Synack Red Team: The hackers with a work order

A hacker finds a hole. Someone patches it. Then comes the small, unglamorous question on which the whole exercise depends: did the patch work? Synack pays researchers to come back and check. That detail explains quite a lot about the Synack Red Team. The discovery gets the applause. The follow-through makes the service useful.

The SRT is Synack’s community of more than 1,500 vetted security researchers. Its members are independent contractors. For buyers, the proposition is access to outside expertise without recruiting an entire offensive security department. For researchers, it is a way to turn authorized hacking into paid work.

The job behind the hack

Penetration testing asks whether an attacker can turn a weakness into access, stolen information or some other unwanted result. A scanner supplies leads. An investigator follows them. Synack wraps that investigation in software that lets a security team launch tests, inspect findings and track remediation.

The work includes vulnerability hunting, structured missions and checking repairs. That creates several incentives inside one community. A spectacular discovery has value, but so does completing a necessary check. The resulting business is partly software, partly specialist labor, and partly coordination. Each part makes the others easier to buy.

The service extends across web applications, APIs, mobile software, cloud assets and infrastructure. Synack also offers social engineering, red team operations and targeted responses to newly disclosed vulnerabilities. These are different assignments: checking a particular control calls for a narrower brief than asking whether an adversary could reach a particular system. The scope determines the investigation.

First, make the strangers accountable

Jay Kaplan and Mark Kuhr founded Synack in 2013 after working at the National Security Agency. Kaplan became CEO; Kuhr became CTO. Their background helps explain the attention to controlled testing. Inviting outside hackers into a corporate environment requires a convincing answer to a rather reasonable question: who, exactly, are these people?

Jay Kaplan / CEO

Mark Kuhr / CTO

Admission involves technical and identity checks, interviews and onboarding. Synack also built LaunchPoint, which gives customers an audit trail of testing traffic. Accountability becomes part of the product. The government-facing credentials are specific: the FedRAMP Marketplace lists Synack’s testing platform at Moderate, with certification dating to December 19, 2023.

There is a community behind the controls. Envoy supports mentorship; Acropolis recognizes researchers’ work. Selected qualifications offer application shortcuts through Pathways. In June 2026, Synack expanded its CREST certification routes. These programs help explain how a dispersed pool of specialists can develop shared standards.

The calendar gave way first

At Jack Henry, the constraint was capacity. Its information security manager, Bob Ponsar, describes outgrowing boutique testing providers while still wanting their attention to detail. In Synack’s published account, Jack Henry handed over what it expected to be a year of tests. The work was completed in three months, with findings visible in the platform.

Iberia Cards had a different problem. Annual assessments left gaps between tests; generic scanner output missed consequential business-logic weaknesses. Its program paired deeper SRT investigations with more frequent Sara AI testing. The company initially ran Sara against assets researchers had already examined, allowing a direct comparison.

“The serious problems are always in the business logic.”

José Manuel Rivera García
CISO, Iberia Cards

The useful result, in that customer account, was evidence management could act on, alongside traceability for regulatory requirements. These examples explain the purchase better than a tally of vulnerabilities. One customer needed more testing capacity. Another needed repeatable proof of business risk. Both needed findings to travel beyond the person who discovered them.

Read the second line of the quote

Synack publishes starting prices: $4,181 for a Sara Pentest, $10,283 for a standard human-led pentest, and $27,120 for a Synack14 engagement. There is a consequential extra line: the Synack Platform is required and charged separately. Federal offerings and custom programs require a quote.

That is a useful buying lesson. Compare the full program: scope, duration, credentials, verification and platform fees. A small company seeking a narrow assessment may need a different package from a bank with changing applications. The cheapest test fee tells you little about which assets receive meaningful attention.

A useful comparison starts with a written test objective. Ask what the tester will attempt, which authenticated roles are included, how a finding will be reproduced and what happens after a developer ships a fix. Those questions turn an impressive sales presentation into something a security team can evaluate against its own specific needs and available budget.

A machine joins the work queue

Sara Pentest, announced in November 2025, brings AI agents into host and web-application testing. Reconnaissance agents identify services and endpoints. Attack agents attempt exploitation; verification agents check results. Synack says its triage team verifies exploitable findings before delivery. This is an allocation of work, with review built into the process.

Synack’s offer sits among traditional consultancies, researcher platforms such as HackerOne and Bugcrowd, and automated testing vendors. Those alternatives increasingly overlap. Synack’s particular combination is a private community, managed testing and a platform that connects findings to remediation. Buyers should examine that operating arrangement as carefully as the AI demonstration.

Connections to existing tools matter here. Synack’s Qualys integration imports scanner findings for further investigation and patch verification. Its Microsoft collaboration places testing within an Azure security improvement program. For the buyer, the practical question is whether outside discoveries can enter the systems where staff already prioritize work. A separate queue needs someone to own it.

The arrangement still needs a customer who can define authorized targets, provide appropriate access and fix what is found. Restricted access limits what an investigation can establish. Repeated discovery without engineering capacity simply grows the repair queue. Paying for continuous testing makes sense when an organization can keep responding to it.

More people, the same question

Synack raised a $52 million Series D in 2020, bringing announced funding to $112.1 million. On October 5, 2026, it completed its merger with NetSPI. The combination brings together NetSPI’s in-house testers and Synack’s researcher network. At close, the companies retained their separate platforms and agreements.

The transferable idea is straightforward: organize expertise around the whole task. Define the target, investigate the weakness, establish its impact, assign the repair and check it again. A company can copy that discipline with its own team. Synack sells a way to bring more people and software to the job.