Horizon3.ai NodeZero Platform

My main use case for The NodeZero Platform by Horizon3.ai is to run automated penetration tests and remediate findings.

We run our penetration test on a scheduled basis, specifically every two months against our data centers, and then we take the results, create incidents in ServiceNow for teams to remediate the findings. When they believe they have remediated the findings, we retest The NodeZero Platform by Horizon3.ai to verify. If the findings are discovered to be mitigated, we close the incidents. If the findings are not mitigated, then we leave the incidents open and coordinate future remediations with the teams.

The best features of The NodeZero Platform by Horizon3.ai are the attack configurations. For internal penetration tests, you are able to select what specific vulnerabilities or exploits you want to check for and deselect those that are more likely to have negative effects on the devices that are pen-tested. Additionally, for external pen tests, it is beneficial to have a tool that can regularly and frequently test your environment to let you know of any recent exploits that are discovered.

Those attack configuration options have helped my team as we frequently encounter zero days, which are critically and recently discovered vulnerabilities. The NodeZero Platform by Horizon3.ai implements exploits to find those vulnerabilities in our environment, so we have tuned attack configurations to check only for those zero day vulnerabilities to quickly get results back on what we are affected by.

The NodeZero Platform by Horizon3.ai has allowed us to quickly and easily identify the exploits in our environment that are greatly increasing our risk. It has simplified that process and also our remediation process, allowing us to more easily work with teams to show how it is exploitable and what they need to do to fix those issues. This has allowed us to significantly improve our finding discovery and remediation process of vulnerabilities, overall decreasing our risk.

My impression of The NodeZero Platform by Horizon3.ai's feature that allows security teams to fix and retest vulnerabilities instantly is fantastic. Those features really simplify our penetration test process and allow us to quickly know if exploits were fixed or not and what can be done to fix them.

The platform's real attack capabilities have greatly helped us in identifying vulnerabilities in our on-prem systems by providing the proof on how the vulnerability was exploited and what could be done to fix it. With penetration testers, you do not always receive that guaranteed proof, nor is it written in a way that is easily digestible by all parties. It has been a great leverage for us.

The effectiveness feature of The NodeZero Platform by Horizon3.ai's endpoint security greatly helps me understand potential security threats, as it tells you what attackers are likely to exploit the vulnerabilities found in your environment. This insight helps prioritize which teams should focus on mitigating first to decrease their risk.

The NodeZero Platform by Horizon3.ai could greatly improve their feature request and product suggestions process. There is not an easy way to see what the status is of product suggestions, and from personal experience, many of the product suggestions and feature requests I have submitted have not been implemented. Having better reflection on the status of feature requests, along with an improved process for that, would greatly enhance the product.

One feature in particular that could greatly improve The NodeZero Platform by Horizon3.ai is load balancing penetration tests. For large environments, it can take a significant amount of time for a penetration test to complete, but if that pen test could be load balanced on more than one system, I believe The NodeZero Platform by Horizon3.ai could leverage that system and complete penetration tests in a much quicker time frame, providing quicker results to customers.

I have been using The NodeZero Platform by Horizon3.ai for over three years.

The NodeZero Platform by Horizon3.ai is extremely stable.

The NodeZero Platform by Horizon3.ai's scalability is easily manageable, as you can deploy as many penetration test servers as needed, and they are very easy to deploy.

The customer support for The NodeZero Platform by Horizon3.ai is great. They have a quick chat feature that makes their support easily accessible, as well as an AI chatbot for simple questions and a case submission system for when neither of those options is available or if they cannot answer your questions.

We did not previously use a different solution.

We did not evaluate other options before choosing The NodeZero Platform by Horizon3.ai.

The advice I would give to others looking into using The NodeZero Platform by Horizon3.ai is to assess their environments to run penetration tests and get an idea of the amount of IPs or assets they have, thereby knowing how many licenses they should acquire for The NodeZero Platform by Horizon3.ai. I would rate this product an eight out of ten.

Hybrid Cloud

Amazon Web Services (AWS)

What do you like best about the product?

The tool is easy to use and straightforward to implement. Being able to run penetration tests at any time, and at a much lower cost than using third parties, has significantly improved our security posture.

What do you dislike about the product?

