Automated pen tests have strengthened security and provide detailed monthly remediation insights
What is our primary use case?
I have been using The NodeZero Platform by Horizon3.ai for about three years now.
I use The NodeZero Platform by Horizon3.ai to run scheduled penetration tests against my internal and external network resources.
I recently changed my hosting service and web hosting service, and along with that change, I decided to run another penetration test against it to ensure everything was functioning properly. I did find a vulnerability which I was able to quickly address and resolve.
I run this once a month in general, although I will run it whenever something new is introduced into my infrastructure. My monthly run reports provide me with data that I can review, and if I find anything in there that I did not see before, I can address it.
What is most valuable?
One of my favorite features of The NodeZero Platform by Horizon3.ai is the scheduling feature, which means I do not have to remember to run the penetration tests. Another feature I really appreciate is the remediation tasks that it provides. When it offers remediation guidance, it gives me steps to resolve the issue, which saves me time in determining what I need to do to remediate a certain vulnerability.
The remediation steps provided by The NodeZero Platform by Horizon3.ai are usually quite detailed and helpful. Occasionally, I will get one that does not offer a lot in the way of specific steps because the device on which it found the vulnerability is not a standard device that it recognizes. However, if it is a Windows box or Linux box, it is very good about giving me accurate information.
I believe that The NodeZero Platform by Horizon3.ai has kept me safer in a cybersecurity sense. It is one of a couple of different products I use for that purpose, but because I have cybersecurity insurance, I am required to run pen tests at least once a year. This product allows me the opportunity to run it as many times as I want, which is very beneficial because when new things are introduced into my network, I may not be able to identify these vulnerabilities until I run my next penetration test, which could be up to eleven months later.
Because I stay on top of these things, I am not usually caught off guard with a security issue that suddenly appears. I see them monthly and I do not have to generally perform any sort of emergency response that I would have had to do in the past when I had nothing in place.
What needs improvement?
I would love it if I could whitelist certain vulnerabilities that I consider not especially significant with The NodeZero Platform by Horizon3.ai. The NodeZero Platform by Horizon3.ai classifies them based on severity, and the severity for a lot of these things, such as threes, ones, and 0.01s, are generally things that I do not care too much about. I want to see them in a report when they appear the first time, but I would love it if I could simply check that one and indicate that I do not want to see a report about this one again because I am not going to take action on it.
For how long have I used the solution?
I have been working in this field for around thirty years.
What do I think about the stability of the solution?
The NodeZero Platform by Horizon3.ai is quite stable.
What do I think about the scalability of the solution?
It is kind of difficult for me to comment on The NodeZero Platform by Horizon3.ai's scalability because I have not had to change the scale. It certainly works fine in my rather small environment, but since I have not run it in a very large network environment, I cannot really say much more than that.
How are customer service and support?
Customer support for The NodeZero Platform by Horizon3.ai is awesome. I love the chat person I work with on chat. She is always super responsive and very patient and is able to get to the bottom of my problems, which are fairly infrequent. At the beginning, there were a few little hiccups that I was causing through some misunderstanding on my part, but she was very good.
Which solution did I use previously and why did I switch?
I previously used Fortelist, an annual service that they provided to run penetration tests on my network. The reason I switched is because I wanted to be able to run penetration tests more frequently, and it simply would not have been cost-effective to do it more often than one time a year. That is the main reason for the change.
How was the initial setup?
Interestingly enough, I have used that quite a bit in the past. The last time I ran my pen test, I for whatever reason was not able to quickly retest as conveniently as before. I am not really sure why that is, and I probably should just talk with Horizon3.ai about that.
Certainly, time has been saved with The NodeZero Platform by Horizon3.ai, and I would imagine money has been saved from the previous way of doing my pen tests, which were a yearly pen test that were quite expensive to do. There has been no change in employment or employees, but as far as the licensing costs, I think that was a big win for me.
What about the implementation team?
I did not have involvement in the evaluation process. I was not the one who evaluated it; I was the one who implemented it.
What was our ROI?
I believe The NodeZero Platform by Horizon3.ai has helped reduce my pen testing costs, but I cannot tell you exactly how much as I am not the person who paid for those services. However, I believe it was a significant reduction.
