Horizon3.ai - Automated Pen Testing as a Service

Frequently Asked Questions

What is NodeZero?

NodeZero is a fully-automated cyber attacker, orchestrating 100s of attacker tools, tactics, and techniques so you can find and fix what matters. Now. Click here for our Data Sheets.

What is The NodeZero Portal?

We provide a secure web application where you can configure, launch, and learn from your pentest operations. All results are encrypted and require your authorization and an account to access. Click here to visit your NodeZero Portal, watch a short video, and login with LinkedIn or Google to run your first pentest operation in <30 minutes!

Where is all the documentation?

From building out your ephemeral host to 1-click reporting, you'll find it right here on our website, from a portal pull-down, or Click here.

How long does an operation take?

Minutes to set up on a Docker host and call in an ephemeral one-time curl command, and then about ~40 seconds per enumerated IP/Host (internal) and subdomain (external/OSINT) in your environment. You can plan for a /24 network segment to take just under 2 hours or 10K IPs/Hosts/Subs environment to take just over a week.

What do I have to install?

A single host running Docker. No agents to monitor or maintain, no taps or sensors, no credentialed access, no special configurations.

What kind of connectivity is needed to reach outside the network?

The NodeZero Docker host needs to communicate with the service command and control infrastructure via encrypted HTTPS over TCP 443. For the specifics, see Docs.

Are you just another vulnerability scanner?

No. NodeZero is focused on attack vectors. It chains security misconfigurations, known software vulnerabilities, weak credentials, and dangerous defaults to maneuver through your environment using what is accessible and exploitable.

What makes you different than all the other security tools out there?

This ain't your grandma's pentesting platform. We started with simple design principles:

  • No persistent agents
  • 100% coverage
  • Safe to run in production
  • 1-click user experience
  • No cheating, scripting, or humans

Those principles are manifested in our differentiation such as:

  • Chaining kill-chain action, attacks, and findings
  • Providing environmental context, which leads to true prioritization
  • Speed to TTV, and ROI gains momentum
  • No training, no tuning, no configurations...there is zero maintenance

This is Automated Pen Testing as a Service...APTaaS.

We already have a Blue (defense) Team with security tools!

NodeZero augments and accelerates your Blue Teams and your Security Operations Center as a complementary automated Red Team, giving you an enviable Purple Team capability that you control and schedule for immediate operations with the same goals as your Blue Team: protect the company business and brand.

We already have a Red Team!

NodeZero augments and accelerates your Red Team with 50x coverage in 50x less time, automatically orchestrating full-spectrum attack tools and penetration tests (internal, external, OSINT) saving time, talent, and treasure.

We don't have a Red Team to use this!

NodeZero is your self-service Red Team, automatically orchestrating full-spectrum attack tools and penetration tests (internal, external, OSINT) with 50x .coverage in 50x less time than traditional consultants, and at far less cost per test/operation.

How do you determine that your exploit is benign and safe to run in production?

We thoroughly research the safety of any known exploit (e.g. denial of service vs. buffer overflow vs. directory traversal, etc.), and prove it. Any and all exploitations of vulnerabilities are continually and thoroughly tested in our own cyber range against a wide range of operating systems and applications.

  • If we determine the exploit is 100% safe, NodeZero will exploit it automatically
  • If we determine the exploit is 100% safe but may change the environment, the exploit is on by default but can be disabled by the user in the Advanced Config
  • If we determine the exploit is < 100% safe, a user must deliberately authorize (turn on) the exploit in the Advanced Config--i.e., it'll be off by default

Additionally, certain exploits that cause changes to the environment such as writing data to a system, are configurable in the advanced options for the customer to disable.

Regardless, NodeZero will enumerate and validate where possible to accurately determine if a potential exploit is possible. This will show as an “unconfirmed” weakness and consequentially, no proof will have been collected.