NetSPI, which provides penetration testing and vulnerability management services to enterprises, raises $90M; NetSPI expects sales of about $50M in 2021
Neal St. Anthony / Star Tribune :
Context & Ripple Effects
In May 2021, Minneapolis-based NetSPI raised $90M on expectations of about $50M in annual sales — a bet that enterprise demand for hands-on penetration testing could be scaled like a product business rather than a consultancy.
The corpus shows how that bet played out: eighteen months later NetSPI closed a $410M KKR investment, lifting total funding to $500M and expanding from pure pen-testing into attack surface management. Meanwhile the tooling end of the market was already moving toward software — Netsparker's $40M Series A backed web application scanners sold to Microsoft, Samsung, and NASA — and by 2026 Novee emerged from stealth with AI models that automate penetration testing outright, putting the labor-heavy service model itself in question.
First-order effects
- The $90M gives NetSPI runway to hire testers and expand delivery capacity well beyond its ~$50M 2021 revenue base, converting a regional services firm into a nationally scaled one.
Second-order effects
- Capitalized rivals compress the middle ground: scanner vendors like Netsparker compete on price per scan against consulting hours, while NetSPI's own path — the later KKR round and attack surface management expansion — pushes it to bundle software with its services.
Third-order effects
- If AI-native entrants like Novee can deliver automated penetration testing at software margins, the industry splits between platform owners who productize offensive security and services firms whose economics still rest on billable expert hours.
The trend: Offensive security is being recapitalized from a consultant-hours business into a funded platform category, with automation-first entrants forcing incumbent services firms to add software layers or lose the recurring-revenue layer.