Horizon3.ai
Horizon3.ai

Autonomous Security Platform

Offense Informs Defense

Security Controls Validation

Threat
Hunting

Automated Remediation

Security Data Fabric

NodeZero Pentest Results

NodeZero Tripwires Early Warning Network

Delivered via

Commercial
SaaS

GDPR Compliant
SaaS

FedRAMP, Secret, Top Secret SaaS

In-Country Data SaaS

"NodeZero has given our organisation the ability to conduct penetration testing in a reliable, repeatable, affordable manner."

Senior IT Security and Risk Specialist

 

"My overall experience has been very positive, from the deployment of the NodeZero to conducting the operation to interpreting the results."

IT Security and Risk Management

 

"This product is in a unique and growing space and stands out strong beyond all others. The utility of this system can substantially increase your security posture."

– IT Services

 

"The setup and deployment of this product is pretty straightforward and easy to do. You can have this up and running in a very short amount of time and finding vulnerabilities in your environment before someone else does and shuts you down."

IT

 

"Great product, that is simple and easy to use. Truly great support and team behind the scenes as well."

IT

 

"Ease of setup. Linux box with docker, then access to the portal. Not hard at all for any busy professional."

IT

 

"I have been in IT/Security since 1997 and over the years I have seen multiple penetration testing tools. Node0 by far is the best pen-test tool I have used. The experience and technical ability that Horizon3 brings to the table is outstanding."

IT Security and Risk Management

 

"Our initial trial was so impressive, we committed to a year contract to leverage this product to improve our security stance. After paying for an external pen test and being able to compare the results of both, this product was superior in many ways."

IT

 

"Overall, the product is great! Would like to see some more API expanded capabilities (i.e. pulling additional CSV reports from the engagement - same as what is currently available in the portal)."

IT Security and Risk Management

 

"This helps elevate my team and takes away some of the most time-consuming tasks and automates them. Can't ask for much more."

IT Security and Risk Management

 

"This has really enlightened us on where we need to improve on the infrastructure of our business."

IT

 

"The software was remotely fully installed and operational within 15 minutes "

Operations

 

"The kill chain that Horizon3 presents is great for being able to show the C-suite and talking them through WHY they should spend money to fix something."

IT MSP

 

"We can now run our required internal penetration testing without a dedicated resource."

Director of IT, Provider

 

"It is a very powerful, well thought out pentest tool that can be used as often as needed."

Systems Engineer, Provider

 

"Excellent Product."

Senior Cybersecurity Engineer, IT Service Industry

 

"The technology is solid and easy to set up and use."

Director of IT, Construction Industry

 

"NodeZero should be part of all enterprises' security fabric."

COO, IT Services Industry

 

We are rated 4.7 on

Autonomous Pentesting with NodeZero

Autonomous Pentesting is licensed as an annual subscription based on the number of unique assets assessed. With that subscription, you can test your entire enterprise as often as you want, instead of a small sample once a year. If you need to run quarterly pentests or more, you’ll save money by shifting to NodeZero.

Here’s what’s included in the subscription:

Find and Fix Attack Vectors Before Attackers Can Exploit Them

How does NodeZero Do it?

In this autonomous pentest attack path, NodeZero exploited two weaknesses to achieve domain compromise, a Java JMX misconfiguration and SAM credential dumping.

NodeZero will chain together misconfigurations, dangerous product defaults, exploitable CVE's, ineffective security controls, and harvested credentials. You can then see the way NodeZero combined these security issues across hosts together into an easy-to-understand attack path.

Fed up with false positives? NodeZero gives you proof-of-exploit, showing exactly how an attacker can compromise your system. If you don't believe us, you can copy+paste the command and run it yourself.

Isometric Laptop Right-Facing NodeZero Summary UI
Prioritized impacts show you what to fix first and how to do it most efficiently with detailed reporting to demonstrate your progress with your C-suite and auditors.
NodeZero UI - 1 Click Verify

Your team will save time using the detailed remediation guidance for every weakness identified and a complete Fix Action report for your reference, including details on which fixes will solve the most problems, maximizing your return on effort.

NodeZero TripwiresTM will automatically deploy decoys—such as fake files and fake credentials—on hosts and fileshares that NodeZero successfully compromised during an autonomous pentest, creating an early warning network for your exploitable attack surface.

Once you have completed your remediations, it’s easy for you to do a 1-Click Verify to ensure that your fixes are effective. This means you can empower your IT teams to quickly retest problems they've fixed.

Quickly understand how your posture has changed overtime by comparing current and historical pentest results.

