Jay Kaplan

I have not posted here in a long time. This seemed worth logging back in for. This week @NetSPI and @Synack signed a definitive agreement to merge, backed by @KKR_Co. Together we are creating the largest expert-led offensive security platform in the world. Nearly 40 years of operating history and more than 13 million hours of real-world offensive testing, with agentic AI underneath all of it. There are far too many people to name here, so: every Synacker past and present, the investors who backed two guys out of the NSA in 2013 on an idea that sounded strange at the time, and the partners, advisors and customers who took our calls and told us the things we did not want to hear. The people who moved on built the floor the rest of us are standing on. This outcome is yours as much as anyone's. To the @SynackRedTeam especially. You are the reason the thesis was right in the first place. If I believed autonomous tooling could replace expert judgment, then merging two of the largest concentrations of it in this industry would be a spectacular waste of capital. This deal is an argument for your value, not against it. And I am looking forward to working alongside @Aaron_Shilts and the NetSPI team as much as anything else about this. Respected them from across the field for years. Glad to finally be on the same side of it. Briefly on why we did it this way, because it is not the obvious bet. The industry is spending hundreds of millions of dollars to take humans out of offensive security. "No humans in the loop." "Requires no human input." We just built the opposite. Every benchmark in this argument measures what agents found. Not one measures what they walked past. A false positive costs an engineer an afternoon. A false negative is the breach, and it is invisible by construction. The best autonomous agent yet tested beat nine of ten professional pentesters on a live network, out-submitted every one of them on false positives, and reached the finding that mattered only after researchers handed it hints. It was not outmatched. It was undiscerning. Autonomy was never the goal. It is a means. The goal is knowing which of ten thousand findings gets used against you, and knowing what nobody looked at. Day one of the next chapter. Thank you for building the last one with me. Full thesis: synack.com/blog/autonomy-was…

This isn’t sci-fi, it’s happening now: • Claude-powered ransomware kits on Telegram • Deepfake fraud scams stealing $25M in a single attack • AI-polymorphic malware mutating faster than traditional tools can keep up AI has become an accelerant for attackers.

The data makes it clear: • In 2024, 82% of orgs reported passing compliance audits. • In the same year, global breaches surged 72%. • Average cost per breach? $4.88M, up 17%. Compliance has become the floor, but attackers are already on the second story.

Congratulations @orenfalkowitz, @eastdakota and the @Area1Security team! Proud to have been a customer for many years and am glad to see you land at an amazing home @Cloudflare bloomberg.com/news/articles/…

Incredible achievement. Really proud of the team that we've built and am inspired every single day. It's our employees that make @synack such an amazing place to work. Thank you @Glassdoor for the honor.

I predict Log4j is the beginning of a plethora of massive-impact zero days to come to light over the next twelve months; every organization needs to use this event to fine-tune and operationalize their response plan.

Welcome to the team, Claire!

Great list of cyber security luminaries that should make a big impact.