Horizon3.ai NodeZero Platform

What do you like best about the product?

I like that NodeZero from Horizon3.ai runs in the background and gives us very clear reports on the most critical vulnerabilities. It helps us find our most critical vulnerabilities so that we can solve them quickly, like password issues allowing us to change our password policy. I appreciate how it helps us automatically put the issues to resolve into Jira, which aids in project management. The reports are clear and we can go back to them easily. I also like that we can retest fixes and add action items into Jira without any hassle. It helps secure our environment and even brings down the cost of our cyber insurance.

What do you dislike about the product?

I find the speed of running the first test pretty slow. It took us several weeks, maybe even a month or more for the test to complete because we ran every test as a beginning baseline. We also found the initial setup a bit time-consuming, but luckily, we had technicians from Horizon helping us set it up and get it running the first time.

What problems is the product solving and how is that benefiting you?

NodeZero from Horizon3.ai helps us identify and quickly resolve critical vulnerabilities in our network and web apps, reduce cyber insurance costs, and integrate seamlessly with Jira for project management.

What do you like best about the product?

I appreciate that NodeZero from Horizon3.ai is a fast and ongoing internal attack simulation solution that doesn't compromise production infrastructure. The automated proof of exploit capability is great because it generates verifiable attack chains without impacting business operations. I also find it valuable that Docker containers can be quickly deployed locally in minutes, and the impact maps clearly show credential harvesting chains across DC. Additionally, I like how rules applied to a firewall are instantly re-activated by automated re-testing. I find it convenient to push Vuln discovery reports directly into Jira for remediation tickets.

What do you dislike about the product?

I find that legacy subnet routers consume system resources excessively at random when trying to discover devices using an aggressive approach. Also, during network sweeps, the platform should offer fine-grained control over bandwidth.

What problems is the product solving and how is that benefiting you?

I use NodeZero for fast, ongoing internal attack simulations, replacing costly manual tests. It simulates attacks without disrupting operations and quickly deploys Docker containers. Impact maps show credential chains clearly, and firewall rules are verified by re-testing. This improves penetration testing efficiency and reliability.

What do you like best about the product?

I like that NodeZero from Horizon3.ai is a safe real-exploit execution tool that doesn't crash services. It helps us focus by separating out proven vulnerable routes, making sure fixes for actionable compromises are handled quickly. I also appreciate the platform's step-by-step proof of compromise logs, which include captured hashes and command line outputs for each successful attack. The one-click post remediation verification feature is really handy, allowing us to retest specific targets without needing a full enterprise assessment.

What do you dislike about the product?

If our VLAN is highly segmented, and we have strict rate limits on our firewall, we often experience timeouts with large subnet discovery jobs. In a multi-homed asset scan, when complex host parsing logic is applied, we notice that secondary interfaces are dropped. Additionally, the initial setup was quite hard for us.

What problems is the product solving and how is that benefiting you?

I use NodeZero to automate penetration testing in our network, separating proven vulnerabilities for prompt fixes. It provides step-by-step proof of compromise logs and one-click post remediation verification to retest targets efficiently.

My main use case for The NodeZero Platform by Horizon3.ai is pen testing.

A quick specific example of how I use The NodeZero Platform by Horizon3.ai for pen testing is pen testing the external IP of store locations.

I primarily use The NodeZero Platform by Horizon3.ai for a spot check and on-the-fly instances; otherwise, we utilize it for recurring scans that happen weekly.

The best features The NodeZero Platform by Horizon3.ai offers are the ability to set up recurring scans that are updated automatically based on current trends in the environment, which is taken up by Horizon rather than us having to manually update these scans ourselves if we were to do this on our own.

The automated updating of scans has been a huge value-add for us; we're a small cybersecurity team, so speed to value is the biggest thing to multiply the force of our small team, saving a lot of man-hours.

I trust the results that The NodeZero Platform by Horizon3.ai provides; there have been times where it's found a vulnerability that wasn't in our environment, but that was due to an IP address changing on our side, actually helping me follow up with our sysadmin team to verify that the vulnerability belonged to an IP address that we no longer owned, allowing me to remove it from the platform and assisting with a little bit of housekeeping as well.

The NodeZero Platform by Horizon3.ai improves remediation time; rather than us having to manually do these scans, which take a lot of man-hours, having them run in the background while we complete other work allows us to address other vulnerabilities that we may have in other aspects of our environment, saving us time overall.

The setting up of new runners in The NodeZero Platform by Horizon3.ai could be simplified a little bit; currently, it's kind of a three-step process where you have to set up the assets in a separate menu, then a separate menu to set up a template, and then you actually set up the runner, so it would be nice if from the runner creation screen it just took you through the whole process instead of having to navigate to three different tabs.

