Horizon3.ai uses NodeZero to validate exploitable attack paths

Horizon3.ai develops NodeZero, an autonomous security-testing platform that examines whether weaknesses in an authorized environment can combine into consequential attack paths. Its purpose is to help defenders decide what to fix and verify that a fix worked. The useful distinction is between a suspected exposure, demonstrated impact and evidence that the same path is no longer available.

01 / ProductSecurity testing built around demonstrated paths

The NodeZero platform is designed to test internal, external, cloud and Kubernetes environments, then present findings, attack paths and remediation guidance. Instead of treating every detected weakness as equivalent, its product model asks what that weakness allows in the environment being tested. An outdated component and an overprivileged identity may matter differently when their relationship is examined.

Horizon3's AI explanation describes graph-based reasoning for planning, machine learning for classification and scoped generative AI for tasks such as analysis and summaries. It states that generative AI does not create or execute exploits. That is a material product boundary: NodeZero is an integrated testing system, not simply a language model given unrestricted control over a network.

The portfolio extends beyond a one-time report. Higher packages add capabilities such as Tripwires, Rapid Response and exposure-oriented analysis, while WebApp testing has separate packaging. The appropriate purchase depends on the security program's actual job. Repeating a test after a change, responding to a newly disclosed threat and assessing application logic are related activities with different inputs and coverage questions.

02 / AudienceTeams that can turn test evidence into remediation

The strongest audience is a security or infrastructure team that already owns a remediation process but struggles to prioritize it. A long vulnerability list does not tell every service owner which change will remove the most consequential exposure. Demonstrated paths can make that discussion more concrete, provided the tested scope and starting perspective are understood.

An organization should also have the capacity to act on results. Running more tests without assigning owners or arranging maintenance windows can create another backlog. NodeZero's value is easier to judge when the team selects a meaningful problem, resolves it and uses verification to close the loop. The unit of improvement is a removed path or reduced impact, not the number of report pages generated.

For vulnerability and exposure context, Tenable is a useful adjacent comparison. For human-led vulnerability discovery and researcher programs, HackerOne addresses a different operating model. Automated testing and human assessment can complement one another. Buyers should compare coverage, evidence and responsibility rather than assume that either approach universally replaces the other.

03 / WorkflowA proposed authorized validation and retest cycle

Consider a proposed pilot for a company-owned internal business network. The security owner first defines the authorized systems, excluded services, test window and responsible contacts. Agree what business impact the team wants to assess and which evidence it can retain. A broad phrase such as internal network is insufficient if the environment includes third-party services or systems whose owners have not approved testing.

The host requirements explain that the NodeZero host is the starting point for internal assessments and should be placed in the relevant network segment. This placement affects the perspective being measured. A result from one location does not automatically describe what an external attacker, remote employee or other network segment could reach. Record the starting conditions alongside the findings.

Use the internal-test guide to review scope and configuration before launching an approved assessment. It offers inclusion, exclusion and expansion choices, so the team should explicitly confirm them against its authorization. The pilot should remain within the intended boundary rather than relying on an unexamined default. The operator needs to understand what the platform will test and how to monitor its progress.

Review a consequential finding with the service owner. Keep the evidence connecting the initial condition to the demonstrated impact, then choose an approved remediation. A patch, configuration change or permission correction may interrupt the path at a different point. The best intervention is not necessarily the one attached to the highest individual severity label; operational feasibility and the protected business function matter too.

Retest after the change and compare the conditions. A failed path is useful evidence only if the relevant systems were reachable and the test actually exercised the intended scenario. Distinguish a verified fix from an incomplete assessment. This is a proposed defensive evaluation; Sequenced has not run NodeZero, tested a production network or independently verified the company's performance claims.

04 / PricingPublished marketplace packages have defined asset scope

Horizon3's packaging page separates Flex episodic testing from Core continuous testing, with Pro and Elite adding further capabilities. Its own page is primarily a feature comparison and sales route. However, the vendor's AWS Marketplace listing publishes contract prices, so describing all NodeZero pricing as unavailable would be misleading.

The table uses the displayed 12-month US-dollar prices for 500-asset Core, Pro and Elite packages and the separately listed WebApp product. These are particular marketplace offers, so confirm asset definitions, testing entitlements, renewal terms and any private offer. The listing notes possible additional AWS infrastructure costs. Its vendor refund policy makes fees non-cancellable and non-refundable except where the law requires otherwise; resolve the scope before committing.

Web application testing should be scoped separately. The marketplace lists NodeZero WebApp at $10,000 for 12 months, but its brief description does not specify the number of licensed applications or whether it corresponds to Flex or Continuous. The packaging page presents WebApp Flex as an add-on to any base package and WebApp Continuous as an add-on to Core, Pro or Elite. Obtain written confirmation of the application quantity, testing mode and required base package before using the listed amount as a complete budget.

05 / DistinctionsReasoning, execution and explanation have different roles

The explicit separation of AI roles is helpful for understanding NodeZero. A model-generated executive narrative can help communicate a finding, but it is not the underlying evidence. Graph reasoning can guide which path to investigate, while controlled test operations establish what happened. A defensible security workflow preserves the distinction so a persuasive summary does not become the sole basis for a remediation decision.

The platform also makes verification part of the same operational cycle. When the test evidence and follow-up check remain connected, an engineering team can demonstrate that its change addressed a specific problem. That is more actionable than closing a ticket solely because someone says a patch was installed. It also exposes regressions when an old configuration or permission later returns.

The distinction should not be overstated. A tested path is evidence about an environment and a moment in time. It is not proof that every possible path was explored, every business-logic flaw was found or future changes are safe. Use the platform to improve a defined security process and retain appropriate human assessment for questions that need broader application knowledge or independent judgment.

06 / QuestionsResolve perspective, evidence handling and package boundaries

Which starting perspective is meaningful? An internal assessment with a local host answers a different question from an external assessment launched from Horizon3's cloud. Document the chosen context and any supplied access. Otherwise a comparison between two runs may confuse a changed starting position with improved defenses. A report is most useful when a reader can understand its scope without relying on the operator's memory.

How will sensitive findings be handled? Security tests may expose credentials, business data or access relationships that require restricted handling. Review retention, data access and the treatment of generative analysis under the actual service agreement. Horizon3 describes its architecture publicly, but a product explanation does not establish every contractual setting for a particular customer.

What does the verification result prove? Ask the operator to distinguish unavailable targets, excluded services and completed checks. An apparent absence of findings can result from a reduced test surface rather than a safer environment. The evidence needed to close a remediation ticket should therefore include the scope and completion state, not only a changed dashboard score.

Finally, confirm which package supports the planned operating model. Continuous retesting, threat-response features and WebApp coverage are separate buying questions. A security team conducting a narrow periodic check may need a different arrangement from one building an ongoing exposure-management program. Include the staff effort needed to interpret results and carry out changes when assessing the investment.

07 / DecisionBuy a repeatable evidence-to-fix process

Horizon3.ai is worth evaluating when a team wants to validate which weaknesses matter in its own authorized environment and then prove the effect of remediation. Start with one controlled assessment and carry a meaningful result through to a completed retest. Expand only when the team can explain the scope, evidence, operational impact and package entitlement behind that cycle.