Continuous Pentesting at Any Scale

Scale Beyond Samples, Test Your Entire Enterprise

Don’t just test a small sample of your enterprise—NodeZero scales to test your entire hybrid cloud environment.

Safe for Production

Run Multiple Tests Simultaniously

Schedule Continuous Assesments

Gen 1: Manual Pentesting, Gen 2: Marketplaces, Gen 3: Compliance Automation, | AI CHASM - Continuously Optimizing via: - Reinforcement Learning, - Shadowing, - Collective Intelligence |, Gen 4: Exploitable Attack Surface, Horizon3.ai

The “AI” in Horizon3.ai

NodeZero is an autonomous agent capable of executing self-directed actions to achieve an objective. In pentesting, these objectives include becoming Domain Admin, compromising sensitive data, gaining access to critical systems, and so on. Knowledge graph analytics, inference engines, and learning loops play a key role in ensuring the more pentests NodeZero executes, the “smarter” it gets.

The alternative to our approach is attempting to hardcode every possible attack path using automation. There are far too many variations, and the burden of maintaining automated scripts is significant given how frequently an environment changes. This is why automated pentesting has failed to take off, whereas our autonomous approach, delivered via multi-tenant SaaS, serves customers from the Global 100 to your local hospital.

Learn More About AI for Offensive Security,

Listen to our CEO’s presentation to the National Science Foundation’s ACTION Institute.

Trusted By

Internal and Hybrid Cloud Pentest

Simulates an attack from inside your network to find exploitable vulnerabilities without needing any prior knowledge or credentials.

External Pentest

Identifies weaknesses in your public-facing systems from an external viewpoint, conducted from Horizon3.ai’s cloud.

AWS IAM Test

Identifies weaknesses in your public-facing systems from an external viewpoint, conducted from Horizon3.ai’s cloud.

Azure Entra ID Pentest

Evaluates the security of the central identity service of Azure, Entra ID, by exploiting vulnerabilities and weak IAM controls that could allow attackers to gain high-level access and pivot between on-prem and cloud environments.

Active Directory Password Audit

Evaluate your organization's Active Directory passwords and identify weak, reused, or breached passwords.

Insider Threat Attack

Simulates an attack from someone with authenticated access, like an employee, to see how well your security stack can handle insider threats.

Compromised Credential Test

Tests the impact of an attacker using stolen credentials to see what systems and data they can access and exploit.

Phishing Impact Test

Test the impact of compromised credentials from phishing attacks within your environment.

Segmentation Testing

Verify what an attacker can see in your network. Tests for effective network segmentation by discovering internal IPs, ports, services, and applications visible from the NodeZero host.

Ransomware Risk Assessment

Evaluates how susceptible your systems are to ransomware attacks and identifies additional potential weaknesses that could be exploited by ransomware groups.

Security Controls Validation

Test the effectiveness of your security controls by running assessments before and after security tool implementation/tuning and validate their ability to mitigate real-world attacks and vulnerabilities.

PCI 11.4 Pentest Report

A thorough penetration test and fix action report not only enables your organization to prove compliance with PCI DSS 11.4 but also streamlines remediation with actionable guidance and 1-click verification of remediated weaknesses.

PCI-DSS Human-based Pentest Report

Horizon3.ai pentesting experts follow PCI DSS requirements to safely test your CDE and deliver a detailed Penetration Testing Report and Fix Action report that can be shared with auditors to help you meet PCI compliance.

Rapid Response: Palo Alto CVE-2024-3400

CVE-2024-3400 is a critical command injection vulnerability in Palo Alto Networks PAN-OS software used by GlobalProtect gateways, allowing unauthenticated attackers to execute arbitrary code with root privileges through remote code execution due to a chained attack involving directory traversal and command injection

Rapid Response: F5 CVE-2022-1388

CVE-2022-1388 is a critical vulnerability in the iControl REST API of F5's BIG-IP product that allows unauthenticated remote attackers to bypass authentication and execute arbitrary commands with root privileges, potentially leading to complete control of the affected server​

Rapid Response: VMware CVE-2023-34051

CVE-2023-34051 is a critical vulnerability in VMware Aria Operations for Logs that allows an unauthenticated attacker to bypass authentication and inject files into the operating system of an affected appliance, potentially resulting in remote code execution​

Rapid Response: Cisco CVE-2023-20198

CVE-2023-20198 is a critical zero-day vulnerability in Cisco's IOS XE software that allows unauthenticated remote attackers to gain full administrative control over affected systems by exploiting the web user interface feature when the HTTP or HTTPS server is enabled​