Offensive security, the market for pentesting, red teaming, and exposure validation, is consolidating through mergers and acquisitions. For buyers, fewer suppliers can mean broader coverage and simpler contracts, but it can also mean roadmap uncertainty, price changes, and data-migration risk. The right response is to ask continuity questions before the next renewal.
Testing vendors that once competed are now merging, and buyers are being asked to trust combined companies with their most sensitive findings. Here is what is changing and how to protect your program.
What Does Consolidation in Offensive Security Actually Look Like?
The pace of deals has picked up sharply. A short timeline of recent moves shows how quickly the market is reshaping:
- October and November 2025: Pentera, known for automated security validation, acquired DevOcean, an AI remediation management platform, and then EVA Information Security, an offensive security firm focused on AI red teaming and pentesting.
- August 2026: Brinqa, a continuous threat exposure management vendor, acquired PlexTrac, a pentest reporting and workflow platform, and Fortinet acquired Virtue AI, whose capabilities include red teaming of agentic AI systems.
- September 2026: NetSPI and Synack announced a definitive agreement to merge, with backing from KKR.
This brings together two of the better-known testing providers in the market. The companies describe the combined business, presented on its own page as NetSPI + Synack, as bringing together expert testers and agentic AI for continuous testing, and Synack’s press release reports combined revenue of well over $200 million. According to an update on Synack’s site, the merger was completed in October 2026.
These deals follow two patterns. Testing providers are combining to offer broader coverage under one contract, and exposure management and security platform vendors are buying offensive capabilities to validate the risks their tools already report.
Why Do Buyers End Up With Overlapping Tools?
Most security programs assembled their testing stack one need at a time. An annual pentest came first, often to satisfy an auditor. A bug bounty or crowdsourced program followed for public applications. Attack surface management arrived when the team lost track of internet-facing assets, and automated validation came later still, when leadership asked how often defenses were actually tested.
Each purchase made sense on its own, and together they produced overlap. Two or three tools may discover the same assets, report the same vulnerabilities in different formats, and assign them different severities. Analysts spend hours reconciling results that should have come through as a single finding. That overlap is exactly what vendor consolidation promises to remove, and it explains why many buyers welcome these deals at first. Budget pressure adds to the appeal, since one contract is easier to defend in a cost review than five separate ones with overlapping scope.
What Does a Buyer Gain and Lose When Suppliers Merge?
The effect of a merger depends on how well the combined company integrates and how much bargaining power the customer retains. Both sides of the ledger deserve attention.
What You Can Gain
A merged supplier can offer a wider range of testing types under one contract, with a single findings record across services. That can cut administration, improve correlation, and simplify reporting to leadership. Larger providers may also invest more in automation and research, and they often bring broader capacity for urgent testing during incidents or major releases.
What You Risk Losing
The risks are quieter but real. Roadmaps change after mergers, and overlapping products are often merged or retired. Pricing models may be standardized in ways that cost some customers more. Account teams, testers, and support contacts can change, and the people who knew your environment may move on. Data handling is also a growing concern, since findings, credentials, and evidence may move into new systems, possibly with new AI processing. Questions about how AI systems handle sensitive information now reach well beyond security, as this site’s coverage of workplace AI monitoring shows, and buyers are entitled to clear answers from any vendor holding their vulnerability data.
Which Contract and Continuity Questions Should You Ask?
The best time to ask is before your next renewal, while you still have negotiating power. Send these questions to any supplier that has merged, been acquired, or announced a deal:
- Which products and services will continue unchanged, and for how long is that commitment in writing?
- Will pricing, retest terms, or service levels change at renewal, and can you lock in current terms for a defined period?
- Will the same testers and account team stay on our engagements?
- Where will our findings, evidence, and credentials be stored after integration, and will they be used to train AI models?
- Can we export our complete findings history in a standard format at any time, at no extra cost?
- Do contract commitments bind any successor company if the business is sold or restructured again?
Keep the answers on file. If a supplier cannot answer clearly, that is useful information for the renewal discussion and a reason to run a pilot with an alternative provider. It also helps to map which of your current tools overlap with the merged supplier’s services, since the combined company may offer to replace them. Any replacement deserves the same scrutiny as a new purchase, with a pilot on real targets before older contracts are canceled.
Is Consolidation Good for Buyers?
It can be, on two conditions. The combined company has to deliver genuine integration, with one findings record and consistent quality across services, rather than a bundle of separate products sold together. And the buyer must keep the ability to leave if quality slips, which means protecting data portability and maintaining at least a working relationship with an alternative provider.
Buyers who treat consolidation as a prompt to review their testing program, rather than a change to accept passively, are likely to come out ahead. The market will keep shifting, and the strongest position belongs to the customer who knows exactly what it needs from offensive security and can move its data whenever a supplier stops providing it.