NetSPI
Penetration testing and attack surface management firm for regulated enterprises.
On the record
Checkpoint: NetSPI's next 'year in review' revenue and headcount disclosure
The call
NetSPI holds regulated-bank trust and human-tester credibility while AI-native rivals chip at its lower tiers and KKR's holding period runs long.
NetSPI hires real human testers to find holes in networks for regulated companies like banks, then documents the work in ways that satisfy auditors and regulators. It is hard to replace because banks trust named people and need paperwork that holds up in court, and AI tools like Synack and Pentera can speed up routine testing but cannot yet fully replace the judgment and credibility NetSPI provides. However, growth has dropped from 58% to low double-digits, the company has cut staff despite AI tools getting better, and its private-equity owner (KKR) is due to cash out soon, which means the company either needs to prove AI makes its testers more productive (and revenue grows faster with fewer people) or it risks being seen as just another testing service that AI will eventually cheapen.
Why
01
AI pressure: Synack (agentic 'Sara' tool, FedRAMP Moderate); Pentera; BreachLock. Synack's Sara automates pentesting steps and BreachLock blends AI with human testers at lower SMB prices, squeezing NetSPI's commodity tier. Could AI do the core job? Only partly.
02
Bigger players: Palo Alto Networks, CrowdStrike, Rapid7, Qualys, Tenable. These platform giants avoid labor-heavy manual pentesting today, but could bundle AI-driven testing into existing security suites later. Could a giant copy it? Probably.
03
What protects it. Named human testers plus audit-grade compliance and lock-in with 9 of the top 10 U.S. banks, hard for AI-only tools to replicate quickly.
What would change this call
NetSPI's December 2026 year-in-review shows revenue growth and headcount figures. Reveals whether slowdown is AI-driven efficiency or real demand softness.
KKR announces IPO, sale, or dividend recap for NetSPI. Signals how the 5-year hold resolves and on what terms for equity holders.
A named top-10 U.S. bank switches its pentesting contract to Synack or Pentera. Would show the regulated-enterprise moat is being breached, not just contested.
KKR announces IPO, sale, or dividend recap for NetSPI. Signals how the 5-year hold resolves and on what terms for equity holders.
A named top-10 U.S. bank switches its pentesting contract to Synack or Pentera. Would show the regulated-enterprise moat is being breached, not just contested.
Key numbers
- Revenue estimated at $126 million
- Headcount fell from 644 to 586
- Growth slowed from 58% (2022) to double-digit (2024)
Named risks
- KKR exit after 5-year hold could occur on terms unfavorable to employee equity.
- Headcount decline from 644 (Nov 2024) to 586 (Jul 2026) may signal demand softness.
- AI-native rivals (Synack, Pentera, BreachLock) commoditizing SMB/mid-market pentesting tier.
- Growth deceleration from 58% (2022) to unspecified double-digit (2024) unquantified.
- No independently audited revenue or margin data; figures rely on self-report and estimates.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Synack | gaining on | Shipped agentic 'Sara' engine with FedRAMP Moderate authorization by mid-2026 |
| Pentera | contesting | Autonomous pentesting platform pressuring commodity/SMB pricing tier as of 2026 |
| BreachLock | contesting | Hybrid AI plus human SMB pricing model competing at mid-market tier, 2026 |
| Cobalt.io | contesting | Crowdsourced PTaaS peer competing for enterprise pentest contracts |
| Bishop Fox | contesting | Consultant-led plus continuous 'Cosmos' testing rivaling NetSPI's enterprise offering |
Questions people ask
- Is NetSPI profitable?
- NetSPI has not disclosed profitability figures. It reported revenue approaching $100 million in 2024 per Bloomberg (Nov 2024) and double-digit growth for 2024, but no net income or margin data has been publicly released as of July 2026.
- Who owns NetSPI?
- NetSPI is privately held, majority backed by KKR. KKR invested $90 million in May 2021 alongside Ten Eleven Ventures, then increased its commitment to $500 million total by November 2022, exiting earlier investor Sunstone Partners in the process.
- Is NetSPI laying off employees?
- No layoffs have been publicly announced, but third-party tracker Crustdata shows headcount declining from 644 in November 2024 to 586 by July 2026, a reversal from the company's self-reported 30%+ hiring growth in 2024.
- Could AI replace NetSPI's penetration testing services?
- Not for regulated enterprise clients as of July 2026. NetSPI serves 9 of the top 10 U.S. banks and relies on 300+ in-house testers for audit-grade compliance; AI is being added as an accelerant (MCP integrations, May 2026) but framed by NetSPI itself as human-led, AI-accelerated, not autonomous.
- Who is NetSPI's biggest competitor?
- In enterprise pentesting, peers include Cobalt.io and Bishop Fox. The bigger emerging threat is AI-native rivals Synack (agentic 'Sara' engine, FedRAMP Moderate authorized), Pentera, and BreachLock, which target the commodity/SMB tier NetSPI's mature growth is decelerating in.
- Is NetSPI growing or shrinking in 2026?
- Growth has decelerated from 58% organic revenue growth in 2022 to unspecified 'double-digit' growth in 2024 (company press release, January 2025), while headcount fell from 644 (Nov 2024) to 586 (Jul 2026) per third-party tracking, signaling a maturing rather than hypergrowth phase.
Timeline
- 2026-07-08NetSPI expands Continuous Pentesting suite with AI penetration testing and AI findings validation services
- 2026-05-12NetSPI launches AI-Powered Continuous Pentesting with agentic MCP integrations
- 2025-11-19NetSPI named Leader and Outperformer in 2025 GigaOm PTaaS Radar among 16 vendors
- 2025-01-02NetSPI reports 2024 banner year: 650+ employees, 1,942 customers, double-digit revenue growth
- 2024-06NetSPI acquires CAASM vendor Hubble Technology; founder Tom Parker becomes CTO
- 2022-11-04KKR closes additional $410 million investment, bringing total commitment to $500 million
- 2021-05KKR invests initial $90 million alongside Ten Eleven Ventures
- 2017NetSPI takes first institutional capital from Sunstone Partners
- 2001NetSPI founded in Minneapolis, Minnesota
Revision history
21 July 2026
First assessed. Protection under test. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- About Us (2026-06-06)
- NetSPI Raises Growth Capital From Sunstone Partners (2024-04-26)
- NetSPI Secures $90 Million in Cyber Security Funding Led by KKR (2024-04-26)
- Bloomberg: KKR Backs Cybersecurity Firm NetSPI With $410 Million Funding (2024-11-15)
- NetSPI - Overview, News & Similar companies (2026-07-13)
- NetSPI Achieves 58% Organic Revenue Growth in 2022 (2024-04-26)
- NetSPI Achieves Banner Year in 2024 (2025-01-02)
- NetSPI Named a Leader and Outperformer in the 2025 GigaOm Radar for PTaaS (2025-11-19)
- NetSPI Moves to New Minneapolis Headquarters (2023-08-29)
- NetSPI - Headcount, Funding & Open Jobs (2026-07-08)
- NetSPI Acquires CAASM Vendor Hubble (2024-11-21)
- NetSPI Launches AI-Powered Continuous Pentesting (2026-05-12)