The NodeZero Platform by Horizon3.ai Reviews

My main use case for The NodeZero Platform by Horizon3.ai includes pen testing and vulnerability management. I use The NodeZero Platform by Horizon3.ai to run weekly external and internal scans to identify configuration issues, software vulnerabilities, or misconfigurations.

The NodeZero Platform by Horizon3.ai has positively impacted my organization by allowing my security team to be more efficient and focus on the most valuable work at the highest criticality. My team's efficiency has improved by identifying what is truly a cybersecurity risk, allowing us to filter out vulnerabilities that are not exploitable and not worth the time and effort to remediate.

The best features The NodeZero Platform by Horizon3.ai offers include addressing security threats introduced by misconfigurations, identity, and vulnerability.

The NodeZero Platform by Horizon3.ai helps me identify security threats from misconfigurations or identity issues by conducting weekly scans of my entire environment to identify issues as an attacker would perceive them, starting from a patient zero.

The NodeZero Platform by Horizon3.ai could be improved by reducing the elapsed time from identifying a zero-day vulnerability from their QA environment to their production environment.

I have been using The NodeZero Platform by Horizon3.ai for four years.

The NodeZero Platform by Horizon3.ai is stable.

The NodeZero Platform by Horizon3.ai is very scalable.

The customer support is excellent.

I did not previously use a different solution.

I had a very good experience with pricing, setup cost, and licensing.

I evaluated other options before choosing The NodeZero Platform by Horizon3.ai, specifically Pantera.

My advice to others looking into using The NodeZero Platform by Horizon3.ai is to do yourself a favor and see what the product will find. The platform's real attack capabilities have helped in identifying vulnerabilities in my on-premises systems by allowing us to find even systems that made it off inventory; there is nowhere to hide from The NodeZero Platform by Horizon3.ai.

The NodeZero Platform by Horizon3.ai's endpoint security effectiveness feature impacts my understanding of potential security threats by allowing me to assess the efficacy of the EDR solution. The NodeZero Platform by Horizon3.ai has improved my remediation times in a meaningful way and has helped reduce my pen testing costs by approximately 25 percent. I would rate this product 8 out of 10.

Private Cloud

Amazon Web Services (AWS)

The use cases for The NodeZero Platform by Horizon3.ai include Attack Surface Monitoring primarily, followed by third-party risk management and Attack Surface Management, as well as social media monitoring. These are probably the three biggest use cases.

What I appreciate the most about The NodeZero Platform by Horizon3.ai is its distinctive competitive advantage, which is the ability to bundle multiple security solutions into one single tool. While there is competition, there is nothing quite like The NodeZero Platform by Horizon3.ai at the moment, at least to my knowledge. That is the biggest USP.

Otherwise, it is a question of time. If you benchmark a pure play Attack Surface Management tool alongside The NodeZero Platform by Horizon3.ai, then sometimes The NodeZero Platform by Horizon3.ai may do a better job, whereas sometimes the other tool might do a better job. It is a question of always catching up, much as the different AI models evolve. At some point, ChatGPT was super good, then suddenly it became Gemini and today it is flawed. Competition is constantly ongoing. However, the area where The NodeZero Platform by Horizon3.ai has done pretty well is to build multiple tools and stack them into one single solution, and that is something which competition has not really done. I have no answers to why, but that is the biggest thing with The NodeZero Platform by Horizon3.ai.

The feature that allows security teams to fix and retest vulnerabilities instantly is part of the Attack Surface Management functionality of The NodeZero Platform by Horizon3.ai. The whole idea of ASM is continuous monitoring of vulnerabilities, so the minute you actually fix it and you say that it is fixed, it will go back and check against the same particular use case. That is the functionality being discussed.

The downsides of The NodeZero Platform by Horizon3.ai are that it is an expensive tool; it is a very expensive tool.

Since The NodeZero Platform by Horizon3.ai is integrated, for people who are not looking for everything but just one particular functionality, compared to any other tool, The NodeZero Platform by Horizon3.ai tends to be a little more expensive.

