Synack Put 1,500 Hackers Behind One Locked Door - Now AI Is Knocking

The first thing Synack had to penetrate was disbelief. In 2013, former National Security Agency operators Jay Kaplan and Mark Kuhr arrived in Silicon Valley with an offer that sounded less like a security service than the opening scene of a breach report: allow a rotating group of people from around the world to attack your applications and networks. Early prospects, Kaplan later recalled, told the pair they were nuts. Fair response. The founders were two unfamiliar men from Washington asking chief information security officers to invite unfamiliar hackers inside.

That objection did not disappear under a glaze of better marketing. It became the product specification. Synack would recruit skilled security researchers, test their technical ability, verify identities, run background checks, interview them and route their work through controlled infrastructure. Customers would see where testing traffic came from. Synack would review findings, manage payments and keep the engagement inside a platform. The company was not selling access to a crowd so much as a way to make a crowd governable.

Thirteen years later, that controlled crowd is the Synack Red Team, a community of more than 1,500 researchers. Its work sits beside vulnerability management, coverage analytics, integrations, reporting and patch verification in a subscription platform. In 2025, Synack added a new sort of researcher: Sara, the Synack Autonomous Red Agent. The name sounds friendly. The job description does not. Sara maps attack surfaces, probes web applications and hosts, and attempts to turn weaknesses into working exploit chains.

A marketplace wearing a seat belt

Synack lives between three familiar security products. A traditional consultancy assigns a few testers for a fixed window and delivers a report. An open bug bounty program invites independent researchers to submit findings for rewards. An automated scanner sweeps broadly and produces alerts. Synack borrows from each: human judgment from consulting, performance incentives from bounties and repeatability from software. Then it adds restrictions that make the mixture acceptable to banks, federal agencies and large technology companies.

Researchers do not simply point their laptops at a customer and hope the rules are clear. Synack indexes their skills, assigns work, monitors activity and uses known testing infrastructure. They can earn money for finding vulnerabilities, completing defined missions, writing reports, verifying patches and mentoring. Customers buy testing products at defined rates; Synack handles researcher payouts. That separation matters. A customer does not receive a surprise invoice because the target happened to be full of bugs, and a researcher still has a reason to find something more useful than a cosmetic warning.

The result is Penetration Testing as a Service, or PTaaS. Security teams can test web and mobile applications, APIs, networks, cloud environments and internal systems. They can launch a point-in-time compliance assessment, give a team 14 days to hunt, or run testing throughout the year. Findings appear while work is underway, not only after a consultant has formatted the final PDF. Jira, ServiceNow, Splunk and Microsoft integrations move results toward the people expected to fix them. A patch-verification request sends the tester back to see whether the door is actually shut.

A bank described the old ritual with painful precision: one enormous annual test produced one enormous report; teams said they had remediated the findings; the next year's test found some vulnerabilities still present. With Synack, patch verification became part of the workflow. That shift looks mundane next to the hacking, but it may be the more valuable product decision. Finding a hole is an event. Proving the repair changes the operating habit.

What it costs - and what broke first

Synack now publishes starting prices, a welcome bit of daylight in enterprise security. A low-complexity Sara pentest for one web application or up to 100 host IPs starts at $4,181. A standard human-led pentest starts at $10,283. A Synack14 engagement, with a team testing for 14 days, starts at $27,120. Enterprise programs are custom. The full Synack Platform is a separate subscription, while a basic platform tier is available without charge. Scope, duration, testing method and number of assets determine the actual bill.

The first failure in the company's story was not a bad release. It was the conventional pentesting model the founders had watched from the offensive side of government work. Annual consulting engagements were brief, talent was uneven and networks changed after the testers left. Automated tools covered more ground but often stopped at possibility: a vulnerable version, a suspicious response, a theoretical path. Attackers did not stop at possibility. Kaplan and Kuhr believed defenders needed a renewable offensive force.

Then Synack's own pitch failed its first contact with buyers. The idea of a remote hacker community triggered exactly the trust questions a responsible CISO should ask. Former NSA credentials helped the founders get heard, but the early results changed minds. Researchers uncovered weaknesses that existing approaches had missed. One early customer, Kaplan said, became almost paralyzed by the quantity of evidence. The lesson was uncomfortable: a security test can succeed technically and fail operationally if the customer cannot absorb what it finds.

Sara gets the map. Humans take the alley.

Sara is Synack's answer to the same capacity problem, updated for an era when both attack surfaces and attackers move faster. It uses specialized agents for reconnaissance, mapping and exploitation. In an early customer engagement, the system found and exploited a chain involving SQL injection, account takeover and stored cross-site scripting in six hours without human guidance; 70 percent of that engagement's findings were rated high or critical. General availability followed in May 2026 after selected deployments beginning the previous October.

The significant design choice is what Sara does not replace. Its findings pass through human validation, and the Red Team pursues business-logic flaws and chained paths that automation may miss. This is less romantic than the usual story of an AI agent replacing an expensive profession. It is also more credible for a product whose output can send engineers scrambling, trigger disclosure obligations or touch government systems. Synack uses the machine to make testing abundant and the person to make the conclusion defensible.

That combination is the company's current market position. HackerOne and Bugcrowd offer broad hacker-powered programs. Cobalt, NetSPI and BreachLock sell variants of PTaaS. Consultancies offer depth and bespoke advice. Scanners offer inexpensive breadth. Synack's case rests on controlled access, a deliberately selective researcher community, visibility into testing coverage, FedRAMP Moderate authorization and one platform for both autonomous and human-led attacks. It is a premium workflow for organizations where an unproven alert wastes real money and an untested asset carries real consequences.

The limits of the locked door

Synack is not a universal upgrade. A small company with one stable application may not need a global researcher pool, continuous analytics or a platform subscription. A business hunting for the cheapest compliance checkbox can buy a narrower assessment. A team with no engineering time to remediate findings will simply acquire a more elegant queue of bad news. And no pentest, continuous or otherwise, replaces secure design, code review, monitoring, incident response or the dull discipline of patching.

There is also a tension inside the AI story. Sara's lower entry price and speed make broader testing possible, but automated offense will become less distinctive as models improve and rivals copy techniques. Synack's durable advantage, if it has one, is not that it owns an agent. It is the accumulated system around the agent: a decade of attack knowledge, controlled infrastructure, customer permission, human reviewers and a workflow that ends at a verified patch. The machine can knock faster. The valuable part is still knowing which door it opened.