Synack

Connection methods

• Scanner or platform REST API
• Scheduled scan result exports
• Ticketing system webhooks
• PDF/CSV assessment report upload

Documentation topics

Review the following areas in Synack admin and product documentation before connecting to ComplAI:

• Admin console setup and service account creation
• API authentication, scopes, and rate limits
• Audit log export and retention settings
• Security hardening and least-privilege configuration

ComplAI integration overview

Synack integrates with ComplAI to support Propel Ready Solutions's GRC program. Crowdsourced security testing with continuous assessment. This guide covers product context, the recommended connection process, prerequisites, and verification steps for audit-ready evidence collection.

Last updated: 2026-06-24

GRC evidence available

• Open findings by severity
• Scan coverage and frequency
• Remediation SLA compliance
• Penetration test summaries
• Crowd pentest metrics and configuration evidence
• SmartScan metrics and configuration evidence

Prerequisites

• Named integration owner and backup contact at Propel Ready Solutions
• Change request approved per Propel Ready Solutions change management policy
• Network egress allowlisting completed if required by vendor
• ComplAI organization administrator access
• Admin or integration-builder role in Synack
• Synack product documentation reviewed (see Documentation topics below)

Integration process

1. Step 1

   Plan Synack integration scope

   Confirm which Crowd pentest and SmartScan capabilities will be connected first. Start with read-only ingestion before enabling write actions.

2. Step 2

   Define assessment scope

   Document in-scope assets, environments (prod/staging), and testing windows approved by change management.

3. Step 3

   Connect scanner or PT platform API

   Integrate vulnerability or pentest platform to pull findings, severity, CVSS, and remediation status into ComplAI.

   • Use read-only API tokens scoped to relevant business units
   • Configure finding severity thresholds for risk register auto-ticket rules
   • Exclude credentials from scan configs stored in ComplAI

4. Step 4

   Set remediation SLAs

   Map critical/high/medium findings to remediation timelines per your Vulnerability Management Policy.

5. Step 5

   Export evidence for audits

   Schedule monthly exports of scan coverage, mean-time-to-remediate, and open critical findings.

6. Step 6

   Mark integration complete in ComplAI

   Update integration status to Connected, attach configuration evidence, and link mapped controls in the Controls library.

GRC benefits

• Vulnerability scan results and remediation SLAs for risk treatment
• Penetration test evidence for external assessment requirements
• Continuous exposure management aligned to ISO 27001 risk treatment (Clause 6)

Related controls

Verification checklist

• ☐Integration credentials stored securely and rotation scheduled
• ☐Test sync completed successfully with sample records
• ☐Error alerting configured for failed sync or API rate limits
• ☐Control mappings documented in ComplAI
• ☐Evidence sample exported and reviewed by control owner
• ☐Runbook link attached to related controls

Troubleshooting