I have probably been working on it for a year.

In terms of stability, I have not seen any issues with The NodeZero Platform by Horizon3.ai; I have not experienced lagging, crashing, or downtime.

I do not know the underlying architecture of The NodeZero Platform by Horizon3.ai; it is a SaaS solution, and since it has not crashed ever, and it is not a business-critical application, it is not your ERP. So frankly, even if they did crash, it would be very hard to notice unless we really manage to try and use it at that time and we get caught. The whole idea of The NodeZero Platform by Horizon3.ai is to work in the shadows and just keep pushing alerts to you. You only log into the tool when you want to. The idea is it works behind the shadows; so even if there was a downtime of, for example, five minutes or ten minutes, it is not your ERP system and you will not really notice it.

There is no single tool which can really say it has all the features that The NodeZero Platform by Horizon3.ai has. However, I have tried other tools which offer some parts of The NodeZero Platform by Horizon3.ai functionality. For example, I have used different third-party risk management tools, ASM tools such as SpyCompass, and IzoLogic for dark web monitoring and things of that nature, which are different tools, but they serve different areas; whereas The NodeZero Platform by Horizon3.ai is a combination of everything.

The initial deployment of The NodeZero Platform by Horizon3.ai is absolutely straightforward and simple; all I need to do is request for an instance, specify these things, and there is nothing really to install apart from the agent server that I need to install. It is not a big deal.

In terms of the platform's real attack capabilities, The NodeZero Platform by Horizon3.ai identifies vulnerabilities in my on-premises systems as good as any other vulnerability scanning solution that is out there. It does a very good job of finding real vulnerabilities and prioritizing them based on the criticality of the asset and contextualization of the organization's nature, which is very standard to any typical vulnerability scanning solution that is out there.

For The NodeZero Platform by Horizon3.ai overall, I would rate it an eight out of ten, with ten being the highest and one being the lowest.

Public Cloud

Other

We use The NodeZero Platform by Horizon3.ai to perform pentests for our customers, and we have built services around it so that customers can book a one-off pentest or continuous pentesting with us. We call that Pitas or label it Security Validation as a Service, and that way customers get quarterly feedback with a 'to-fix' list from us with recommended actions. We can also run pentests on a monthly basis. We have built many services around The NodeZero Platform by Horizon3.ai and actively use it as a component for our pentesting services.

We had a customer who got a new network and had a huge infrastructure overhaul, and just wanted to know how effective everything we had done actually was. We placed The NodeZero Platform by Horizon3.ai as a so-called runner, then carried out a pentest, and also played through various scenarios, such as grey-box testing—for example, how far can I get if I have credentials of an admin, or how far can I get if I have credentials of a normal user. We also did black-box testing, where we simply plugged ourselves in, got an IP address, and then saw how far we could get. We have also used it in customer projects to see how good the Active Directory password strength is—that is, how good the password policies are configured in an infrastructure. We did that with the ADPA, the Active Directory Password Assessment. We have already used it in various scenarios and in different variants. The overall experience is always positive, and the feedback is always positive.

We always offer it in different flavors for the customer. We also really listen to the customer and ask them what they really want. Do they want an internal pentest, do they want an external pentest? Maybe they also want a phishing assessment. It is really based on how the customer would like to have it for themselves at that moment.

The NodeZero Platform by Horizon3.ai has had a positive effect on our company and our customers in that, firstly, we can save the customer a lot of money, because a single pentest is also very expensive. We can react relatively quickly to customer requirements. If a customer wants a pentest, we can manage to start one within fifteen minutes, assuming the customer is correspondingly flexible. By running continuous pentests with The NodeZero Platform by Horizon3.ai and thanks to the functionality and logic behind it, we can cover a lot of scenarios, and that in turn creates added value for the customer, because if they use it continuously they always know at any given time how their attack surface is shifting.

