The Operator Who Walks Into Exits
There is a specific kind of person who shows up at a company, quietly rebuilds the product, helps engineer a nine-figure outcome, and then moves on to the next one. Sonali Shah has done it twice. First at Veracode - a $950 million sale to Thoma Bravo. Then at Invicti - a $625 million acquisition. Now she's running Cobalt as CEO, and nobody who's watched her track record is betting against a third.
She joined Cobalt's board in January 2024. Eight months later, she was named CEO. The board didn't have to look far - they'd been watching her think about the company's trajectory from the inside. That's not a coincidence. That's pattern recognition applied to people.
Cobalt is a Pentest as a Service company, which sounds niche until you realize that every enterprise with a digital surface area is a potential customer. The platform connects organizations to a vetted network of security researchers who perform penetration tests - simulated attacks designed to find vulnerabilities before actual attackers do. In 2025, Cobalt's pentesters uncovered an average of 12 critical vulnerabilities per day. Across the year: 255,000 testing hours. These are not abstract metrics. Each one represents a door that was locked before someone malicious tried the handle.
Shah's pitch is precise: traditional security testing runs on quarterly cycles. Threats don't. Her mandate is to make offensive security move at the speed of software development - continuous, AI-augmented, and deeply integrated into the development lifecycle rather than bolted on at the end.
At Bitsight, she built the product that became the industry's first cybersecurity risk rating platform - the equivalent of a credit score, but for how well companies manage their security posture. The category barely existed when she arrived. It's now a standard tool in board-level risk conversations. She didn't just contribute to that shift. She helped create the language for it.
Before Bitsight, there was a seven-year stretch at Verisign, then Syniverse, then Wall Street - a stint as an investment banker at Credit Suisse that she parlayed into a deep fluency with how companies get valued, sold, and rebuilt. The combination of financial architecture and product instinct is unusual. Most people develop one or the other. Shah developed both, and the resulting resume reads like a blueprint for how to turn security technology into durable business value.