01 · The challenge
Scale without losing detail
Boutique vendors could not keep up with Jack Henry’s growth, and strict regulatory and reporting requirements left no room for shallow testing.
Case Study How Jack Henry Achieves Pentesting at Scale with Synack
Jack Henry needed pentesting that could scale with a digital banking platform serving more than 13 million end users, without giving up the detail-oriented coverage of a boutique vendor. With Synack, it completed what it planned as a year of tests in three months.
3 months To complete a planned year of tests
13M+ End users on Jack Henry’s digital banking platform
Real-time Visibility into every finding in the Synack Platform
Always-on Adversarial coverage of the attack surface
From boutique vendors to pentesting at scale
Jack Henry outgrew its pentesting vendors, but not its need for depth and detail.
02 · The approach
Human-led, AI-powered PTaaS
Jack Henry moved to Synack for vetted researchers, real-time findings in a live platform and testing that fits its DevSecOps workflow.
03 · The outcome
A year of testing in three months
Synack completed the planned tests in a quarter, with every finding visible in the platform and researchers continuing to test.
Why pentesting Jack Henry’s critical assets was no simple task
Jack Henry’s open ecosystem gives community banks and credit unions hundreds of self-service tools. That flexibility also makes it harder to test.
Given the volume of financial transactions it processes and the trust placed in its Banno Digital Platform, even a minor suspected vulnerability can demand a rapid response from the internal security team.
Add stringent regulatory and reporting requirements, and flexibility, responsiveness and attention to detail became the top priorities for any pentesting program.
Jack Henry had previously used boutique pentesting vendors, but our size got to a point where we needed something that could scale. At the same time, we didn’t want to give up the detail-oriented security coverage smaller pentesting companies can offer.
What changed with Synack
Synack combined vetted security researchers with AI-enabled, cloud-delivered testing, giving Jack Henry scale without losing the expert depth it expected.
Real-time visibility
Findings are visible in real time in the live Synack Platform, so the security team can respond quickly.
Vetted researchers at scale
Cohorts of Synack Red Team researchers provide always-on adversarial coverage, constantly looking for new potential vulnerabilities.
Built for DevSecOps
Testing integrates with DevSecOps workflows, so pentesting keeps pace with fintech release cycles.
Cloud-delivered testing
An AI-enabled, cloud-delivered approach that matches Jack Henry’s cloud-first technology modernization strategy.
After onboarding, we provided Synack with what we thought would be one year of tests. In three months, they’d completed everything, and all findings were visible in the Synack platform.
Bob Ponsar
Information Security Manager, Jack Henry
What Jack Henry achieved
A year of tests in three months
Synack completed what Jack Henry expected to be a full year of testing in a single quarter.
Every finding in one place
All findings were visible in the Synack Platform, giving the security team real-time visibility.
Scale without sacrificing detail
Jack Henry kept the detail-oriented coverage it valued from boutique vendors while testing at enterprise scale.
Continuous coverage between deep tests
Always-on testing means researchers keep looking for new potential vulnerabilities after planned tests are done, so exposure does not wait for the next cycle.
Questions about the Jack Henry case study
Who is Jack Henry?
Jack Henry (Nasdaq: JKHY) is an S&P 500 financial technology company. For nearly 50 years it has provided technology to approximately 7,400 banks and credit unions, and its digital banking platform serves more than 13 million end users.
Why did Jack Henry move away from boutique pentesting vendors?
Its size reached a point where it needed testing that could scale, but it did not want to lose the detail-oriented coverage smaller vendors offer. Synack provided both.
How quickly did Synack deliver?
Jack Henry gave Synack what it expected to be one year of tests. Synack completed them in three months, with all findings visible in the Synack Platform.
Which Synack solutions does Jack Henry use?
Synack’s Penetration Testing as a Service on the Synack Platform, with testing by the Synack Red Team. Jack Henry is also deploying Sara AI Pentesting, where expert human review backs every AI finding.
Get the Jack Henry case study
See how an S&P 500 fintech scaled expert pentesting across its digital banking platform without losing depth or detail, and how it is adding agentic AI to keep pace with AI-driven threats.