Nodezero has been slow to implement the product and feature requests I’ve submitted. On top of that, it isn’t easy to see the current status of those requests or track where they stand.

What problems is the product solving and how is that benefiting you?

NodeZero is simplifying our penetration testing process. It has made it much more efficient to identify and remediate pen test findings, and it’s helping our organization’s risk reduce drastically.

What do you like best about the product?

The autonomous penetration testing engine automatically identifies any external vulnerabilities that can be exploited without the need to configure the scripts manually. The platform correctly correlates low-level misconfigurations to show complete domain compromise techniques.

What do you dislike about the product?

When discovering large corporate subnets, the credentialed scanning module will drop active network connections. Also creating local compliance remediation checklists results in a huge delay in dashboard rendering.

What problems is the product solving and how is that benefiting you?

Our security team had to test internal firewalls against current ransomware replication methods. The automated assessment infrastructure conducts continuous perimeter checks, without interfering with live manufacturing operations. The internal testing framework helps us minimize the use of costly outside consultants.

What do you like best about the product?

The platform capabilities are outstanding. I really like that it's safe to use in production and will prioritise any exploits or weaknesses in your environment. The UI is easy to navigate and provides some in-depth information at every step of a successful attack path. It's fast and can scale to any size; it offers various integrations with certain ticketing systems. Pricing seems very reasonable for what you get, and what it gives back to you is very valuable.

The support has been second to none, and any issues or queries I've made have been resolved in a timely manner.

It doesn't use a lot of AI, which I like, and where it does use it, it's enriching already useful information.

What do you dislike about the product?

Honestly, nothing. I've used it extensively and I can't find anything that I don't like.

What problems is the product solving and how is that benefiting you?

It addresses the discovery of exploits and weaknesses in my environment, so it’s truly tailored to my infrastructure and configurations. It identifies what’s actually exploitable in my setup, which helps me focus on what’s critical and most likely to lead to a breach.

It is also wa central console showing me every discoverable asset in the environment, so you get great visibility into what's actually connected to your network.

What do you like best about the product?

What I like most about NodeZero is that it removes the guesswork from penetration testing. Rather than depending on a point-in-time, manual assessment, it continuously and autonomously identifies exploitable attack paths the way a real attacker would—chaining together weak credentials, misconfigurations, and vulnerabilities to highlight real business risk, not just a long list of CVEs. The findings are prioritized and actionable, which helps our team focus remediation on what truly matters instead of chasing noise. It’s also refreshingly self-service: there are no lengthy scoping calls or waiting around for a vendor’s schedule, and we can launch an operation whenever we need to. That mix of speed, autonomy, and real-world attack validation has made it a genuinely valuable addition to our security program.

What do you dislike about the product?

There isn’t much to dislike. If anything, I’d just like to see a few additional features that make it easier to manage the platform.

What problems is the product solving and how is that benefiting you?

NodeZero addresses the challenge of not knowing our true exposure between annual pentests. By running autonomous pentests on an ongoing basis, it highlights real, exploitable attack paths—not just a list of theoretical vulnerabilities—so we can focus on the fixes that actually matter. It’s saved our team time, accelerated remediation, and given us genuine confidence in our security posture instead of relying on guesswork.

What do you like best about the product?

The autonomous penetration testing architecture safely performs production line exploits without impact and downtime. It leverages accessed Active Directory credentials and local configuration vulnerabilities to create the path of lateral movement.It stitches together compromised Active Directory credentials and local configuration vulnerabilities to produce paths of lateral movement.

What do you dislike about the product?

Until the specialized testing environment is completely provisioned, it takes up to 15 minutes for the containerized node orchestration engine to work. The external network perimeter scanning modules are unable to conduct a deep sub domain scan in very complex multi cloud network setups.

What problems is the product solving and how is that benefiting you?

Long wait times and shallow data coverage from manual red teaming consultants were problematic for our corporate security group. Every time code changes deploy to our production environment, NodeZero deploy full scope infrastructure attack campaigns.

What do you like best about the product?

I like their AI motor that performs VAPT without asking for more details, it just execute the VA and after it decides what it needs to do the pentesting

What do you dislike about the product?

Well, the report could be generated in spanish, we are from Mexico and we need spanish reports.

What problems is the product solving and how is that benefiting you?

