Jay Kaplan Wants You to Let the Hackers In

One of Jay Kaplan’s customers had been hacked. He was a teenager running a shared web-hosting business, a job that involved renting out server space and keeping other people’s websites working. Then someone got into a customer’s site. For a young operator who was supposed to keep the machinery running, the obvious question was also the interesting one: how had they done that?

He followed the question. Years later, after government service and the founding of Synack, he would earn his living persuading organizations to ask it before an intruder supplied the answer. The awkward part was his proposed method. He wanted customers to give hackers permission to try.

It is a sales pitch with a certain social disadvantage. Most companies prefer visitors who admire the building. Kaplan wanted to bring people who would check the windows.

A business to run before the homework

Kaplan started his first company at 13, offering website development and shared hosting. He grew its customer base past 1,000 and automated work so he could continue going to school. He sold the business during his freshman year at George Washington University. The adolescent enterprise already contained two interests that would keep resurfacing: making technology work and organizing a business around it.

“I was always the on-call help desk,” he recalled. It is a modest description of an education that arrived through other people’s broken computers. Help desks also teach an inconvenient lesson early: the person who built a system and the person trying to use it can be living in quite different worlds.

His formal studies gave the curiosity somewhere to go. He earned a bachelor’s degree in computer science in 2008 and a master’s in engineering management in 2009. The combination fits the work that followed: understand the machine, then understand how people get something done with it.

Washington supplied the co-founder

George Washington’s cybersecurity connections mattered to his choice of college. A CyberCorps scholarship came with an obligation to work for the federal government in cybersecurity for three years after graduation. The arrangement offered a route into work that a small hosting company could hardly reproduce.

Kaplan’s government career included incident response and red-team work at the Department of Defense. At the National Security Agency, he became a senior analyst working on cyber vulnerabilities in support of counterterrorism intelligence operations. Offensive security meant examining how systems could be entered, including through weaknesses their owners might never have considered.

It also put him alongside Mark Kuhr, his future co-founder. The two worked on their business idea during late coffee runs and weekend meetings. In 2013 they left the agency, went through Techstars in Boston and moved to the Bay Area. Kaplan became Synack’s CEO; Kuhr became its CTO.

Leaving was a decision rather than a foregone conclusion. Kaplan considered business school and staying in government. He had enjoyed the work and valued its purpose. The startup offered a chance to apply that experience to organizations whose security resources looked very different from those available inside an intelligence agency.

First, persuade the customer you are sane

Early prospects had questions. Kaplan later recalled being greeted with “you guys are nuts.” Two people arriving from Washington wanted to arrange for hackers to probe a company’s technology. Before anyone debated the quality of the testing, there was the question of trusting the testers.

That objection reached into the design of the business. Synack screened researchers, checked identities and technical skills, and created controls around their access. A customer needed to know who was working, what they were allowed to test and how that activity would be tracked. The permission was bounded. A talent pool without rules would have been a rather expensive way to reproduce the customer’s original anxiety.

Kaplan’s proposal required two kinds of confidence at once. Researchers had to believe their discoveries would be handled fairly. Customers had to believe the search for weaknesses would stay inside the agreed limits. The platform sat between people with different incentives and made the arrangement usable.

The trust problem was commercial, technical and thoroughly human. Having worked at the NSA gave the founders credibility. It did not eliminate the need to explain why a stranger should be allowed to look for a way in.

“you guys are nuts”

Kaplan recalling the response from early prospects

Paying for an unwelcome discovery

The operating idea was straightforward enough: assemble capable security researchers from different places, give them authorized targets and reward useful findings. Their specialisms could cover different applications and infrastructure. People who would never appear together on a company’s recruiting shortlist could work on the same security problem.

In a 2014 explanation of the business, Kaplan described researchers who often had other jobs and did Synack work on the side. Rewards varied with the seriousness of a vulnerability. A finding such as a SQL injection flaw could earn several thousand dollars. The arrangement gave customers access to expertise they might otherwise struggle to hire.

