NetSPI & Synack Are Now One

Continuous Offensive Security at AI Scale

Read the Press Release Download PDF

NetSPI & Synack bring together two complementary approaches to offensive security

What has closed, and what is not changing?

NetSPI & Synack have officially closed their merger, bringing together two complementary approaches to offensive security. NetSPI contributes a large in-house testing organization, specialist coverage for legacy and physical technology, attack surface management and breach and attack simulation. Synack contributes Sara AI Pentesting, a vetted global researcher community, continuous and point-in-time PTaaS and human validation of exploitability.

Nothing changes for existing engagements as a result of the close. Testing cadence, scope, platform access and points of contact stay the same, and customers and partners should continue working with their current representatives.

The Combination at a Glance

Nothing changes for existing engagements as a result of the close.

  • No Change Today: Testing cadence, scope, platform access, and points of contact stay the same. Customers and partners should continue working with their current representatives.
  • Transaction Closed: Definitive agreement announced September 2, 2026. The merger officially closed in October 2026, following customary closing conditions and regulatory approvals.
  • Combined Scale: More than 13 million hours of real-world offensive security testing, over $200 million in combined revenue and nearly 40 years of combined operating history.
  • Human Depth: 350+ NetSPI in-house pentesters and 1,500+ vetted Synack Red Team researchers, two different delivery models rather than one larger pool.
  • Testing Breadth: 50+ NetSPI penetration testing types, plus Synack continuous and point-in-time PTaaS across modern attack surfaces and Synack Advanced Services.
  • Federal Posture: The Synack security testing platform is FedRAMP Moderate Authorized. This authorization applies specifically to the Synack platform, remains unchanged by the merger, and does not extend to NetSPI products or any future combined offering.

+

Why the combination matters for security teams

  • Operate continuously without losing depth:

    Continuous testing keeps changing surfaces under recurring scrutiny, while specialist, compliance and point-in-time assessments stay where the technology, risk or regulation demands them. The two models are complementary, not alternatives.

  • Cover more of the attack surface:

    Both companies test modern applications, APIs, cloud, infrastructure and AI systems. NetSPI adds specialist depth across mainframe, hardware, IoT and OT. Synack adds continuous testing and a global researcher community. Together that is a wider set of assets and technology types that can enter an assurance program,

  • Multiply expertise with AI:

    Purpose-built and agentic AI expand what expert testers can reach. Sara AI Pentesting runs real-world attacks at a scale traditional pentesting cannot match, and findings are validated by human experts. The point is augmentation. Neither company positions AI as a replacement for expert judgment.

  • Prove what is actually exploitable:

    Scanner output and attack surface data tell you where exposure might be. They do not tell you what an adversary can reach and use. Human-validated exploitability, security control evidence and remediation context give teams a defensible basis for what to fix first.

  • Connect exposure to action:

    Asset visibility, prioritization, offensive testing, defensive control validation, remediation and retesting belong in one flow. NetSPI integrates penetration testing, attack surface management and breach and attack simulation. Synack connects asset discovery, validated findings, patch verification and reporting. The combination expands coverage across this lifecycle.

13M Hours

combined testing experience

40 Years

of combined operating history

Talk to your account team to learn
what the merger means for you

“Organizations need validated findings they can trust, backed by security professionals who understand exploitability, context and business risk.”
NETSPI AND SYNACK MERGER ANNOUNCEMENT, SEPTEMBER 2026

How We Complement Each Other ( Today )

Each Company ( Today )

AI-enabled pentesting

An AI-accelerated platform with agentic MCP integrations, supporting discovery through validation. July 2026 New Continuous Offerings:

  • Web App & AI Applications
  • Internal Network Pentesting
  • Continuous AI Findings Validation with  expert human judgment to the output of AI-driven tooling.

Sara AI Pentesting, generally available since May 2026. Sara AI runs real-world attacks against the same scoped assessment a human researcher would use, at a fraction of the credit cost, and every finding is validated by human experts before it reaches the customer.

Application & Infrastructure testing

Web, API, mobile, thick and virtual applications, internal and external
networks, AWS, Azure and GCP, and AI/ML.

The same surfaces, delivered point in time or continuously: web
applications, APIs, mobile, cloud, hosts, internal environments and
AI/LLM systems.

Human offensive talent

350+ in-house pentesters, positioned as an extension of the
customer’s team.

1,500+ vetted Synack Red Team researchers in a global research
community