Search

Home > Archives for Mark Kuhr

Mark Kuhr

Mark Kuhr

CTO and Co-founder of Synack

Mark Kuhr is CTO and Co-founder of Synack, the leading platform for human and agentic AI-powered penetration testing. With more than 20 years of experience in cybersecurity, Mark co founded Synack to empower a global network of ethical hackers to test applications and networks for vulnerabilities at scale. Prior to Synack, he spent over nine years in cybersecurity roles at the National Security Agency and the Defense Information Systems Agency (DISA). Mark holds a Ph.D. in Computer Science from Auburn University earned under a DoD/NSA-sponsored fellowship. At Synack, he leads the engineering, operations, and product teams, overseeing the development and delivery of the company's platform and services. 

Author archive filters and sorting

Research by Mark Kuhr

When Should Organizations Choose PTaaS?

When Should Organizations Choose PTaaS?

Annual and ad-hoc penetration testing were built for a slower pace of change than most organizations operate at today. When applications ship weekly, cloud infrastructure shifts under infrastructure-as-code pipelines, and attack surfaces expand faster than a testing calendar can track, a fixed-scope engagement answers a question that is already out of date by the time the report lands. This article covers the organizational conditions that signal penetration testing as a service (PTaaS) is the right model, how it compares to traditional testing over time, the signals that indicate a program has outgrown point-in-time testing, and how PTaaS fits into a mature security testing program.

MK
Mark Kuhr
Mark Kuhr
3 min read
Continuous Security Validation Explained: A Guide to Proving Security Effectiveness

Continuous Security Validation Explained: A Guide to Proving Security Effectiveness

Security teams have more tools, more alerts and more vulnerability data than ever. One question stays hard to answer: does your security actually work against real attacks? Continuous security validation answers it by repeatedly proving whether exploitable attack paths exist, and whether the controls meant to stop them hold, as applications, infrastructure and attack surfaces change. The approaches sold under that name are not equivalent. Some simulate known attacks against your controls. Some verify that a real exploit works against your live environment. That difference decides what the result can be trusted to prove.

MK
Mark Kuhr
Mark Kuhr
10 min read
Exploitability Validation: How to Prove Which Vulnerabilities Are Actually Exploitable

Exploitability Validation: How to Prove Which Vulnerabilities Are Actually Exploitable

A practical guide for security leaders on separating theoretical vulnerabilities from real, exploitable risk. Exploitability validation is the process of confirming that a vulnerability can actually be exploited in a specific environment, rather than assuming it is dangerous because a scanner flagged it or a severity score looks high. It answers a narrower and more useful question than a scan: not “does this weakness exist,” but “can an attacker use this weakness to cause real harm here, given our configuration, controls, and access paths?” The output is a shorter, evidence-backed list of findings a team can act on with confidence.

MK
Mark Kuhr
Mark Kuhr
7 min read
What Is Continuous Threat Exposure Management?

What Is Continuous Threat Exposure Management?

Most security teams feel confident their testing program keeps pace with how fast their environment changes. A 2026 survey of enterprise security leaders found that six in ten are very confident about that. The same survey also found that 95% of those organizations still discover high or critical vulnerabilities outside their scheduled testing windows at least a few times a year, and 42% find them monthly. Continuous Threat Exposure Management (CTEM) is the framework most directly aimed at that gap between confidence and coverage. This article explains what CTEM is, why it has gained traction, how its five stages work, how it relates to vulnerability management, attack surface management and breach and attack simulation, and how to build toward it using the security stack you already have.

MK
Mark Kuhr
Mark Kuhr
8 min read
What Is AI Penetration Testing?A Complete 2026 Guide

What Is AI Penetration Testing?A Complete 2026 Guide

AI penetration testing uses artificial intelligence to assist or automate parts of an authorized security test. Depending on the approach, AI may help map an attack surface, select tests, correlate findings, attempt controlled validation, collect evidence and trigger retesting when an environment changes. This guide explains what AI pentesting is, how it works, how it differs from vulnerability scanning and traditional penetration testing, where human expertise remains essential and what security teams should evaluate before adopting it.

MK
Mark Kuhr
Mark Kuhr
10 min read
What Are the Limitations of AI-Only Penetration Testing?

What Are the Limitations of AI-Only Penetration Testing?

AI-driven tools can scan more of an environment, faster, than manual testing ever could. That scale is real, but it raises a fair question for security architects deciding how much to trust automated output: what does AI-only testing actually confirm, and where does it fall short of a defensible security assessment? This article walks through where AI-only penetration testing is strong, where it is not, and how to think about pairing it with human-led validation. After reading, you will understand why detecting a vulnerability is not the same as confirming it is exploitable, where automated testing struggles with adaptive attacker behavior and business context, and which use cases are a good match for AI-only testing versus ones that call for adversarial human judgment.

MK
Mark Kuhr
Mark Kuhr
7 min read
How Is Continuous Penetration Testing Integrated Into a DevSecOps Pipeline?

How Is Continuous Penetration Testing Integrated Into a DevSecOps Pipeline?

What Is Continuous Penetration Testing in a DevSecOps Model? Continuous penetration testing in a DevSecOps context is ongoing, human-led adversarial validation that is embedded into automated delivery pipelines rather than scheduled as a single annual or semi-annual engagement. Instead of assessing a system once and reporting on its state at that moment, continuous testing reassesses […]

MK
Mark Kuhr
Mark Kuhr
8 min read
How Does Continuous Testing Support Modern Development Cycles?

How Does Continuous Testing Support Modern Development Cycles?

Modern software rarely stands still. Code ships multiple times a day, infrastructure is defined and redefined in code, and third-party dependencies update on their own schedule. Continuous testing is the security model built for that pace: instead of validating risk at a single point before release, it reassesses exposure as the underlying system changes. This guide explains what continuous testing means in the context of modern development, why agile and DevOps workflows require it, how it fits into a CI/CD pipeline, and what organizations should expect when they adopt it.

MK
Mark Kuhr
Mark Kuhr
5 min read
How Does Continuous Testing Differ From Annual Assessments?

How Does Continuous Testing Differ From Annual Assessments?

Organizations validate security in two fundamentally different rhythms. An annual assessment tests a defined environment during a scheduled engagement and produces a report tied to that point in time. Continuous testing instead operates as an ongoing cycle that reassesses exposure as releases, configurations, and infrastructure change throughout the year. This guide compares the two models across cadence, validation timing, remediation workflow, prioritization accuracy, and governance and reporting outcomes, so security teams can decide which approach, or combination of both, fits their environment.

MK
Mark Kuhr
Mark Kuhr
6 min read
What the New AI Executive Order Means for Federal Security Testing Public Sector

What the New AI Executive Order Means for Federal Security Testing

On June 2, the White House signed a new executive order (EO), “Promoting Advanced Artificial Intelligence Innovation and Security.” While most coverage has focused on the voluntary framework for frontier model access, there’s language around defensive cybersecurity that also deserves attention from security leaders.The order directs CISA to establish or expand federal programs and cybersecurity […]

MK
Mark Kuhr
Mark Kuhr
3 min read