It also made the definition of success unusually uncomfortable. The researcher was rewarded for demonstrating something the customer would prefer were impossible. A useful result might be bad news, delivered in enough detail to do something about it. The service had to make that news easier to act on.

By 2017, Microsoft Ventures was leading a $21.25 million funding round that also included Hewlett Packard Enterprise and Singtel Innov8. Investors saw a business in coordinating this work. Kaplan had already appeared on Forbes’ 2015 Enterprise Technology 30 Under 30 list. The teenage hosting operator had acquired a rather different customer conversation.

The answer was empathy

Ask a former offensive security analyst which employee virtue is underrated and you might expect precision, persistence or a low tolerance for weak passwords. Kaplan’s answer in a 2018 interview was “Empathy.” His three-word job advice was “Strive for excellence.” Together, those answers suggest standards that leave room for the person expected to meet them.

His view of the places he had worked was similarly balanced. Silicon Valley, he thought, could teach Washington to encourage ideas and tolerate the risk of failure. Washington could teach the Valley about execution, commitment and service. He admired what each culture did well enough to notice what the other lacked.

That matters in a company built between communities. Government customers, venture investors and independent researchers do not naturally share a vocabulary, a timetable or an appetite for uncertainty. The founder has to translate. A technically accurate answer can still fail if the recipient cannot use it.

There was a less solemn detail in the same interview: his favored coffee meeting spot was Equator in the LinkedIn building, near Synack’s San Francisco office at the time. From planning with Kuhr to talking business in California, coffee makes a recurring, perfectly unclassified appearance.

In 2021, he also backed an effort to change how the field was discussed. Synack launched README, a cybersecurity publication. Kaplan’s launch essay argued that reporting needed more technical expertise and deeper analysis, with contributions from people who understood the work firsthand. The initiative put another version of his recurring concern into public view: useful knowledge exists across a community, and somebody has to organize a way for it to reach the people who need it.

A machine joins the testing team

By 2025, Kaplan was making the case that security teams faced a mismatch between the pace of threats and their capacity to investigate them. Synack introduced Sara, the Synack Autonomous Red Agent, as part of its response. AI could take on more of the work of exploring systems while people brought judgment to difficult findings.

The word “autonomous” might seem an odd addition to a business organized around a community of human researchers. Kaplan’s position has been consistent about what he wants the technology to accomplish: widen the reach of testing and let expertise go further. Human participation remains central to the company’s offering.

In a May 2026 interview, he urged security leaders to judge the coverage they were getting. His suggested starting point was specific: identify a system whose compromise would seriously damage the business, map its connected assets and test from there. It is practical advice for a sprawling problem. Give the work a consequential place to begin.

The same reasoning changes the calendar. A test records a condition at a particular time. Software and infrastructure keep changing afterward. Kaplan argues for testing that continues with those changes, so the useful answer stays connected to the system people are actually running.

Thirteen years later, a larger table

On September 2, 2026, Synack and NetSPI announced an agreement to merge. Kaplan used the occasion to defend the value of experts working with AI. “Bad actors are unpredictable,” he said. His argument centered on the context and business logic that people bring to deciding whether a weakness can become a damaging breach.

The merger closed on October 5. The combined organization brings together NetSPI’s in-house testing practice and Synack’s global researcher community. Synack lists more than 1,500 vetted researchers; NetSPI brings more than 350 in-house penetration testers. Those figures describe different working models, with different ways of reaching a customer’s problem.

For Kaplan, the combination extends a proposition he has spent years explaining. Organizations need access to people who can think like their adversaries, and those people need tools that make their time more useful. Buying more testing capacity only helps if the findings lead to decisions.

His career began with an unwelcome discovery on a customer’s website. It has become a business of arranging for discoveries to arrive while there is still time to fix them. The invitation remains slightly awkward. Please come in. Here are the rules. Show us what we missed.