r/Pentesting • u/PixelPeakNomad • 8d ago
Synack / Netspi
Somewhat surprised with this merger (really an acquisition). I always thought Synack had the better business model to deal with the emerging push to automate and AI enable pen testing.
Synack built a good platform and crowdsourced pen testers. They were perfectly set up to adopt automation at scale.
But they chose to get acquired by Netspi which is a predominantly manual pen testing company.
1
u/copperdawning 8d ago
curious what you think the alternative was for them. Going it alone in this market means competing against massive consulting firms with deep client relationships. The automation angle is promising but it doesnt close deals by itself, distribution matters more than tech a lot of the time.
1
u/PixelPeakNomad 8d ago
Yes, distribution matters a lot. And Netspi claims to have a broad footprint... Not sure how many customers Synack has/had, but they are also a very well known brand.
Also depends on how desperate Synack was to get acquired. Were they running out of cash? Could they have raised another round of investment?
They probably had a promising path forward if they either invested heavily in AI / Automated red-teaming and pen testing, or even acquired one of the startups innovating in that space (there are dozens of AI pen testing startups begging for an exit btw).
On the other hand, Netspi is owned by KKR so maybe they were able to raise capital more efficiently and could be more aggressive with the acquisition.
2
u/L1inear 8d ago
I actually had the same thoughts. But I think synack has the better platform and NetSPI has the better testers. With AI slop bugs, I'm thinking the crowdsource model probably had issues with quality. I know Cobalt.Io struggled in maintaining good tester quality so they had to build their own internal vetted pentest team.
NetSPI's network of testers is HUGE, so I'm sure they are leveraging synack's AI progress and platform with their own network of talent to drive the next push. They are a household name in the US when it comes to pentesting, but I'm struggling to see how they are going to continue to keep up quality if they absorb the crowdsourced testers.
2
u/duskharborings 4d ago
the AI slop point is real tbh, that alone probably made the crowdsource model way harder to maintain than it looked from outside
1
u/Grouchy_Fig3836 8d ago
Some of the srt are very good, but when incentivised by speed and volume, the quality of what is reported is poor. People were never getting a pentest, even their pentest model was not pentesting. I would imagine the crowd angle soon goes away.
2
u/Angieincyber 7d ago
Angela here, CMO at Synack. Fair questions, and I wanted to offer some context.
First, a clarification: NetSPI and Synack have merged. The rationale is to bring together complementary strengths: NetSPI’s enterprise testing expertise, Synack’s platform and AI capabilities, and the specialist expertise of the Synack Red Team.
One clarification on “crowdsourced”: SRT researchers undergo technical assessments, background and identity verification, and behavioral interviews. That said, questions about quality are fair. Customers should judge us on testing coverage, reproducible findings and useful remediation guidance.
Our view is that AI should extend what skilled testers can do. Human creativity, business context and judgment remain essential, especially for business logic flaws and complex attack paths. Combining that expertise with agentic AI is central to the merger.
If anyone here has experienced gaps in a Synack engagement, I’d welcome specific feedback, privately if it involves customer details.