Synack
Vetted-researcher penetration testing platform.
Scorecard from 0 structured reviews
Exposure signal
LowAn objective, third-party reading of this vendor's own credential hygiene. It is not part of the community scorecard and does not affect any rating on DBSE.
Credentials belonging to 5 of this vendor's own staff appear in infostealer logs, and the most recent staff credential appeared 4 years ago. Their staff hold credentials for 17 distinct external services, which is the surface a successful attack on this vendor could reach. This says nothing about how well the product works.
Customer-side infections: 69 (not counted in the band)
These are infections on the machines of people who log in to this vendor's service. They reflect those users' own endpoint hygiene, and a vendor with a large consumer or partner login footprint will always show more of them. Counting that against the vendor would penalise popularity, so this platform does not.
Which third-party services appear · 3 of these are in our directory
| Service | In our directory | Community rating | Occurrences |
|---|---|---|---|
| mckinsey.com | Not listed | – | 9 |
| paloaltonetworks.com | Palo Alto Cortex XDR +4 more here | Not rated yet | 7 |
| ssrn.com | Not listed | – | 6 |
| goscoutgo.com | Not listed | – | 6 |
| arubainstanton.com | Not listed | – | 4 |
| onelogin.com | OneLogin | Not rated yet | 4 |
| bcgplatinion.io | Not listed | – | 3 |
| bn.co | Not listed | – | 2 |
| okta.com | Okta | Not rated yet | 2 |
| prismacloud.io | Not listed | – | 2 |
| ferguson.com | Not listed | – | 2 |
| tnt.com | Not listed | – | 2 |
If your own organisation depends on any of these, a successful attack on this vendor and an attack on you share a blast radius. That is worth a question in the security review, not a reason to walk away. Where a service is itself a vendor in our directory it is named and linked, with whatever the community has scored it, so you can read both sides of the dependency in one place. The rating shown is the community's own; it is not derived from this exposure data.
Source: FireIntel (xti.fireintel.net), public domain summary. Source: Hudson Rock (hudsonrock.com), free infostealer intelligence API. About this data. Read 1 month ago, and due a refresh. DBSE does not collect, hold, or sell this data.
Discussions about Synack
- No threads yet. Start one.