Verify if your ManageEngine assets are reachable, vulnerable, and exploitable to this latest CVE-2022-47966 with NodeZero. Check for free NOW.

NODEZERO

Continuously Verify Your Security Posture

...with the industry's most advanced and award-winning pentesting platform

Find

Pentest your hybrid cloud at scale

Verify

Prove your detection & response teams, tools, and rules are working

Fix

Prioritize and fix problems that matter

Recognized and Trusted

See all our awards →

What People Are Saying About Us

“The kill chain that Horizon3 presents is great for being able to show the C-suite and talking them through WHY they should spend money to fix something."

– IT MSP

 

"I believe traditional vulnerability scans are noisy and destroy value in the typical organization. Horizon3.ai is laser focused on delivering the highest quality scans. When you do get results you know they are validated. And of the validated items you get very practical remediation guidance."

– Shaun Hunt, McKenney’s Inc.

 

“We can now run our required internal penetration testing without a dedicated resource"

– Director of IT, Provider

"It is a very powerful, well thought out pentest tool that can be used as often as needed"

– Systems Engineer, Provider

 

“Excellent Product"

– Senior Cybersecurity Engineer, IT Service Industry

 

“The technology is solid and easy to setup and use"

– Director of IT, Construction Industry

 

“Impressive Pen Test Tool, Perfect For SMB Or Enterprise"

– Director of IT, Food and Beverage Industry

 

“NodeZero should be part of all enterprises security fabric”

– COO, IT Services Industry

 

How NodeZero Works

Log In and Customize Your Internal or External Pentest

Discover and authorize assets, execute OSINT (Open Source Intelligence), and control a range of advanced configuration options.

Horizon3.ai Portal

Horizon3.ai VPC-Private Cloud

USER LOCAL ENVIRONMENT

Copy + Paste the NodeZero Script In Your Local Network

Launch the pentest from the perspective you want. Just copy the script from your portal and paste to your host.

One-time-use Attack Architecture

NodeZero Begins Pentesting

NodeZero communicates with ephemeral resources in the Horizon3.ai AWS account to safely enumerate and exploit weak credentials, dangerous misconfigurations and unpatched vulnerabilities.

NodeZero Begins Pentesting

NodeZero communicates with ephemeral resources in the Horizon3.ai AWS account to safely enumerate and exploit weak credentials, dangerous misconfigurations and unpatched vulnerabilities.

One-time-use Attack Architecture

Isometric Laptop showing NodeZero UI

Review Your Results

Pentest details are collected into static resources and made available in the Horizon3.ai Portal.

Prioritized by potential impact to your business and brand, NodeZero provides you with diagramed attack paths, clear proof of successful exploit, 1-click reporting, easy to follow fix actions and full logs.

Run A Pentest
Isometric Laptop showing NodeZero UI

How can NodeZero help you?

Let our experts walk you through a demonstration of NodeZero, so you can see how to put it to work for your company.

Schedule a Demo

NodeZero™

Learn More

Financial Services

Elevated privileges to full Domain Admin in 7 mins and 19 seconds

IT Services

Achieved compromise with SSH and 5-character default password

Media

In less than 3 days gained access to 1M+ sensitive files

Healthcare

Proved persistent exploitable vulnerability despite contrary reporting from other tools

NodeZero, our autonomous pentesting solution, is a true self-service SaaS that is safe to run in production and requires no persistent or credentialed agents. See your enterprise through the eyes of the attacker, identify your ineffective security controls, and ensure your limited resources are spent fixing problems that can actually be exploited.

Why use NodeZero?

Glass Band Aid Icon

Painless

No persistent agents. No provisioned credentials. You’ll be up and running in minutes with results in hours.
Glass Team Icon

Purple Team Approach

Let us be your purple team partner and help you establish a find-fix-verify loop to improve your security posture.

Glass Lock Verify Icon

Safe

Using our solution you configure the scope and attack parameters to conduct benign exploitation of your network. You own your pentest from start to finish.

Glass Network Icon

Complete Attack Surface

Coverage for both internal and external attack vectors. From inside or out, we’ll find it. Whether your network is on-prem, in the cloud or hybrid, we’ve got you covered.

Glass Unlimited Icon

Continuous & Unlimited

Our SaaS solution is available 24×7. Don’t wait months between reports. Continuously evaluate your security posture and proactively identify and remediate attack vectors as they appear.

Glass Network Icon

Complete Attack Surface

Coverage for both internal and external attack vectors. From inside or out, we’ll find it. Whether your network is on-prem, in the cloud or hybrid, we’ve got you covered.

Glass Unlimited Icon

Continuous & Unlimited

Our SaaS solution is available 24×7. Don’t wait months between reports. Continuously evaluate your security posture and proactively identify and remediate attack vectors as they appear.

Horizon3.ai’s Story

We are a mix of US Special Operations, US National Security, and cybersecurity industry veterans. Our mission is to “turn the map around” – using the attacker’s perspective to help enterprises prioritize defensive efforts. Our team of nation-state-level, ethical hackers continuously identifies new attack vectors through autonomous pentesting and red team operations, leveraging collective intelligence to improve our products and strengthen our clients’ security. Founded in 2019, Horizon3.ai is headquartered in San Francisco, CA, and 100% made in the USA.

Meet our team
Horizon3.ai Team
Horizon3.ai Team at Marketing Kickoff 2021

Get Started Now

Assess your networks today with a free trial of NodeZero. You’ll be up and running in minutes.

Start Free Trial

Lessons Learned

At Horizon3.ai, know that we’ve been in your shoes, working in the SOC, dealing with auditors, serving as CIOs & CTOs, and pouring our hearts and souls into ensuring our organization is secure. Here are the topics at the top of our minds.

ManageEngine CVE-2022-47966 Technical Deep Dive

ManageEngine CVE-2022-47966 Technical Deep Dive

Jan 19, 2023 | ,

Introduction On January 10, 2023, ManageEngine released a security advisory for CVE-2022-47966 (discovered by Khoadha of Viettel Cyber Security) affecting a wide range of products. The vulnerability allows an attacker to gain remote code execution by issuing a HTTP...

ManageEngine CVE-2022-47966 IOCs

ManageEngine CVE-2022-47966 IOCs

Jan 13, 2023 | ,

Introduction The recent ManageEngine CVE-2022-47966 is a pre-authentication remote code execution vulnerability. Depending on the specific ManageEngine product, this vulnerability is exploitable if SAML single-sign-on is enabled or has ever been enabled. ManageEngine...

Metrics That Matter: An Attacker’s Perspective on Assessing Password Policy

Metrics That Matter: An Attacker’s Perspective on Assessing Password Policy

Dec 1, 2022 | ,

After compromising a Windows domain controller, one of the actions that NodeZero, our autonomous pentest product, performs is dumping all domain user password hashes from the Active Directory database. This is a common attacker technique, and the resulting dump is highly valuable to attackers. But did you know that this data is a great source of insight for defenders too?

Vulnerable ≠ Exploitable

Criticality = ƒ(Exploitability, Impact) — The hardest part of cyber security is deciding what NOT to do.

Spending valuable and scarce time and effort on remediating weaknesses that are not exploitable or do not represent a substantial business impact is itself a risk. At the very least, you should be able to trust that the findings from your security tools and services will appropriately guide your remediation and staffing decisions. Find out more about how to prioritize vulnerabilities in this whitepaper.

Read More