Search

Home > Archives for James Thatcher

James Thatcher

James Thatcher

Principal AI Engineer

James Thatcher is a Staff AI Engineer at Synack specializing in agentic AI, machine learning, and AI-powered penetration testing. He focuses on building intelligent security solutions that combine autonomous AI agents with human expertise to modernize continuous security validation and offensive security operations.

Author archive filters and sorting

Research by James Thatcher

How Sara Pentest is Changing the Game for AI Pentesting Agentic AI

How Sara Pentest is Changing the Game for AI Pentesting

How Sara AI Pentesting Identifies Real-World Vulnerabilities In a single six-hour session, with no human intervention, Sara found and fully exploited multiple high-severity vulnerabilities across a live application including a SQL injection (SQLi), an admin account takeover, and stored cross-site scripting. In fact, 70% of Sara’s findings on this target were rated high or critical. […]

JT
James Thatcher
James Thatcher
11 min read
Benchmarking Synack’s Agentic AI Against PortSwigger SQLi Labs  Agentic AI

Benchmarking Synack’s Agentic AI Against PortSwigger SQLi Labs 

Sara Pentest is a penetration test powered by agentic AI and built on Synack’s PTaaS platform. The Sara architecture employs specialist agents to seek out OWASP vulnerabilities, with human oversight focused on validating these identified vulnerabilities. The agents behind Sara Pentest are continuously tested in the same lab environments that make great human pentesters, such […]

JT
James Thatcher
James Thatcher
3 min read
How Synack’s AI Agent Identifies and Exploits XSS In OpenEMR’s Backup Interface Agentic AI

How Synack’s AI Agent Identifies and Exploits XSS In OpenEMR’s Backup Interface

OpenEMR is a widely deployed open source electronic health records system, serving over 100,000 medical providers worldwide and managing sensitive health information for millions of patients. When vulnerabilities exist in software handling protected health information, the consequences extend beyond technical exploitation to regulatory compliance failures and patient privacy breaches. To evaluate Sara’s capabilities against real […]

JT
James Thatcher
James Thatcher
14 min read
How Synack’s Autonomous AI Agent Identifies and Exploits a SQL Injection Vulnerability Agentic AI

How Synack’s Autonomous AI Agent Identifies and Exploits a SQL Injection Vulnerability

Portswigger representation of how to approach an SQL injection. In the following scenario, the target application uses a tracking cookie that is vulnerable to SQL injection. However, the vulnerability is “blind” and does not return any data directly. The agent must use time delays to infer information. The goals for the Synack Autonomous AI agent […]

JT
James Thatcher
James Thatcher
12 min read