Synack Reviews & Product Details

We’ve been using Synack for a number of years and consider them a trusted, long-term partner. Their flexibility and willingness to work with our evolving needs has been a major differentiator, and their support teams have been consistently responsive and reliable—especially over the past few years as our environment and requirements have continued to grow.

From a security perspective, we strongly value Synack’s crowdsourced testing model. Having a diverse pool of vetted researchers means our applications are continuously tested by individuals with varying skill sets and areas of expertise, which provides broader and more realistic coverage than traditional approaches alone.

The Synack platform itself has evolved significantly during our time as a customer. It’s clear they are not standing still—the platform is regularly updated with new features and capabilities, more recently around analytics and scope coverage, which has improved both visibility and executive-level communication. We also appreciate that Synack is actively investing in and leveraging AI within their ecosystem rather than simply coasting on past success.

Synack has proven to be a strong partner that continues to innovate while maintaining the operational maturity and support we rely on. Review collected by and hosted on G2.com.

In the past, I had some concerns around the depth of analytics and the data available across different assessments. At the time, it was difficult to easily dive into detailed metrics and trends at the level we wanted. Synack has since addressed this gap by rolling out much more robust analytics, and overall data visibility, which has significantly improved the experience. I will note that Reporting has always been good.

Another past challenge was ensuring consistent “eyes on” coverage from researchers across our assessments (having the same assessment running year over year can be a challenge). Synack listened to feedback and has taken tangible steps to improve this over time. That said, this is also a shared responsibility—customers need to keep scopes current, ensure red team context is updated, and periodically review and tune assessments to get the best results. Review collected by and hosted on G2.com.

I appreciate that Synack explains exactly how each flaw was exploited and provides a full detailed explanation on how to remediate the flaw. This reduces developer toil by cutting down the time needed to develop the remediation, and it's like getting secure code training for free. Customers purchase credits, not tests, allowing for the credits to be used for any type of test offered, even to customize tests, making the licensing model extremely flexible. Synack is more important than just checking a compliance box; it does more than merely validating controls are in place. It validates if those controls work, and it can confirm that remediations have actually fixed problems. Unlike standard compliance checks like SAST scans, it doesn't just test against known requirements but also looks for unknown failures like logic flaws, insecure workflows, auth bypasses, etc. Review collected by and hosted on G2.com.

Sometimes they have been a little slow to spin up their red teams, but all it takes is a follow up call and they are always willing to up the priority. The setup is easy for the most part, but can get a little more complicated when API and/or multiple testing accounts are involved. Review collected by and hosted on G2.com.

I like the unique way in which Synack operates. They pull from a differentiated set of attackers or thought leaders, which feels innovative. The way they represent and present the information back to me on what they found is something that I appreciate. Review collected by and hosted on G2.com.

I'm a bit concerned about the cost pressures with Synack, in terms of always needing to do more with less. I feel that Synack needs to rethink its approach to the market because the buying cycle and the economic buyer have shifted. I also think there's a need to focus more on how the service ties into enterprise resiliency rather than just standard break-fix penetration testing. The space has become more commoditized, which makes conversations about it more difficult and a tougher fight to keep it relevant. Review collected by and hosted on G2.com.

The pen test results that come out of the service are very robust and always accompanied with detailed documentation enabling our teams to recreate the vulnerability. The dashboards and reporting provided within the platform are easy to digest and rich in data/insights. Review collected by and hosted on G2.com.

It's more difficult to execute tests of internal applications that aren't exposed to the internet, though this is to be expected. In these cases, the Synack team works closely with us to set up the test using the best methods available. Review collected by and hosted on G2.com.

I find the metrics in Synack's portal very good, offering a level of detail related to each vulnerability that's very helpful. I really like how Synack's service validates that a vulnerability is truly fixed once patching or code changes are applied. Synack's customer success team stays engaged and invested, adding value and supporting our security program. I consider Synack a true partner. Their portal helps track our time to resolve each vulnerability, which is essential for managing risks and communicating with executive leadership. The initial setup was very easy, as Synack collaborates well in scoping and setting up each test. Review collected by and hosted on G2.com.

I have no dislikes. Review collected by and hosted on G2.com.

I really appreciate the Synack team's ability to engage independently, especially in our large federated environment. As the federal point of contact, it's great that they can work directly with organizations like NIH and CDC, finding ways to bring value with minimal guidance from me. I also find Synack's responsiveness impressive, as they always seem to find ways to add value. Setting up Synack was very easy, which is another thing I like about using it. Review collected by and hosted on G2.com.

n/a Review collected by and hosted on G2.com.

I particularly like the detailed reports that document vulnerabilities that are discovered. These include detailed write-ups and helpful screenshots. The Synack team has been responsive and has proactively offered additional capabilities/features to augment our existing solution. The web UI is intuitive. Not to be overlooked, the solution meets our security requirements. Review collected by and hosted on G2.com.

I find the credit system to be a little confusing. We haven't identified good uses for the credits we have. Review collected by and hosted on G2.com.

I like that the Synack platform is easy to use. It's great that developers can be in there in real-time, and the researchers can respond to their comments and vice versa. Review collected by and hosted on G2.com.

The onboarding experience could be improved. There's a lot of effort on the initial onboarding as well as configurations and familiarity with the applications can be time-consuming. The initial setup of the applications for assessing is a little more cumbersome. Review collected by and hosted on G2.com.

The Synack team is real humans on keyboards on target attacking our systems. The continious preasure applied through the Synack platform provides always current and relavent results for our attack surface. Review collected by and hosted on G2.com.

Our team has discovered a few edge cases in the Synack portal which needed to be resolved with their engineering teams. Synack resolved the issues and engineering and support was helping in the eventual resolution. Review collected by and hosted on G2.com.

I like Synack's great customer service and how their pentesting platform effectively helps in pentesting our organization's applications. Their analytics are valuable in keeping our organization safe. Additionally, the initial setup was easy. Review collected by and hosted on G2.com.

I wish there were more options for downloading vulnerabilities based on application name and not just code names. Review collected by and hosted on G2.com.