NetSPI, a Minneapolis penetration-testing company majority owned by KKR, and Synack, a crowdsourced security-testing company based in Redwood City, California, signed a definitive agreement on 2 September 2026 to merge. The combined business will have well over $200 million in revenue, the companies said.
No financial terms were disclosed. KKR, which has controlled NetSPI since October 2022, will be the majority owner of the merged company and said it would fund the group's growth plan. The deal was subject to regulatory approvals and customary conditions, and Synack said in an update on its announcement that the merger closed on 5 October 2026.
The companies did not name the leadership of the merged business. Both chief executives, Aaron Shilts of NetSPI and Jay Kaplan of Synack, spoke for the deal. Existing customers, partners and employees are to keep their current ways of working at first while the range of services widens.
What Synack built
Synack was founded in 2013 by former operatives of the US National Security Agency. It runs a vetted community of outside security researchers, the Synack Red Team, which hunts for vulnerabilities in customers' systems on a continuous basis. Synack puts the team at more than 1,500 researchers; GovInfoSecurity reported the figure as nearly 2,000.
The company says it has delivered nearly 10 million hours of testing for enterprises, public-sector bodies and regulated organisations, and it built a practice serving US federal agencies. GovInfoSecurity reported that Synack had 242 employees at the time of the deal.
Synack's model relies on freelance researchers who are screened before they are allowed to test client systems, and the company's chief executive argued that the approach catches flaws automated scanners miss. Its customers have included enterprises, government agencies and organisations in heavily regulated industries.
“Autonomous tools find exploits. Experts armed with AI find the ones that actually breach you.”
Why NetSPI is merging
NetSPI was founded in 2001 and is known for penetration testing as a service. Its customers include the ten largest US banks and many Fortune 500 companies. According to GovInfoSecurity, it had 591 employees and no federal practice before the deal, so Synack's government business opens that market to NetSPI's hardware, IoT and physical device testing.
Kaplan told GovInfoSecurity that a freelance model has limits in areas such as networks, on-premises systems, hardware, operational technology and mainframes, where NetSPI's full-time staff can do the work. Shilts described continuous testing as a mix of in-depth expert tests, autonomous tools and crowdsourced researchers.
Both executives argued that AI should support human testers rather than replace them. Kaplan said AI still makes mistakes and struggles with some classes of vulnerabilities, such as business logic abuse. Together the companies claim nearly 40 years of operating history and more than 13 million hours of offensive testing.
The funding behind Synack
Synack's last disclosed round was a $52 million Series D in 2020, co-led by B Capital Group and C5 Capital. Synack said at the time that the round brought its total funding to $112.1 million; GovInfoSecurity put the figure at nearly $108 million.
Earlier backers that joined the Series D included GGV Capital, GV, Hewlett Packard Enterprise, Icon Ventures, Intel Capital, Kleiner Perkins, Microsoft's venture fund M12 and Singtel Innov8. None of the parties said how the merged company's equity was split between KKR and Synack's shareholders.
KKR's role and the advisers
KKR made a $410 million growth investment in NetSPI in October 2022. Ben Pederson, a managing director on KKR's technology growth team, said customers would look for a trusted partner given the pace at which attackers innovate. KKR said it would back investment in technology and product development, expansion of the testing workforce and international growth.
Piper Sandler and Latham & Watkins advised Synack. Gibson, Dunn & Crutcher advised KKR and NetSPI.
The companies said customers of the combined business include leading cloud providers, the largest US banks, Fortune 100 companies and US federal agencies. The merger was announced from both companies' home cities, Minneapolis and Redwood City, and Synack updated its announcement on 7 October to confirm that the deal had closed two days earlier.