We had a concrete example with a customer where we really started from a very catastrophic state, and they had a lot of vulnerabilities. I remember that we had about 2,300 findings. We then created a report, sat down with the customer and basically said, 'We now need to harden your environment.' After the first retest, we still had about 1,000 of those vulnerabilities, because a lot could already be fixed. After the third retest we were down to just ten vulnerabilities, where these ten vulnerabilities were also due to the fact that there had been another patch day or that some new vulnerabilities had been published and we and the customer had not yet had the opportunity to patch them because the vendor had not provided a patch yet. We were able to harden a customer environment relatively quickly and also to see whether everything we had done was actually bearing fruit.

The best features of The NodeZero Platform by Horizon3.ai are that Horizon3 AI is simply very good because it is deployable on pretty low-level hardware. We can deploy it in a VM and integrate it into an infrastructure relatively quickly. Another really good point is its simplicity. We can run a pentest again and again. One of the most useful features that Horizon3 AI offers us is the so-called One-Click Verify. If we have tested something and the customer has a vulnerability, we can verify with one click, once they have fixed it, whether this fix actually took effect—whether we have been able to turn off the corresponding attack graphs and all of that. Another advantage is the presentation and the explanation. We do not just hand the customer a pentest report, but we also really give the customer an understanding of the impact on their business. How severe is the whole thing? If I have a vulnerability with a score of ten point zero, how badly will that hit? Or perhaps another vulnerability with a score of four point zero is actually twice as bad. That is basically the advantage for the customer.

For my day-to-day work, I would say the clear, well-structured reports from The NodeZero Platform by Horizon3.ai are excellent. As already mentioned, we can really tell the customer, 'You have a problem there, and this problem has this or that weight,' and it is not just a matter of throwing raw vulnerabilities at them. Instead, the customer truly knows how bad the whole thing actually is.

What is also really good is the huge range of functions that we get for the price with The NodeZero Platform by Horizon3.ai. If we compare it with competitors, we get quite a lot for our money. With other competitors, we have to buy one base license first, and then we have to buy a lot of additional licenses. With The NodeZero Platform by Horizon3.ai, it is different. We get a large feature set right away, and at a pretty good price.

In my opinion, The NodeZero Platform by Horizon3.ai could be improved by continuing to add new features, such as cloud pentesting, which is currently one of the buzzwords. Kubernetes has just been added. I think what is important for Horizon is simply that the vendor continues to be so committed to providing a platform that is that advanced. I think that is the only point where Horizon can continue to evolve. Everything is already very good as it is.

The small things that I had with The NodeZero Platform by Horizon3.ai have now been fixed, so everything is good. I also think it is very good that we can configure and adjust so many things ourselves.

We have been a partner of Horizon3 AI for just under a year, and we have been actively using The NodeZero Platform by Horizon3.ai for about a year to a year and a half. Before that, we had taken a look at it several times.

So far with The NodeZero Platform by Horizon3.ai, we have not been able to identify any instabilities. Everything has always run stably.

The scalability of The NodeZero Platform by Horizon3.ai is very good because if we have purchased licenses, we can also buy additional licenses. It is scalable. We can scale it by IPs, so to speak. That means we have a way to bundle a package for every company. We can go from ten or more. The scaling is really very good. We can simply buy one license per asset, and if we grow, we can grow our licenses. If we become smaller, we can of course scale down.

My experience with The NodeZero Platform by Horizon3.ai's customer support has been very good. We almost always get an answer relatively quickly, and we also quickly have someone on the phone if something breaks or if we have a question. I really cannot say anything negative about that.

We previously used another solution that was similar—that was Pentera in this case. We simply changed partners because we also wanted to go to market with a new solution.

So far, everything with The NodeZero Platform by Horizon3.ai has actually been positive. The dashboards and all the overviews we have are really just very good and very detailed. We always get a contact person at our side who guides us through everything. We have had a lot of tech demos and also many discussions with Horizon, so that we were then able to use the cloud platform relatively quickly.