What's my experience with pricing, setup cost, and licensing?
I cannot really speak to the pricing as I was not involved in the purchase of it or any of the costs. I was the one that implemented it, and for that, I give it a thumbs up—it was awesome.
Which other solutions did I evaluate?
I think everything else is fine.
What other advice do I have?
The first time you run a test with The NodeZero Platform by Horizon3.ai, be prepared to triage because you are going to find things you had no idea you had.
It is because I have not had any serious problems for a long time. I would say that the very first time I ran The NodeZero Platform by Horizon3.ai, I did find many things such as open SFTP ports, open FTP ports, and open database ports that I was able to quickly address. I would say quickly, but it took a while because the platform found so many. However, it was super helpful because I did not have a single way to find those things before.
I give this review a rating of nine.
Effortless Pentesting with Intuitive Insights
What do you like best about the product?
I like NodeZero from Horizon3.ai for its intuitive interface, which makes it easy to navigate the different sections of the portal. I also appreciate the remediation assistance it offers, as it provides steps to fix vulnerabilities. Additionally, the initial setup of NodeZero was very easy, which was a nice plus.
What do you dislike about the product?
I believe the external pentest can be improved to offer similar depth as the internal pentest. The external pentest can incorporate aspects of application vulnerability scans.
What problems is the product solving and how is that benefiting you?
I use NodeZero from Horizon3.ai to run regular internal pentests and password audits, identifying attack vectors that can exploit system vulnerabilities. The intuitive interface makes navigation easy, and remediation assistance provides steps to fix vulnerabilities.
Automated security testing has improved risk prioritization and reduced remediation efforts
What is our primary use case?
My main use case for The NodeZero Platform by Horizon3.ai includes pen testing and vulnerability management. I use The NodeZero Platform by Horizon3.ai to run weekly external and internal scans to identify configuration issues, software vulnerabilities, or misconfigurations.
How has it helped my organization?
The NodeZero Platform by Horizon3.ai has positively impacted my organization by allowing my security team to be more efficient and focus on the most valuable work at the highest criticality. My team's efficiency has improved by identifying what is truly a cybersecurity risk, allowing us to filter out vulnerabilities that are not exploitable and not worth the time and effort to remediate.
What is most valuable?
The best features The NodeZero Platform by Horizon3.ai offers include addressing security threats introduced by misconfigurations, identity, and vulnerability.
The NodeZero Platform by Horizon3.ai helps me identify security threats from misconfigurations or identity issues by conducting weekly scans of my entire environment to identify issues as an attacker would perceive them, starting from a patient zero.
What needs improvement?
The NodeZero Platform by Horizon3.ai could be improved by reducing the elapsed time from identifying a zero-day vulnerability from their QA environment to their production environment.
For how long have I used the solution?
I have been using The NodeZero Platform by Horizon3.ai for four years.
What do I think about the stability of the solution?
The NodeZero Platform by Horizon3.ai is stable.
What do I think about the scalability of the solution?
The NodeZero Platform by Horizon3.ai is very scalable.
How are customer service and support?
The customer support is excellent.
Which solution did I use previously and why did I switch?
I did not previously use a different solution.
What's my experience with pricing, setup cost, and licensing?
I had a very good experience with pricing, setup cost, and licensing.
Which other solutions did I evaluate?
I evaluated other options before choosing The NodeZero Platform by Horizon3.ai, specifically Pantera.
What other advice do I have?
My advice to others looking into using The NodeZero Platform by Horizon3.ai is to do yourself a favor and see what the product will find. The platform's real attack capabilities have helped in identifying vulnerabilities in my on-premises systems by allowing us to find even systems that made it off inventory; there is nowhere to hide from The NodeZero Platform by Horizon3.ai.
The NodeZero Platform by Horizon3.ai's endpoint security effectiveness feature impacts my understanding of potential security threats by allowing me to assess the efficacy of the EDR solution. The NodeZero Platform by Horizon3.ai has improved my remediation times in a meaningful way and has helped reduce my pen testing costs by approximately 25 percent. I would rate this product 8 out of 10.
Which deployment model are you using for this solution?
