Case Study

How Gumtree Group Runs Continuous Pentesting Across Its Marketplaces With a Lean Security Team

Gumtree Group replaced annual pentests with continuous, human-validated testing from Synack. The lean security team now finds issues close to when they are introduced, fixes root causes and reports to leadership on what is actually fixed.

Industry:: Online marketplaces
Region:: Australia
Solutions:: Synack365, Synack Red Team

Download the case study Request a demo

First page of the Gumtree Group case study, titled How Gumtree Group Runs Continuous Pentesting Across Its Marketplaces With a Lean Security Team

2024 Working with Synack to augment the in-house security team

4 + 1 Web applications plus the Gumtree mobile app under continuous test

Year-round Testing in place of a once-a-year snapshot

Jira Validated findings sent to engineering with remediation guidance attached

From annual pentests to continuous validation

Gumtree, Autotrader and CarsGuide change constantly. Here is how Gumtree Group kept testing in step with them.

01 · The challenge

Applications moved faster than an annual test cycle

Point-in-time tests produced a report, a burst of activity and then a long gap until the next one.

02 · The approach

Continuous testing that works like an extension of the team

Vetted Synack Red Team researchers test year-round, with validated findings and retesting built in.

03 · The outcome

Fewer repeat findings, faster remediation

Root-cause fixes, developer training and clear reporting on what is actually fixed.

Why annual pentesting couldn't keep up

As Head of Cyber Security at Gumtree Group, Les Nagy has limited time to spend managing security vendors. His applications change constantly, and the lean security team could not scope, run and chase traditional pentests while also covering everything else.

The value of point-in-time testing was also limited. "Our traditional point-in-time tests produced a report, a burst of activity, and then nothing until the following year," Les said. Once an engagement ended, the team lost access to the testers, and much of the context went with them.

Gumtree Group needed testing that was continuous, available on demand and delivered by people the team could trust, without having to build that capability in-house.

For a lean team, validation is the whole equation. More coverage only helps if what comes out the other end is actionable.

Les Nagy, Head of Cyber Security, Gumtree Group

Continuous, validated pentesting that works like an extension of the team

Les wanted a partner that would function as an extension of his team, "not another project I would have to manage." Synack's vetting of the Synack Red Team and its built-in retesting were deciding factors. Without human validation, Les says the team would either be buried in scanner output it could not triage quickly enough or would have to cut coverage back to a level it could manage. "Both options would leave us less secure," he said.

Test year-round, not once a year

Synack365 covers Gumtree Group's marketplace applications and the Gumtree mobile app, so new issues are found close to when they are introduced.

Start from a list that is already real

Every finding is confirmed exploitable. The team ranks by severity and business context, and critical and high findings go straight to engineering through Jira.

Close the loop with retesting

When a fix goes in, the team requests a retest and confirms the issue is closed without starting a new engagement.

Over time, we have seen fewer repeat findings and faster remediation, which tells me we are getting better, not just getting tested.

Les Nagy

Head of Cyber Security, Gumtree Group

What Gumtree Group achieved

Less noise for the security team

Every finding validated as exploitable before it arrives, so time goes to fixing real issues instead of disproving false positives.

Fewer repeat findings

Recurring issue classes addressed at the root cause.

Faster remediation

Findings flow straight into development work through the Jira integration.

Stronger engineering practices

Root-cause insights fed into developer training and changes to the release process.

Accurate reporting to leadership

Built-in retesting shows what is fixed, not just what is marked as done.

Questions about the Gumtree Group case study

Who is Gumtree Group?

Gumtree Group brings together Gumtree, CarsGuide and Autotrader, reaching millions of Australians every month with listings spanning automotive, home and garden, real estate, jobs, pets and more.

Which Synack solutions does Gumtree Group use?

Gumtree Group uses Synack365 for continuous pentesting by the Synack Red Team across four web applications and the Gumtree mobile app, with findings sent to engineering through a Jira integration.

How does human validation reduce noise?

Synack researchers confirm exploitability before a finding reaches the team, so a lean team can run broad, continuous coverage without spending time disproving false positives.

How does Gumtree Group prioritize findings?

By severity and business context: what the asset is, what data it touches and how exposed it is. Critical and high findings on customer-facing systems go to engineering first. Lower-severity issues are batched into regular development work.

How does continuous testing improve security posture?

Testing year-round shows patterns over time. Gumtree Group uses repeat issue classes as a signal to fix root causes, which has led to developer training, release process changes, fewer repeat findings and faster remediation.