Synack

Synack was founded in January 2013 by Jay Kaplan and Mark Kuhr, two cybersecurity specialists who met while working at the U.S. National Security Agency (NSA), where Kaplan served as a Senior Cyber Analyst (2009–2013) supporting counterterrorism-related intelligence operations and Kuhr spent over nine years across the NSA and the Defense Information Systems Agency (DISA). Both had NSA/DoD-funded academic fellowships (Kaplan at George Washington University; Kuhr earned a Ph.D. at Auburn University under a DoD/NSA-sponsored fellowship, after starting at West Point). Drawing on their government offensive-security backgrounds, they set out to build a 'controlled crowdsourced' penetration-testing model — vetting a global community of independent security researchers and pairing them with proprietary scanning and orchestration technology — as an alternative to traditional, episodic consulting-firm pentests. The company announced $1.5M+ in seed funding on August 1, 2013 from Greylock Partners and Kleiner Perkins Caufield & Byers (partner Ted Schlein), along with Wing Venture Partners, Allegis Capital, and Shape Security CEO Derek Smith as an individual investor; Synack's own SEC Form D shows $1.71M sold in that initial offering.

Synack raised a $7.3M Series A in April 2014, a $25M Series B in December 2014/February 2015 (with GGV Capital's Glenn Solomon joining the board around that time), a $21.25M Series C in April 2017 led by Microsoft Ventures with Hewlett Packard Enterprise and Singtel Innov8 (alongside prior investors GV/Google Ventures, GGV Capital and Kleiner Perkins), and a $51.6M (~$52M) Series D in May 2020 led by C5 Capital and B Capital Group. Across SEC filings, the five primary rounds total roughly $106.9M raised. Since 2020 there have been no further SEC Form D primary-round filings; Crunchbase records subsequent 'Secondary Market' transactions involving G Squared and LAPA Capital, indicating investor liquidity events rather than new primary capital.

Product-wise, Synack evolved from a pure crowdsourced bug-bounty/pentest marketplace into a broader 'Penetration Testing as a Service' (PTaaS) platform, adding attack surface management, vulnerability disclosure program management, and compliance-oriented continuous testing. The company built a public-sector practice early, offering free election-security testing to U.S. state election systems starting in 2018 (continuing through 2020 and 2024 election cycles) and working with agencies including the U.S. Department of Defense and Department of Health and Human Services. By 2025–2026, amid the AI boom, Synack pivoted its positioning toward 'Human + AI' continuous security validation: it launched an agentic AI pentesting capability in November 2025, published Synack/Omdia research in March 2026 finding that although 95% of enterprises prioritize pentesting, only 32% of attack surfaces are actually tested, launched a 'Glasswing' AI-readiness assessment in April 2026 to address AI/LLM security coverage gaps, and brought its AI agent 'Sara' (Synack Autonomous Red Agent) to general availability in May 2026 — claiming Sara can autonomously chain multiple vulnerabilities and, in early access, produced findings rated high/critical severity 70% of the time. The company reports its researcher network (the Synack Red Team) now spans 1,500+ vetted researchers across 80+ countries and has cumulatively delivered close to 10 million hours of expert security testing, and it was named a Leader and Fast Mover in GigaOm's 2025 PTaaS Radar.

Business model

B2B SaaS / managed security services; subscription and project-based Penetration-Testing-as-a-Service (PTaaS) sold to enterprises and government agencies, delivered via a marketplace of vetted freelance security researchers (the Synack Red Team) plus proprietary AI-assisted testing technology.

Subscription/flat-fee and engagement-based contracts for continuous penetration testing, attack surface management, vulnerability disclosure programs, and (from 2025/2026) AI-agent-assisted pentesting (Sara), also sold via AWS, Microsoft Azure and Google Cloud marketplaces.