Private Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
NodeZero: A Game-Changer for Prioritizing Urgent Cybersecurity Issues
What do you like best about the product?
NodeZero has been a game changer for my team, helping us focus on the most relevant and urgent cybersecurity issues affecting our specific environment.
What do you dislike about the product?
There is occasional lag when moving issues from QA to Prod.
What problems is the product solving and how is that benefiting you?
Resource constraints are a constant challenge, especially when deciding how to deploy limited time and capacity against the most pressing, highest-value work in cyber defense. Node Zero helps me do more with less by keeping my focus on what matters most.
Effortless Network Visibility and Security
What do you like best about the product?
I like that NodeZero from Horizon3.ai is pretty simple to use and straightforward to deploy and maintain. The UI or web GUI is clear and not complicated, which I appreciate. It's quite easy to use, which makes network visibility better and identifying vulnerabilities clear, helping in improving patching. The ease of setting it up is also a plus, as it literally took us just one hour to get it up and running.
What do you dislike about the product?
na
What problems is the product solving and how is that benefiting you?
NodeZero from Horizon3.ai gives us network visibility, shows how strong or weak our network is, and details vulnerabilities. It helps our network security engineers easily patch issues, enhancing our network security from a vulnerability perspective.
Unlimited Pentest Runs Make It Easy to Improve and Re-Test
What do you like best about the product?
I love that there is no limit on how many times you can run a pentest. If you find any issues you can address them and re-run the pentest for a better report.
What do you dislike about the product?
The minimum requirements for the virtual machine are not accurate when it comes to the amount of memory needed. I would recommend allocating 24GB or more to avoid out of memory errors during the pentest.
What problems is the product solving and how is that benefiting you?
Our organization has a much better security posture and more frequent pentest reports as a result of using NodeZero
Fast, Accurate, and Versatile for Multiple Penetration Testing Types
What do you like best about the product?
Speed and accuracy. Support for the multiple types of penetration testing.
What do you dislike about the product?
The installation - docker solution that can be pain in real enterprise grade networks. Customization / fine tuning is missing. Support for custom templates, custom actions.
What problems is the product solving and how is that benefiting you?
I can run multiple pentests in parallel, which helps a lot with the work that can be automated. It delivers great results in a reasonable amount of time.
Revolutionized Our Security with Continuous Pen Testing
What do you like best about the product?
I really appreciate using NodeZero from Horizon3.ai for its capability to run continuous pen testing on our internal and external environments. It does a fantastic job of identifying security vulnerabilities and prioritizing them, enabling us to focus on remediation efforts with minimal effort but maximum impact. I love the ability to validate that fixes are successfully implemented, which helps keep the environment secure. NodeZero effectively improves the security of the entire organization by listing vulnerabilities and increasing their severity based on their role in attack chains. The continuous testing feature is huge for rerunning tests after fixes and consistently staying updated with new features. It's a big improvement compared to traditional pen tests, which are less frequent. The prioritization aspect helps our understaffed security team focus on the most critical vulnerabilities rather than on raw numbers of critical or high vulnerabilities, which aren’t always exploitable. Plus, Horizon3.ai's team was great at helping us set up the initial scans, allowing us to be up and running in less than 24 hours.
What do you dislike about the product?
I really don't have any significant issues with NodeZero from Horizon3.ai. Because of our near continuous pen testing, we sometimes have scans that will run a little bit longer and overrun the start time of the next scheduled scan. But that is a relatively easy fix.
What problems is the product solving and how is that benefiting you?
I use NodeZero from Horizon3.ai for continuous pen testing, identifying security vulnerabilities efficiently, and prioritizing remediation efforts for maximum value. It solves the issue of infrequent traditional tests and helps focus on critical vulnerabilities, improving overall security.
Simplifies Security with Ease, Highly Recommended!
What do you like best about the product?
I love the simplicity of NodeZero from Horizon3.ai. You don’t have to be a pen tester to run a test, and I really appreciate that the results come back on the same day, highlighting what to fix, how to fix it, and showing remediations. The tenant setup is very easy, and once it's done, you're ready to test. We look at best-in-breed technologies, and Horizon3 is certainly that!
