Search

Home > Archives for Mark Kuhr

Mark Kuhr

Mark Kuhr

CTO and Co-founder of Synack

Mark Kuhr is CTO and Co-founder of Synack, the leading platform for human and agentic AI-powered penetration testing. With more than 20 years of experience in cybersecurity, Mark co founded Synack to empower a global network of ethical hackers to test applications and networks for vulnerabilities at scale. Prior to Synack, he spent over nine years in cybersecurity roles at the National Security Agency and the Defense Information Systems Agency (DISA). Mark holds a Ph.D. in Computer Science from Auburn University earned under a DoD/NSA-sponsored fellowship. At Synack, he leads the engineering, operations, and product teams, overseeing the development and delivery of the company's platform and services. 

Author archive filters and sorting

Research by Mark Kuhr

When Should Organizations Choose PTaaS?

When Should Organizations Choose PTaaS?

Annual and ad-hoc penetration testing were built for a slower pace of change than most organizations operate at today. When applications ship weekly, cloud infrastructure shifts under infrastructure-as-code pipelines, and attack surfaces expand faster than a testing calendar can track, a fixed-scope engagement answers a question that is already out of date by the time the report lands. This article covers the organizational conditions that signal penetration testing as a service (PTaaS) is the right model, how it compares to traditional testing over time, the signals that indicate a program has outgrown point-in-time testing, and how PTaaS fits into a mature security testing program.

MK
Mark Kuhr
Mark Kuhr
1 min read
What Is Continuous Security Validation? How It Relates to Continuous Pentesting

What Is Continuous Security Validation? How It Relates to Continuous Pentesting

Security teams have more tools, more alerts and more vulnerability data than ever. One question stays hard to answer: does your security actually work against real attacks? Continuous security validation answers it by repeatedly proving whether exploitable attack paths exist, and whether the controls meant to stop them hold, as applications, infrastructure and attack surfaces change. The approaches sold under that name are not equivalent. Some simulate known attacks against your controls. Some verify that a real exploit works against your live environment. That difference decides what the result can be trusted to prove.

MK
Mark Kuhr
Mark Kuhr
11 min read
Exploitability Validation: How to Prove Which Vulnerabilities Are Actually Exploitable

Exploitability Validation: How to Prove Which Vulnerabilities Are Actually Exploitable

A practical guide for security leaders on separating theoretical vulnerabilities from real, exploitable risk. Exploitability validation is the process of confirming that a vulnerability can actually be exploited in a specific environment, rather than assuming it is dangerous because a scanner flagged it or a severity score looks high. It answers a narrower and more useful question than a scan: not “does this weakness exist,” but “can an attacker use this weakness to cause real harm here, given our configuration, controls, and access paths?” The output is a shorter, evidence-backed list of findings a team can act on with confidence.

MK
Mark Kuhr
Mark Kuhr
7 min read
What Is Continuous Threat Exposure Management?

What Is Continuous Threat Exposure Management?

Most security teams feel confident their testing program keeps pace with how fast their environment changes. A 2026 survey of enterprise security leaders found that six in ten are very confident about that. The same survey also found that 95% of those organizations still discover high or critical vulnerabilities outside their scheduled testing windows at least a few times a year, and 42% find them monthly. Continuous Threat Exposure Management (CTEM) is the framework most directly aimed at that gap between confidence and coverage. This article explains what CTEM is, why it has gained traction, how its five stages work, how it relates to vulnerability management, attack surface management and breach and attack simulation, and how to build toward it using the security stack you already have.

MK
Mark Kuhr
Mark Kuhr
8 min read
What Is AI Penetration Testing?

What Is AI Penetration Testing?

AI penetration testing uses artificial intelligence to assist or automate parts of an authorized security test. Depending on the approach, AI may help map an attack surface, select tests, correlate findings, attempt controlled validation, collect evidence and trigger retesting when an environment changes. This guide explains what AI pentesting is, how it works, how it differs from vulnerability scanning and traditional penetration testing, where human expertise remains essential and what security teams should evaluate before adopting it.

MK
Mark Kuhr
Mark Kuhr
10 min read
What Are the Limitations of AI-Only Penetration Testing?

What Are the Limitations of AI-Only Penetration Testing?

AI-driven tools can scan more of an environment, faster, than manual testing ever could. That scale is real, but it raises a fair question for security architects deciding how much to trust automated output: what does AI-only testing actually confirm, and where does it fall short of a defensible security assessment? This article walks through where AI-only penetration testing is strong, where it is not, and how to think about pairing it with human-led validation. After reading, you will understand why detecting a vulnerability is not the same as confirming it is exploitable, where automated testing struggles with adaptive attacker behavior and business context, and which use cases are a good match for AI-only testing versus ones that call for adversarial human judgment.

MK
Mark Kuhr
Mark Kuhr
7 min read