The lack of resources to execute the pentesting, the AI robot that has help me to keep few people executing nodezero

What do you like best about the product?

I use NodeZero for internal monthly pentesting, and I appreciate that it shows us our vulnerabilities in real time. I like that it's affordable and that the platform provides the tools needed to run regular pentests without involving a third party. We value the coverage it provides, allowing us to switch from annual to monthly testing and enabling us to do periodic testing on isolated tools. It also integrates well with other tools we use, like MS Defender and Rapid7 IDR.

What do you dislike about the product?

Nothing comes to mind.

What problems is the product solving and how is that benefiting you?

I use NodeZero for internal pentesting. It shows vulnerabilities in real time, adapting to changes regularly. It provides tools for monthly tests without needing a third party, adding coverage and allowing periodic testing of isolated tools.

What do you like best about the product?

The interface is simple to use and setup was extremely easy. The pen test results are easy to understand and provide valuable vulnerability information for our network.

What do you dislike about the product?

There's not much to dislike. For the purpose it serves, it performs perfectly.

What problems is the product solving and how is that benefiting you?

It helps to ensure vulnerability testing and discovery without the extensive cost of constantly hiring pen testing services.

My main use case for The NodeZero Platform by Horizon3.ai is autonomous and continuous penetration testing.

A specific example of how I use The NodeZero Platform by Horizon3.ai for autonomous and continuous penetration testing is testing web applications for vulnerabilities as new releases come out. I run these tests weekly or depending upon when it is necessary for different applications.

The best features The NodeZero Platform by Horizon3.ai offers are ease of deployment, intuitive interface, and the extremely useful and phenomenal data that it provides as an outcome.

The interface of The NodeZero Platform by Horizon3.ai is intuitive for me because it provides us with actionable data, and it is very easy to use and straightforward, not requiring much of a learning curve to pick up.

The NodeZero Platform by Horizon3.ai has positively impacted our organization by definitely increasing our security posture significantly.

Since using The NodeZero Platform by Horizon3.ai, I have noticed specific improvements such as a decrease in identified vulnerabilities, with fewer critical and high vulnerabilities over time.

The NodeZero Platform by Horizon3.ai could be improved by speeding up the time from initializing a test to actually starting the test, as the deployment of the underlying infrastructure can take several minutes, sometimes over 10 minutes.

I have been using The NodeZero Platform by Horizon3.ai for four years.

The NodeZero Platform by Horizon3.ai is stable.

The scalability of The NodeZero Platform by Horizon3.ai is very good.

The customer support is very good. On a scale of 1 to 10, I would rate the customer support a 10.

I did not use a previous solution before using The NodeZero Platform by Horizon3.ai.

I have seen a return on investment with The NodeZero Platform by Horizon3.ai but cannot share any relevant metrics.

I evaluated other options before choosing The NodeZero Platform by Horizon3.ai, specifically Pentera.

My advice to others looking into using The NodeZero Platform by Horizon3.ai is to use it to its full potential, as it is very easy to use and has very powerful features; just make sure you're using them all.

Regarding The NodeZero Platform by Horizon3.ai's AI capabilities, I have no preference about its governance and security. I think its accuracy and reliability of output are very good.

The NodeZero Platform by Horizon3.ai is deployed in my organization on a public cloud, as it is a Software as a Service solution. I use AWS as my cloud provider. I did not purchase The NodeZero Platform by Horizon3.ai through the AWS Marketplace.

My impression of the solution's feature that allows security teams to fix and retest vulnerabilities instantly is that it is phenomenal.

The platform's real attack capabilities have helped in identifying actual exploitable vulnerabilities in my on-premises systems compared to a vulnerability management solution, which only gives me theoretically exploitable vulnerabilities.

The NodeZero Platform by Horizon3.ai's endpoint security effectiveness feature impacts my understanding of potential security threats by showing what can actually be exploited.

I would assess The NodeZero Platform by Horizon3.ai's impact on my organization's remediation time as very high.

The NodeZero Platform by Horizon3.ai has not necessarily reduced my penetration testing costs, but it could; however, it has certainly increased our security posture, which could essentially allow me to reduce my penetration testing costs.

I would rate this review a 10.

Public Cloud

Amazon Web Services (AWS)