While platforms bought agent workflows, the offensive-security market made the opposite trade: double down on humans.
On September 2, KKR-backed NetSPI and Synack announced a definitive agreement to merge into a combined offensive cybersecurity platform. Deal price: Undisclosed. Expected close: October 2026, subject to customary conditions and regulatory approvals. Until then the companies operate separately with no change to existing customer engagements. Those are the press-release facts. CyberMerge will not invent a transaction value.
Scale claims differ by source and should stay labeled. The joint press release says the combined company is well over $200 million in revenue. Synack CEO and co-founder Jay Kaplan's same-day blog says the combined company is approaching $300 million in revenue. Cite both. Do not average them into a fake midpoint. The release also cites nearly 40 years of combined operating history and more than 13 million hours of premier offensive testing, with a blue-chip base spanning top cloud providers, top U.S. banks, MAMAA companies, the Fortune 100, and U.S. federal agencies.
The product thesis is explicit and contrarian. NetSPI pioneered Penetration Testing as a Service across more than fifty pentest types, attack-surface management, and vulnerability prioritization. Synack pairs Sara AI Pentesting with the Synack Red Team — a rigorously vetted researcher community — across web, API, mobile, cloud and host, internal environments, and AI or LLM systems. Kaplan's blog frames the merger as a bet against fully autonomous testing: agents score well on CTF-style benches and worse on realistic enterprise environments; experts with AI find the breaches autonomous tools miss. Axios Pro separately characterized the deal as NetSPI merging with Synack in an offensive cyber combination amid an AI-driven surge in M&A and venture activity in testing.
Why this matters for the category. Horizon3's NodeZero printed a $2 billion-plus private mark on automated validation earlier this cycle. Startups keep shipping agentic red-team SKUs. NetSPI–Synack is the incumbent response: consolidate the deepest human benches, wire agentic AI through the combined platform, and dare autonomous vendors to a live-target bake-off. KKR, already behind NetSPI, said it will support technology investment, talent expansion, and international growth post-close. Piper Sandler advised Synack; Latham & Watkins counselled Synack; Gibson Dunn advised KKR and NetSPI.
Put the merger next to Palo Alto's Console buy the same week. One side of the tape is platforms absorbing agentic workflow startups into SOC platforms. The other is offensive specialists merging to keep expert judgment inside the AI loop. Both can be true. Neither discloses every number buyers want. Customers are told day-one engagements do not change; what grows after close is coverage, expertise, and speed.
Underwrite the page: definitive merger, price Undisclosed, close eyed for October 2026, revenue "well over $200M" (press) / "approaching $300M" (Kaplan blog), KKR support, expert+AI thesis. Ask what net pricing power and continuous-testing attach look like four quarters after close before you treat "humans win" as settled category law. A merger without a printed price is still a structure. The structure is the signal.