Since we use The NodeZero Platform by Horizon3.ai with our customers, I cannot give any concrete figures yet. The feedback from customers is indeed always positive in that regard.

The licensing of The NodeZero Platform by Horizon3.ai is actually relatively simple: one asset equals one license, or one IP equals one license. The pricing is good and is always positively received by our customers.

We did evaluate other solutions before deciding on The NodeZero Platform by Horizon3.ai. These were Pico Security and Pentest Tools, and Horizon ended up winning because we realized that the approach with the simple deployment and the pricing are better than with the competitors. Also, Horizon puts a lot of focus on AI, which simply shows that the solution is future-proof.

I would actually give The NodeZero Platform by Horizon3.ai a ten out of ten.

I am giving it a ten because we have come from other vendors that do something similar, and we simply noticed that the collaboration with The NodeZero Platform by Horizon3.ai or Horizon3 AI is really very good. We are in regular contact. Especially as a partner or as a customer, we really have the feeling that we are heard by the partner. That is really worth a lot. If we have real technical problems, we always get support immediately. We just write to our contact at Horizon about a problem, and we get feedback right away. I have experienced it differently before, so this positive experience has really stuck with me.

The NodeZero Platform by Horizon3.ai can only be used as a cloud Software as a Service solution. That is really very good, also from an architectural perspective, because we are mostly with our customers in Germany and in the EU. It is very good that a tenant is only in Europe, so that we have data sovereignty in terms of GDPR. That is definitely a very big advantage for our German customers, for example, that the data is stored in Frankfurt. The general way data is handled is very interesting. They have really thought everything through down to the smallest detail, so that a pentest report or the data that exists for a pentest is very confidential, and we really have to ensure that the data is also removed again relatively quickly and cleanly afterwards.

We actually use the tool provided by The NodeZero Platform by Horizon3.ai.

I would say about The NodeZero Platform by Horizon3.ai: take a look at the solution and look at it for yourselves, and then you will be just as excited as we are. I am rating this product a ten because the collaboration with Horizon3 AI is really very good, and we have received excellent support throughout our partnership.

The primary use case that we have for The NodeZero Platform is for scanning the environment and identifying vulnerabilities. The tool prioritizes vulnerabilities, focusing on the most critical ones.

It has evolved significantly over time. What sets this tool apart from others is its ability to prioritize vulnerabilities effectively. Many vulnerability management (VM) tools today provide users with extensive lists of vulnerabilities—often numbering in the thousands, with categories like four thousand critical and three thousand high. Upon deeper examination, it's common to find that more than half of those vulnerabilities aren't even exploitable. This results in overwhelming amounts of data without a clear focus on what needs immediate attention to improve security. In contrast, this tool excels at prioritizing vulnerabilities based on their relevance to attack scenarios. It analyzes specific attack chains to determine how critical each vulnerability is and assesses how frequently those vulnerabilities appear across various attack chains. By doing this, this tool can elevate the priority of certain vulnerabilities, allowing organizations to concentrate their remediation efforts on the most critical issues. A prime example of this effectiveness comes from an acquisition we conducted. The organization believed it had a robust security environment. However, after running The NodeZero Platform over a weekend, we discovered vulnerabilities that allowed for compromise in approximately 35 different ways. With other tools, addressing these vulnerabilities could have taken six to twelve months due to poor prioritization. In our case, we were able to eliminate the risk of domain compromise within one month and address all single-host vulnerabilities by the second month, all done with a small team, thanks to our precise focus on what truly mattered.

The solution’s feature that allows security teams to fix and re-test vulnerabilities instantly is fantastic. With traditional penetration tests conducted by a human, the process is very expensive. You typically get two weeks of testing, then you make your fixes, and sometimes you can get them to retest. However, often you have to pay extra, and sometimes you just don't have enough time. This results in going another year hoping or thinking that vulnerabilities are fixed, but they might not be. With Horizon3, you can immediately retest vulnerabilities, and it will clearly indicate whether or not they are still present. Probably 20 times in the last year or two, we were told something was fixed when it actually wasn’t. Sometimes it’s due to a patch not being applied correctly, or perhaps they missed adding a registry key. There could be various root causes. The ability to dig in with our team and confirm whether a vulnerability is resolved is crucial. They can go back and fix it, and sometimes that takes multiple attempts. So this functionality is really valuable.