I have been using The NodeZero Platform by Horizon3.ai for seven months.

The NodeZero Platform by Horizon3.ai is stable; I've not experienced any downtime other than when there were updates that needed to be pushed, but outside of that, no downtime, as the updates were quick.

The NodeZero Platform by Horizon3.ai seems to be extremely scalable; we're able to add runners as needed, add and remove assets on the fly, and create more scheduled scans whenever needed, appearing to be infinitely scalable for our use case.

Customer support for The NodeZero Platform by Horizon3.ai has been phenomenal; they've been extremely fast to respond to any tickets that I've entered and have been able to provide solutions extremely fast.

I would rate the customer support a 10.

We used vPenTest previously, and we switched for better cost savings as well as a wider breadth of features.

My advice to others looking into using The NodeZero Platform by Horizon3.ai is to recommend doing an onboarding if there is not one already included in the pricing for purchasing the platform because it takes a little bit to get things up and running, but once you do, it's extremely smooth sailing and self-sufficient for the most part; however, the initial setup can be a little difficult to do on your own.

We would probably need another employee, so ROI could be upwards of $70,000 a year based on how much it would cost to hire an analyst.

The NodeZero Platform by Horizon3.ai has helped reduce our pen testing costs; we had another vendor that we were utilizing before we went with The NodeZero Platform by Horizon3.ai, and it resulted in about a 20% savings.

I joined the organization after this contract was in place but was involved in the next round regarding pricing, setup cost, and licensing.

Before choosing The NodeZero Platform by Horizon3.ai, I evaluated only vPenTest.

On a scale of 1 to 10, I would rate The NodeZero Platform by Horizon3.ai probably an eight, sometimes a nine.

I choose an eight because the UI for setting up a new runner, as I discussed previously, just making that a little smoother would definitely get it up to a nine, and although there have been a few times where I've needed support's intervention, support has been extremely speedy in both their response and also resolution of issues, so I'm not going to dock more points for that; they've been great.

Regarding The NodeZero Platform by Horizon3.ai's AI capabilities, I haven't used those too much in particular, other than what's automatically integrated into the platform, which automatically detects potential vulnerabilities in whatever particular environment I'm pitting it against, making it super helpful since it's analyzing things at a much faster rate than a human could.

The NodeZero Platform by Horizon3.ai's endpoint security effectiveness feature gives a nice breakdown of what threat it's displaying, allowing me to do further research into it; we've had a couple of issues that have sprung up related to IP cameras, discovering again that we don't have those cameras in our environment due to an IP address that no longer belonged to us.

The NodeZero Platform by Horizon3.ai's real attack capabilities have mainly shown that we're 100% clean, which is great to hear, primarily used to show that we have a clean report to our C-suite, essentially demonstrating that all the cybersecurity measures we have in place are appropriately protecting us from threats that are active in the landscape.

I have not utilized the solution's feature that allows security teams to fix and retest vulnerabilities instantly yet.

I rate The NodeZero Platform by Horizon3.ai an overall score of eight out of ten.

Public Cloud

Amazon Web Services (AWS)

What do you like best about the product?

Their support has been extremely fast. I have only had to reach out to them on a few occassions in the last year. But each time they got back to me faster than almost any other vendor that we partner with. On top of that their resolution time was also speedy. I also like the flexibility of virtual and local hosted runners. This allows for more flexibility and a wider range of pen tests can be ran.

What do you dislike about the product?

It can be a little confusing at first to set up a scan for the first time. You have to update assets then create a template then actually set up the runner. Rather than getting an error. It would be nice if from the runner creation section it took you through the whole process.

What problems is the product solving and how is that benefiting you?

It is saving man hours. We are a small Cyber Security shop so speed to value is huge for us. Anything that allows us to force multiple is a huge win. Rather than having to set up repeatative scans and do the manual work of updating them. Horizon stays on top of the latest trends and works them into our scans on a continious basis.

My main use case for The NodeZero Platform by Horizon3.ai is to run automated penetration tests and remediate findings.

We run our penetration test on a scheduled basis, specifically every two months against our data centers, and then we take the results, create incidents in ServiceNow for teams to remediate the findings. When they believe they have remediated the findings, we retest The NodeZero Platform by Horizon3.ai to verify. If the findings are discovered to be mitigated, we close the incidents. If the findings are not mitigated, then we leave the incidents open and coordinate future remediations with the teams.

