NODEZERO
Continuously Verify Your Security Posture
...with the industry's most advanced and award-winning pentesting platform
Find
Verify
Fix
Recognized and Trusted
Winner, Pwn2Own Toronto 2022
Winner, Pwn2Own Toronto 2022
Cloud Security Excellence
Horizon3.ai Named Winner of TMC 2022 Cloud Security Excellence Awards
Cloud Security Innovation of the Year
Named Finalist by SDC Awards a for Cloud Security Innovation of the Year
What People Are Saying About Us
Regina International Airport Uses NodeZero to Close Gaps, Improve Efficiency
At Regina International Airport, everything that has a network cable, wireless signal, or power cord is something Sean McKim, Manager of Technology, cares about. As Canada’s 15th busiest airport – with over 1,700 IP addresses on the corporate side and fluctuating...
Higher Education Organization Improves Cybersecurity Posture with NodeZero
When the director of technology for a higher education organization went looking for a better way to identify and prioritize security weaknesses on the school’s servers and networks, his first interaction with Horizon3.ai and NodeZero started off with an impressive...
How NodeZero Works
Log In and Customize Your Internal or External Pentest
Discover and authorize assets, execute OSINT (Open Source Intelligence), and control a range of advanced configuration options.
Horizon3.ai Portal
Horizon3.ai VPC-Private Cloud
USER LOCAL ENVIRONMENT
Copy + Paste the NodeZero Script In Your Local Network
Launch the pentest from the perspective you want. Just copy the script from your portal and paste to your host.
One-time-use Attack Architecture
NodeZero Begins Pentesting
NodeZero communicates with ephemeral resources in the Horizon3.ai AWS account to safely enumerate and exploit weak credentials, dangerous misconfigurations and unpatched vulnerabilities.
NodeZero Begins Pentesting
NodeZero communicates with ephemeral resources in the Horizon3.ai AWS account to safely enumerate and exploit weak credentials, dangerous misconfigurations and unpatched vulnerabilities.
One-time-use Attack Architecture
Review Your Results
Pentest details are collected into static resources and made available in the Horizon3.ai Portal.
Prioritized by potential impact to your business and brand, NodeZero provides you with diagramed attack paths, clear proof of successful exploit, 1-click reporting, easy to follow fix actions and full logs.
How can NodeZero help you?
Let our experts walk you through a demonstration of NodeZero, so you can see how to put it to work for your company.
NodeZero™
Financial Services
Elevated privileges to full Domain Admin in 7 mins and 19 seconds
IT Services
Achieved compromise with SSH and 5-character default password
Media
In less than 3 days gained access to 1M+ sensitive files
Healthcare
Proved persistent exploitable vulnerability despite contrary reporting from other tools
NodeZero, our autonomous pentesting solution, is a true self-service SaaS that is safe to run in production and requires no persistent or credentialed agents. See your enterprise through the eyes of the attacker, identify your ineffective security controls, and ensure your limited resources are spent fixing problems that can actually be exploited.
Why use NodeZero?
Painless
Purple Team Approach
Let us be your purple team partner and help you establish a find-fix-verify loop to improve your security posture.
Safe
Using our solution you configure the scope and attack parameters to conduct benign exploitation of your network. You own your pentest from start to finish.
Complete Attack Surface
Coverage for both internal and external attack vectors. From inside or out, we’ll find it. Whether your network is on-prem, in the cloud or hybrid, we’ve got you covered.
Continuous & Unlimited
Our SaaS solution is available 24×7. Don’t wait months between reports. Continuously evaluate your security posture and proactively identify and remediate attack vectors as they appear.
Complete Attack Surface
Coverage for both internal and external attack vectors. From inside or out, we’ll find it. Whether your network is on-prem, in the cloud or hybrid, we’ve got you covered.
Continuous & Unlimited
Our SaaS solution is available 24×7. Don’t wait months between reports. Continuously evaluate your security posture and proactively identify and remediate attack vectors as they appear.
Horizon3.ai’s Story
We are a mix of US Special Operations, US National Security, and cybersecurity industry veterans. Our mission is to “turn the map around” – using the attacker’s perspective to help enterprises prioritize defensive efforts. Our team of nation-state-level, ethical hackers continuously identifies new attack vectors through autonomous pentesting and red team operations, leveraging collective intelligence to improve our products and strengthen our clients’ security. Founded in 2019, Horizon3.ai is headquartered in San Francisco, CA, and 100% made in the USA.
Get Started Now
Assess your networks today with a free trial of NodeZero. You’ll be up and running in minutes.
Lessons Learned
At Horizon3.ai, know that we’ve been in your shoes, working in the SOC, dealing with auditors, serving as CIOs & CTOs, and pouring our hearts and souls into ensuring our organization is secure. Here are the topics at the top of our minds.
ManageEngine CVE-2022-47966 Technical Deep Dive
Introduction On January 10, 2023, ManageEngine released a security advisory for CVE-2022-47966 (discovered by Khoadha of Viettel Cyber Security) affecting a wide range of products. The vulnerability allows an attacker to gain remote code execution by issuing a HTTP...
ManageEngine CVE-2022-47966 IOCs
Introduction The recent ManageEngine CVE-2022-47966 is a pre-authentication remote code execution vulnerability. Depending on the specific ManageEngine product, this vulnerability is exploitable if SAML single-sign-on is enabled or has ever been enabled. ManageEngine...
Insight – Horizon3.ai Annual Review Snapshot 2022
Over the past year, Horizon3.ai pentests revealed cybersecurity vulnerability trends across multiple industry sectors around the globe.
Get the Most From TrendMicro Apex One EDR with NodeZero
Learn how you can use NodeZero to get the Most From TrendMicro Apex One EDR, ensuring you stop, alert, log, and detect activity by bad actors.
From Pwn2Own Toronto – An Interview with the Winning Horizon3 AI Team
After successfully exploiting the Lexmark MC3224i in the Printer category, Zach Hanley and James Horseman from the Horizon3 AI team discuss their winning entry with ZDI’s Dustin Childs.
Metrics That Matter: An Attacker’s Perspective on Assessing Password Policy
After compromising a Windows domain controller, one of the actions that NodeZero, our autonomous pentest product, performs is dumping all domain user password hashes from the Active Directory database. This is a common attacker technique, and the resulting dump is highly valuable to attackers. But did you know that this data is a great source of insight for defenders too?
Vulnerable ≠ Exploitable
Criticality = ƒ(Exploitability, Impact) — The hardest part of cyber security is deciding what NOT to do.
Spending valuable and scarce time and effort on remediating weaknesses that are not exploitable or do not represent a substantial business impact is itself a risk. At the very least, you should be able to trust that the findings from your security tools and services will appropriately guide your remediation and staffing decisions. Find out more about how to prioritize vulnerabilities in this whitepaper.