The platform's real attack capabilities have massively helped in identifying vulnerabilities in our on-prem systems. The best litmus test I can give is that during our previous penetration tests, attackers would easily gain domain admin access. However, with Horizon3, we can prioritize vulnerabilities and address them effectively. We recently conducted our first penetration test where the testers were completely unable to gain domain admin access, which is impressive given that this was done by a well-known player in penetration testing.

In terms of NodeZero's Endpoint Security Effectiveness feature's impact on our understanding of potential security threats, looking at it from the endpoint perspective really helps us identify what needs to be done to address vulnerabilities. Once we know what those are, we can go in and fix them. It’s pretty cool.

Prioritization is really key; it's a massive differentiator. The prioritization aspect is crucial. The ability to capture or crack credentials and then use that to move laterally and identify additional vulnerabilities is significant. Their password-cracking capability is a distinct function that is very helpful.

Additionally, when a new vulnerability, such as a zero-day exploit, is identified, they review your previous scans to determine if you might be vulnerable to it, and they proactively notify you. That's a huge benefit.

Also, the fact that they provide fixes alongside all their identified vulnerabilities means you don’t have to search for fixes yourself. They give you specific actions to take, which is incredibly helpful and saves a lot of time.

One significant area to focus on is external vulnerabilities, particularly in the web application space. This often requires a greater level of human ingenuity, as it typically involves navigating a webpage, creating an account, and testing for various vulnerabilities, such as SQL injection. Adding this capability would be a valuable enhancement.

I have been using The NodeZero Platform for approximately four to five years.

The only issue we’ve encountered is that sometimes the scans take a long time to complete. This happens when a credential is identified late in the scan, leading the system to attempt that credential on all the other hosts. As a result, the scans can run longer than expected and may even cause some memory issues. Fortunately, this is a relatively easy fix; you just need to increase the amount of memory on the server. Overall, it’s a minor issue.

The NodeZero Platform has unbelievable scalability. The limiting factor is just where you have the hardware infrastructure to be able to add additional VMs. Anywhere you can put a VM, you can run another concurrent scan.

I might sound like a fanboy, but I truly have about three and a half vendors that I really like. I'm generally tough on most of my other vendors, but these particular ones stand out because they are that good. From a tech support perspective, I would say they have some of the best support compared to any of the companies I work with. Microsoft, for example, is very hit or miss. Sometimes you get an excellent support representative, but I find that about 80% of the time, the person assisting you has no idea what they're doing. As for other decent options, CrowdStrike typically provides good support, but it seems like they focus more on managing tickets from an ITIL perspective, prioritizing the speed of ticket resolution over thoroughness. Zscaler is similar in that respect; They are better than Microsoft, but the quality of support can still be somewhat inconsistent.

Overall, when it comes to The NodeZero Platform's tech support, you can reach them via a chat message on their website, and they respond almost immediately. You're quickly connected with a very knowledgeable engineer, and you receive prompt responses. They are really good.

Positive

We have used Nessus, Qualys, and Tenable as alternatives to The NodeZero Platform. We were paying for Tenable. We were paying for Qualys. We basically stopped and moved to Horizon3.

If you were looking for a super wide net of everything that you could possibly try and identify, I think the other ones might be more holistic, but their prioritization is lacking, leaving you less secure because they do not help you prioritize.

It was super easy. From initially getting it set up to running it, it took about 24 hours. The biggest time requirement is actually getting a virtual machine (VM) stood up. If you can get a Linux VM set up, that’s the hardest part of the whole process. After that, it’s really easy. 

