NetSPI and Synack plan merger to build offensive security giant

NetSPI and Synack have entered a definitive agreement to merge, creating a combined offensive security company focused on continuous testing with agentic AI and human researcher validation. The deal is expected to close in October 2026 and leaves current customer service unchanged for now.

Why it matters: - The merger combines two major offensive security providers into a single platform aimed at continuous testing instead of one-off engagements. - The companies say the combined organization will pair expert researchers with agentic AI to speed coverage while preserving human judgment on exploitable risk. - Enterprise customers could get broader testing capacity and more frequent security validation if the integration delivers as planned.

What happened: - NetSPI and Synack entered a definitive agreement to merge. - The companies say the combined business will create the world's largest bench of elite security researchers. - The merged company will also combine that researcher base with what the companies describe as the industry's most sophisticated agentic AI pentesting platform. - The announcement was made Sept. 30, 2026, in Redwood City, Calif. - The transaction is expected to close in October 2026, subject to customary closing conditions and regulatory approvals.

The details: - The combined company brings together nearly 40 years of operating history. - NetSPI and Synack say they have more than 13 million hours of real-world offensive security testing experience. - The companies are organizing around continuous offensive security, which means ongoing expert-led testing rather than isolated scheduled assessments. - Agentic AI will be used for speed and coverage, while security experts will decide which findings represent exploitable risk. - Jay Kaplan, CEO and co-founder of Synack, said the deal is “a bet on expert judgment at AI scale.” - Existing customers will keep working with their current teams, services and platforms until the deal closes. - Testing cadence, scope, platform access and points of contact remain unchanged during the pre-close period. - The companies said more information about the combined organization will come after closing. - Customers and partners with questions have been directed to their existing account representatives. - The combined organization will serve enterprise customers across a shared bench of security researchers and testing infrastructure.

Between the lines: - The deal reflects a broader shift in offensive security toward continuous validation instead of point-in-time pentests. - The merger also signals that AI-driven scale is now being paired with human review, not used as a substitute for it. - The companies are positioning the combination as an answer to market demand rather than a change in strategy.

What's next: - Regulators and customary closing conditions must be cleared before the transaction can close. - NetSPI and Synack plan to share additional details about the combined company after the merger closes in October 2026. - Current customers are expected to see no immediate changes before closing.