What do you dislike about the product?
I think the only thing is to add web application testing but this is on the roadmap
What problems is the product solving and how is that benefiting you?
It helps customers find, fix, and verify exploitables within their infrastructure quickly and simply, even without being a pen tester.
Automated testing has expanded findings but now demands better scope control and broader coverage
What is our primary use case?
We were using The NodeZero Platform by Horizon3.ai for additional findings for PenTest for network, and we did manual testing as well, so it was kind of just testing it out to see if we liked it.
What is most valuable?
What I liked the most about The NodeZero Platform by Horizon3.ai is that it found a dangling DNS really well, which isn't super useful, but it did add a finding to my reports, so that was good.
The NodeZero Platform by Horizon3.ai did help me to understand potential security threats, such as with the dangling DNS issue that came up, which is not something you would normally be looking for, so that did add to my knowledge base. Other than that, I would go through its attack path, so it did have some learning qualities to it.
What needs improvement?
The main downside of The NodeZero Platform by Horizon3.ai is that it would find additional servers that were not in scope when I would put in my scope, and so I had to go through and hand-pick each one every time to move forward to the next stage of the testing. If you are not careful, you can get something that is not in scope, and then if it ends up in your report, that is a significant problem.
If they could add a web app testing feature to The NodeZero Platform by Horizon3.ai, that might be enticing.
Regarding scalability, if they could extend The NodeZero Platform by Horizon3.ai to web apps and other areas, that would be great, as it would give us more coverage. Right now, using it for networks is great, and you could really do a lot with their continuous testing, which I thought was a great feature.
For how long have I used the solution?
I have been working with The NodeZero Platform by Horizon3.ai for about 18 months, and we did not renew our contract this year.
What do I think about the stability of the solution?
I never had any problems with the stability of The NodeZero Platform by Horizon3.ai. I never did anything that would require a week-long worth of testing, but for tests that take a day or two, I did not have any problems.
What do I think about the scalability of the solution?
Regarding scalability, if they could extend The NodeZero Platform by Horizon3.ai to web apps and other areas, that would be great, as it would give us more coverage. Right now, using it for networks is great, and you could really do a lot with their continuous testing, which I thought was a great feature.
How are customer service and support?
I have chatted with technical support for The NodeZero Platform by Horizon3.ai a few times, usually regarding issues such as needing the password list because we locked people out and needed to know why, or if I was entering something and getting a weird response from The NodeZero Platform by Horizon3.ai, I would ask them, and they would usually resolve it for me, so they were really good.
For support of The NodeZero Platform by Horizon3.ai, I would give them a ten, as they are right on the spot, quick, and always give me the right answers.
How was the initial setup?
The initial deployment of The NodeZero Platform by Horizon3.ai was easy when I first deployed it.
It took me maybe thirty minutes to deploy The NodeZero Platform by Horizon3.ai for the first time, and it was not hard at all.
One person can manage The NodeZero Platform by Horizon3.ai, so you do not need a team for this.
Regarding maintenance on my end with The NodeZero Platform by Horizon3.ai, there was no requirement, though I did have to clean up tests that either we stopped or were duplicates, so you did have to go in once in a while and clean up, but nothing major.
Which other solutions did I evaluate?
I have not really used any alternatives, as The NodeZero Platform by Horizon3.ai was the only thing that we have ever used that was similar.
What other advice do I have?
The last time I actually used The NodeZero Platform by Horizon3.ai was probably at least July of last year.
I have no impression of The NodeZero Platform by Horizon3.ai's feature that allows security teams to fix and retest vulnerabilities instantly as I never used the retest with them. We always did that manually.
Regarding the Real Attack capabilities of The NodeZero Platform by Horizon3.ai, out of all of that time that we were using the product, it only ever got domain admin once, and it did start from the very beginning and lay out the entire attack for us, which was good. We did hundreds of tests, so that is why we did not continue, as it was very expensive for a very low yield.
The pricing of The NodeZero Platform by Horizon3.ai is too much for what it yields.
I do not know if we are a partner with The NodeZero Platform by Horizon3.ai. I do not think so, as we were just clients and users.
I would give this review an overall rating of six.