The best features of The NodeZero Platform by Horizon3.ai are the attack configurations. For internal penetration tests, you are able to select what specific vulnerabilities or exploits you want to check for and deselect those that are more likely to have negative effects on the devices that are pen-tested. Additionally, for external pen tests, it is beneficial to have a tool that can regularly and frequently test your environment to let you know of any recent exploits that are discovered.

Those attack configuration options have helped my team as we frequently encounter zero days, which are critically and recently discovered vulnerabilities. The NodeZero Platform by Horizon3.ai implements exploits to find those vulnerabilities in our environment, so we have tuned attack configurations to check only for those zero day vulnerabilities to quickly get results back on what we are affected by.

The NodeZero Platform by Horizon3.ai has allowed us to quickly and easily identify the exploits in our environment that are greatly increasing our risk. It has simplified that process and also our remediation process, allowing us to more easily work with teams to show how it is exploitable and what they need to do to fix those issues. This has allowed us to significantly improve our finding discovery and remediation process of vulnerabilities, overall decreasing our risk.

My impression of The NodeZero Platform by Horizon3.ai's feature that allows security teams to fix and retest vulnerabilities instantly is fantastic. Those features really simplify our penetration test process and allow us to quickly know if exploits were fixed or not and what can be done to fix them.

The platform's real attack capabilities have greatly helped us in identifying vulnerabilities in our on-prem systems by providing the proof on how the vulnerability was exploited and what could be done to fix it. With penetration testers, you do not always receive that guaranteed proof, nor is it written in a way that is easily digestible by all parties. It has been a great leverage for us.

The effectiveness feature of The NodeZero Platform by Horizon3.ai's endpoint security greatly helps me understand potential security threats, as it tells you what attackers are likely to exploit the vulnerabilities found in your environment. This insight helps prioritize which teams should focus on mitigating first to decrease their risk.

The NodeZero Platform by Horizon3.ai could greatly improve their feature request and product suggestions process. There is not an easy way to see what the status is of product suggestions, and from personal experience, many of the product suggestions and feature requests I have submitted have not been implemented. Having better reflection on the status of feature requests, along with an improved process for that, would greatly enhance the product.

One feature in particular that could greatly improve The NodeZero Platform by Horizon3.ai is load balancing penetration tests. For large environments, it can take a significant amount of time for a penetration test to complete, but if that pen test could be load balanced on more than one system, I believe The NodeZero Platform by Horizon3.ai could leverage that system and complete penetration tests in a much quicker time frame, providing quicker results to customers.

I have been using The NodeZero Platform by Horizon3.ai for over three years.

The NodeZero Platform by Horizon3.ai is extremely stable.

The NodeZero Platform by Horizon3.ai's scalability is easily manageable, as you can deploy as many penetration test servers as needed, and they are very easy to deploy.

The customer support for The NodeZero Platform by Horizon3.ai is great. They have a quick chat feature that makes their support easily accessible, as well as an AI chatbot for simple questions and a case submission system for when neither of those options is available or if they cannot answer your questions.

We did not previously use a different solution.

We did not evaluate other options before choosing The NodeZero Platform by Horizon3.ai.

The advice I would give to others looking into using The NodeZero Platform by Horizon3.ai is to assess their environments to run penetration tests and get an idea of the amount of IPs or assets they have, thereby knowing how many licenses they should acquire for The NodeZero Platform by Horizon3.ai. I would rate this product an eight out of ten.

Hybrid Cloud

Amazon Web Services (AWS)

What do you like best about the product?

The tool is easy to use and straightforward to implement. Being able to run penetration tests at any time, and at a much lower cost than using third parties, has significantly improved our security posture.

What do you dislike about the product?

Nodezero has been slow to implement the product and feature requests I’ve submitted. On top of that, it isn’t easy to see the current status of those requests or track where they stand.

What problems is the product solving and how is that benefiting you?

NodeZero is simplifying our penetration testing process. It has made it much more efficient to identify and remediate pen test findings, and it’s helping our organization’s risk reduce drastically.

What do you like best about the product?

The autonomous penetration testing engine automatically identifies any external vulnerabilities that can be exploited without the need to configure the scripts manually. The platform correctly correlates low-level misconfigurations to show complete domain compromise techniques.

What do you dislike about the product?

When discovering large corporate subnets, the credentialed scanning module will drop active network connections. Also creating local compliance remediation checklists results in a huge delay in dashboard rendering.

What problems is the product solving and how is that benefiting you?

Our security team had to test internal firewalls against current ransomware replication methods. The automated assessment infrastructure conducts continuous perimeter checks, without interfering with live manufacturing operations. The internal testing framework helps us minimize the use of costly outside consultants.