Synack, Inc.

Synack, Inc., doing business as Synack, delivers bug bounty, crowdsourced vulnerability assessment, and ethical hacking services to federal agencies as a prime contractor (96% of recent awards) competing in full-and-open procurements without set-aside designations. Based in Arlington, Virginia, Synack operates a proprietary security research platform and manages a vetted community of independent security researchers to conduct authorized penetration testing, vulnerability discovery, and security assessments across federal civilian and defense information systems.

The vendor's customer concentration is heavily weighted toward defense and homeland security. The Department of Homeland Security Office of the Chief Information Officer (DHS OCIO) dominates potential value at $43.3 million across two awards, anchored by a $43.2 million Indefinite Delivery Contract (Hack DHS: Crowdsourced Vulnerability Assessment Services) running through September 2027. The Office of the Secretary of Defense follows with $35.8 million potential value across eight awards, including a $440,411 Other Transaction Agreement for a bug bounty prototype project completed in September 2025. Together, DHS OCIO and OSD account for 97% of combined potential value despite representing only four awards by count — reflecting both the scale of the Hack DHS IDIQ ceiling and the concentration of smaller prototype and pilot work with OSD. DHS Customs and Border Protection places five smaller task orders ($2.2 million combined) under the Hack DHS vehicle, with recent delivery orders for bug bounty services valued at $641,000 (July 2026) and $905,083 (July 2023). DOD Washington Headquarters Service, the Department of the Treasury Internal Revenue Service, and the Equal Employment Opportunity Commission round out the active customer base, with the EEOC receiving a $36,300 purchase order for FedRAMP-moderate cybersecurity services in August 2023.

Synack holds seven task orders worth $3.3 million combined under an IDC vehicle (HQ003416D0003) and participates in the SeaPort Next Generation GWAC. The Hack DHS IDIQ, the vendor's largest vehicle, carries a multiple-award structure with Synack as one contractor. Recent task-order activity under Hack DHS includes the $92,625 July 2024 delivery order for ICE Mobile Check-In vulnerability assessment (completed November 2024) and the $641,000 July 2026 CBP bug bounty delivery order (completion July 2028). Award activity has remained modest and episodic — two awards per year in 2021–2023, three in 2024, one in 2026 — with only one award ($641,000) facing ultimate completion inside the next twenty-four months, presenting limited near-term recompete exposure.

Synack operates almost exclusively as a prime (96% of awards) with minimal subcontractor engagement; one sub-award recorded since 2016 as a subcontractor to ManTech Advanced Systems International on a cybersecurity testing SaaS project in January 2024. Service Contract Inventory data shows $287,000 in invoiced revenue recorded in FY2023 across three reportable service contracts, with zero FTE labor data captured in the SCI dataset for FY2023–FY2025, reflecting the crowdsourced nature of Synack's delivery model and the fact that most work is performed by independent researchers rather than direct-hire employees. The vendor competes full-and-open across all recent awards, with no set-aside designations applied to any prime contract or IDIQ position in the source data.