When Mission Fed Credit Union chose a penetration-testing company, one detail caught its security manager’s attention: the price included testing the repairs. Ferdi Balagtas also liked the engagement team and the live results. But the retest is the revealing bit. Finding a broken lock is useful. Coming back to check the replacement changes the relationship.
- NetSPI pairs human hackers with software to test what attackers could actually exploit.
- Its platform connects exposure discovery, testing, and the work of fixing vulnerabilities.
- The October 2026 Synack merger adds a different researcher model to the mix.
That small purchasing decision helps explain NetSPI, a Minneapolis cybersecurity business founded in 2001 by Deke George and Seth Peter. Its central proposition is that a security finding becomes more valuable when someone supplies evidence, context, and a way to deal with it. A longer list of weaknesses can otherwise become a longer list of unfinished chores.
01 The retest is the tell
Mission Fed wanted outside help while beginning a relationship with a third-party application provider. NetSPI’s pricing, Balagtas explained in the customer account, was based on functional elements rather than hours. Findings appeared in the Resolve platform while work was underway. The credit union could review engagements in one place and have fixes checked afterward.
For a buyer, those details make a useful comparison sheet. What is being tested? When does evidence arrive? What happens after a developer says the problem is fixed? The last question is particularly good at making a sales conversation less comfortable, and more productive.
02 A mainframe meets a language model
NetSPI’s menu has an amusing range. At one end sit mainframes, including IBM z/OS environments. At another sit AI applications and large language models. In between are web applications, APIs, mobile software, networks, cloud infrastructure, medical devices, and industrial technology. Enterprise computing has accumulated several generations of machinery. Someone has to test the whole family.
The company advertises more than 50 pentesting service types and over 350 in-house security experts. That breadth is part of its position in the market: a bank can need application testing, hardware knowledge, and a red team without wanting to assemble three unrelated supplier relationships.
- 01DiscoverMap the exposed asset.
- 02ValidateProve the weakness.
- 03RouteGive the fix an owner.
- 04RetestCheck the repair.
A schematic of the workflow, rather than a promise about every engagement.
03 The handoff is part of the product
In May 2024, NetSPI put penetration testing, attack surface management, and breach and attack simulation into a unified platform. These answer related questions. What assets are exposed? Can someone exploit a weakness? Would the defensive tools notice the attack? Keeping those questions together makes it easier to follow a problem across organizational boundaries.
The mechanics matter. Platform documentation describes dashboards, findings, attack paths, and asset records. Integrations include Jira and ServiceNow for ticketing. Instead of manually transporting a finding between a test report and an engineering queue, teams can connect the systems where those conversations already happen.
Chubb shows how the use case can spread. The insurer’s relationship with NetSPI expanded from testing its own network to helping policyholders, including on-demand tests connected to underwriting renewals. Its customer account describes reproducible evidence and ticketing integration. Craig Guiliano puts the administrative benefit neatly:
“NetSPI saves me hours and hours”
Craig Guiliano · Chubb
The implied economics are interesting. A vulnerability has a technical cost, but also a coordination cost: reproducing it, explaining it, assigning it, and checking the result. NetSPI sells help with both.
04 Capital follows the testing bench
The business grew up before its big financing announcements. Sunstone Partners supplied its first institutional capital in 2017. A $90 million growth round led by KKR followed in 2021, with Ten Eleven Ventures participating. KKR announced another $410 million in 2022, supporting technology development, hiring, and international expansion.
Software-enabled services require a different kind of scale from selling software alone. There are still people to recruit and train. NetSPI University develops entry-level pentesting skills; technical applicants face a lab assessment. The company’s published values emphasize collaboration, innovation, and delivery. Its training program gives those abstractions a practical expression.
NetSPI reported 1,942 customers in 37 countries for 2024. Its commercial routes include direct engagements, partners, and AWS Marketplace. Custom-scoped marketplace offers can simplify procurement for existing AWS customers. The spending conversation still depends on the work: a cloud assessment and a hardware investigation are different purchases.
05 AI makes more work for humans
In May 2026, NetSPI launched AI-powered continuous pentesting for external and cloud environments. July brought expanded coverage and Continuous AI Findings Validation. The latter addresses a wonderfully modern problem: machines can produce security warnings faster than people can establish which warnings deserve attention.
Consultants review AI-generated findings, confirm their validity, and assess severity. The promise depends on judgment as well as speed. Testing AI systems and using AI to assist testing are separate jobs; NetSPI does both.
The Synack merger, completed in October 2026, extends that approach. NetSPI brings an in-house testing organization; Synack brings Sara AI Pentesting and a vetted researcher community. Existing customers continue with their current agreements and platforms. A completed transaction should not be confused with a fully integrated product.
06 What to borrow before you buy
NetSPI competes with PTaaS providers such as Cobalt and testing consultancies such as NCC Group. Human expertise and live findings are features buyers can find elsewhere, too. The useful comparison is the actual team, its specialist coverage, the testing scope, and the route from evidence to repair.
The lesson to copy is straightforward: require a reproducible finding, give remediation an owner, and agree on retesting before signing. This approach needs authorized access and people with time to make repairs. An excellent test cannot compensate for a company that leaves the results untouched. Mission Fed’s purchasing detail keeps coming back: who returns to check the lock?