Three moves in one quarter changed how penetration testing is sold. In late July, Cobalt launched an Autonomous Pentest tier. On 3 August, Horizon3 announced a US$250 million raise at a valuation above US$2 billion. On 5 October, NetSPI and Synack completed their merger. For NZ and Australian buyers, the headline is not who won. It is that three different models are now on offer, and each suits a different job. Here is how to choose.
What happened, deal by deal?
Cobalt says its Autonomous Pentest delivers findings in 24 hours. About 500 vetted testers review the execution plan and manage scope. Cobalt also says the product complements, and does not replace, human-led tests for compliance work.
Horizon3 raised its Series E at a valuation of more than US$2 billion, up from US$650 million in June 2025. Its NodeZero platform attacks live production environments and re-tests to confirm fixes. The company describes its approach as autonomous testing with no humans in the loop. Part of the money funds expansion into Australia and Singapore.
NetSPI and Synack announced their merger on 2 September and closed it on 5 October. The combined company reports more than 350 in-house pentesters and more than 1,500 vetted researchers, with revenue well above US$200 million, and KKR as majority owner. Each company still runs its own platform, and no combined pricing or packaging has been announced.
Which model fits which job?
There are three models. NetSPI and Synack pair a large human bench with agentic AI. Cobalt runs a platform of vetted testers with an autonomous tier on top. Horizon3 sells fully autonomous testing. None is simply better. The right one depends on what you need the result for.
If you need compliance evidence for SOC 2, ISO 27001 or a regulator, you usually need a dated, independent report that a named human stands behind. Cobalt's own statement points the same way. If you need coverage between those tests, because you ship weekly and a yearly test goes stale, autonomous tools are a sensible addition. If you have a large internal network, autonomous platforms are built for that scale. If your risk sits in access control and business logic inside a SaaS product, human judgement still does the heavy lifting. Our head-to-head comparison of Capture The Bug, Cobalt, Synack and Astra covers the platforms in more detail, although it was written before the merger closed.
A simple way to decide: start with the evidence you must produce, not the tool you want to buy. Write down who will read the result, whether that is an auditor, a customer's security team or your own engineers. Then choose the model that gives that reader what they need. Many teams will end up with two: a human-led test once or twice a year for the record, and autonomous coverage in between.
What changes for NZ and AU buyers?
1. Mergers Move People and Contracts
If you buy from NetSPI or Synack, ask who your contact is, which platform holds your data and where. The companies say your current scope, cadence, platform access and contacts continue as they are. Ask what each credential covers, too. Synack's FedRAMP Moderate authorisation covers its own platform and does not extend to NetSPI's products.
2. More Choice Is Coming to the Region
Horizon3's expansion means autonomous vendors will start selling locally. Ask about support hours in your time zone, where test data is stored and whether any regional customer will speak to you.
3. Check with Your Auditor First
Check with your auditor before you swap a human-led test for an autonomous one. Whether autonomous output counts as evidence depends on your framework and your auditor, not on the vendor's brochure.
4. Treat Vendor Numbers as Claims
Horizon3 says it has run more than 300,000 production tests without disruption. Synack cites Omdia research that 64 percent of organisations prefer agent-led testing with human oversight, but Synack commissioned that research. Both may be right. Neither is independent.
Five Questions That Work with Every Provider:
- Which named human is accountable for the report?
- Will my auditor accept it?
- Where are my test data and findings stored?
- What support do I get in my time zone?
- How are fixes retested and closed?
A vendor that answers all five plainly is worth a closer look. One that avoids them is telling you something.
What do we not know yet? Integration plans for NetSPI and Synack are still to come. Horizon3's Australian launch has no published detail yet. And the independent evidence on how well autonomous tools handle business logic is thin. Watch for all three before you sign a multi-year deal.
Where does Capture The Bug fit?
Our model is human-led and AI-assisted. Automated reconnaissance gives scale. CREST-certified testers validate every finding and answer for the report. Retesting confirms the fixes. That suits teams that need independent, dated evidence and fast feedback. Our guide to autonomous versus human pentesting covers the trade-offs in more detail.
Book your free PTaaS demo and ask which model fits your next compliance deadline.
Frequently Asked Questions
What happened with NetSPI and Synack?
They announced a merger on 2 September 2026 and completed it on 5 October. The combined company reports more than 350 in-house pentesters, more than 1,500 vetted researchers and revenue well above US$200 million. Each company still runs its own platform, and no combined pricing has been announced.
Is autonomous penetration testing a replacement for human testers?
Not for compliance work, according to Cobalt, which says its Autonomous Pentest complements human-led tests. Horizon3 sells fully autonomous testing. The right choice depends on the job: compliance evidence usually needs a named human, while coverage between tests suits autonomous tools.
What should NZ and AU buyers ask an autonomous pentest vendor?
Ask who is accountable for the report, whether your auditor accepts it, where test data is stored, what support you get in your time zone, and how fixes are retested and closed. Treat performance numbers as vendor claims until you can check them.
Is Horizon3 expanding into Australia?
Horizon3 said its US$250 million Series E would fund expansion into Australia and Singapore, among other priorities. No local detail has been published. Ask any new entrant about local support hours, data location and regional references.
Where does Capture The Bug fit?
Capture The Bug is a CREST-certified, human-led PTaaS provider that pairs automated reconnaissance with human validation. It suits teams that need dated, independent evidence for frameworks such as SOC 2 and ISO 27001, with testers who answer for the findings.
