NetSPI and Synack to Merge, Forming A Leading Offensive Cybersecurity Platform

Combined company pairs elite “white hat” hackers with agentic AI to deliver security validation at scale

NetSPI, a global leader in modern penetration testing, and Synack, a global leader in continuous security validation, announced a definitive agreement to merge and form the industry’s leading offensive cybersecurity platform. The combination brings together two of the premier expert-led offensive security organizations and integrates agentic AI across the combined platform to deliver continuous testing and validation at enterprise scale.

As the industry explores fully autonomous testing approaches, these two companies share the conviction that AI is most powerful when combined with expert judgment. By bringing together leading security talent and AI-enabled capabilities, the merger positions the combined company to deliver more sophisticated testing at greater scale.

The combined company is well over $200 million in revenue and serves a blue-chip client base that includes top cloud providers, top U.S. banks, MAMAA (Meta, Amazon, Microsoft, Apple and Alphabet) companies, the Fortune 100, as well as U.S. federal agencies.

Together, the companies bring nearly 40 years of combined operating history and more than 13 million hours of premier, real-world offensive testing experience, providing the scale, expertise and capabilities to help organizations address increasingly sophisticated cybersecurity threats.

“AI is transforming security testing, but it’s still experts who find the vulnerabilities that lead to real breaches,” said Jay Kaplan, CEO of Synack. “Bad actors are unpredictable; you need people who understand context, business logic, and attacker intent to catch them. Our challenge to the market: put our expert + AI team against any fully autonomous platform, on a real target, anytime. Autonomous tools find exploits. Experts armed with AI find the ones that actually breach you.”

Also Read: CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight

The combined company will offer customers expanded capabilities across the full offensive security lifecycle, delivering:

• One of the industry’s deepest benches of vetted offensive security talent, amplified by agentic AI
• Purpose-built AI that accelerates discovery, analysis, and validation of findings
• Continuous security testing and validation across the full attack surface
• Expanded service offerings with flexible delivery models
• Greater operational scale, efficiency, and accelerated innovation.

“Every conversation about this merger started with the same question: What does the customer get out of it? The answer is simple,” said Aaron Shilts, CEO of NetSPI. “More coverage, deeper expertise, and faster answers from a partner they already know and trust. On day one, nothing about how customers work with us changes, but what they can access grows significantly.”

The combined company will continue supporting existing customers, partners, and employees throughout the integration, with a sustained focus on service continuity and long-term growth.

KKR will support the combined company’s growth plan, including investment in technology and product development, expansion of the combined company’s offensive security talent base, and continued international growth.

“Offensive security is a large and structurally growing market driven by regulatory requirements, expanding attack surfaces, and increasingly sophisticated threats amplified by AI,” said Ben Pederson, Managing Director on KKR’s Technology Growth team. “The combination of these two companies creates a platform with the scale, technology, and talent to serve the most demanding enterprise and government customers. Given the pace of adversary innovation, customers will be looking for a trusted partner to help maneuver the accelerating velocity of threats and breaches, and we believe there will be no other company in the market with the breadth or depth of offensive security capabilities.”