them as bookends around continuous monitoring. Before engagement, RowShield verification establishes that configuration hygiene is sound, directing purchased human hours toward logic and exploitation rather than confirming basics. During, the catalog picture accelerates tester orientation and triage.

Afterwards, the platform report becomes a baseline that RowShield then defends: every subsequent migration is checked, and drift alerts confirm whether tested properties survived the next dozen merges. Retest conversations grow shorter because regressions surface immediately. Customers and auditors see human attestation plus machine-verified continuity, a combination that reads as maturity in any security review.

Frequently asked

Is RowShield affiliated with Cobalt?

No. RowShield is developed by Veristria and is not affiliated with, endorsed by or sponsored by Cobalt, associated with Cobalt Labs, Inc. Trademarks referenced herein belong to their respective owners and appear for identification purposes only.

Can I use both together?

Yes, and the sequence matters. Verify posture with RowShield before the engagement so human hours concentrate on logic; let the report stand as the baseline afterwards while RowShield defends it against every following migration. Human attestation plus machine-verified continuity is stronger than either alone.

How soon after a pentest can our posture silently regress?

With testing alone, immediately: the first migration after the report can disable protection or widen grants, and nothing observes it until a retest. With RowShield, that same migration is verified on merge, the regression is flagged within minutes with rule and object named, and the tested posture stays demonstrably intact.