From a maintenance perspective, in terms of keeping the system healthy and functional, there isn’t much that we need to do; it pretty much runs itself. However, where we do put in work is in reviewing the outputs and determining our priorities. We then collaborate with the rest of the team, particularly on the server side, to address vulnerabilities and other issues that arise. So, while there is work involved, it’s not about maintaining the Horizon3 product itself, but rather managing the findings that we need to fix. 

The benefits of The NodeZero Platform are immediate. Just having access to a list of prioritized vulnerabilities and understanding how they were exploited in various attack chains was eye-opening. You might think you have a highly secure environment, but in reality, it can be compromised easily. This insight highlighted everything that needed improvement. Honestly, it's one of the most transformational technologies we've implemented in our company.

They offer really fantastic pricing. We've been with them for a long time, so I believe we might have a special deal. However, from conversations with other peers, it seems their pricing is very competitive as well.

I would rate The NodeZero Platform a 10 out of 10.

My main use case for The NodeZero Platform by Horizon3.ai is to demonstrate the product for customers.

For my customer demonstrations, we use a paid dummy company with AI and conduct penetration testing on that company to show that we perform a real-time scan of the company's data and infrastructure using Horizon3.ai.

Customers typically react with amazement when they see the real-time scan in action, and their questions vary considerably as they are impressed by the quality, quantity, and speed of the test.

The NodeZero Platform by Horizon3.ai has positively impacted my organization as we resell it to customers, and when we conduct a demo, customers are satisfied and want to purchase. This is our main purpose for using the platform. We do not have a large infrastructure ourselves since we work from home and are only three people in the company.

Using The NodeZero Platform by Horizon3.ai has helped us close more deals and speed up our sales cycle, as it is well-known that we sell to customers within the Horizon company through the partner portal and deal registration.

The best features that The NodeZero Platform by Horizon3.ai offers are the manageability of the product, the overview, and the report.

What stands out to me about the overview and the report features is the clarity on what to do as the first step to minimize the attack surface.

I do not know how The NodeZero Platform by Horizon3.ai can be improved at this point, as it is a very comprehensive product, and I cannot say that I am missing anything.

I have been using The NodeZero Platform by Horizon3.ai for a little over a year.

The NodeZero Platform by Horizon3.ai is stable.

The scalability of The NodeZero Platform by Horizon3.ai is simple, and it is easy to scale up.

We have not had any need for customer support.

We did not previously use a different solution.

We have seen a return on investment with increased sales. I cannot provide specific numbers, but we do have increased sales.

My experience with pricing, setup cost, and licensing has been that we do not have any cost as we are resellers.

We did not evaluate other options before choosing The NodeZero Platform by Horizon3.ai.

My advice for others looking into using The NodeZero Platform by Horizon3.ai is to develop a good plan for your IP addresses and infrastructure and place The NodeZero Platform by Horizon3.ai in the correct subnet at the beginning to get the most information from the machines. I would rate this product a 10 out of 10.

The NodeZero Platform has been instrumental in identifying vulnerabilities across our entire network. Its automated scanning capabilities provide detailed insights and alert me to issues, which is exactly what we need from a security tool.

The interface is intuitive and easy to use, and the reporting features are excellent—offering both high-level executive summaries and in-depth technical reports. What stands out is that it not only tells you what's wrong but also explains how to fix it, complete with step-by-step instructions and the exact commands it used during the scan. This transparency is incredibly helpful, especially when validating fixes.

Even when vulnerabilities are detected, they may not always be exploitable in our specific environment. But knowing what's there—and having guidance on remediation—lets me act confidently. I use FortiClient and patch regularly, but NodeZero adds an extra layer of assurance by catching things that might slip through. I don’t have the budget for a dozen expensive tools, but with NodeZero, I get significant value without overspending.

The automation is by far the most valuable feature. NodeZero performs tasks comparable to what we used to get from a manual penetration testing firm—at a similar or even lower cost. The big difference? I can retest whenever I want, without waiting weeks or paying extra fees.

IT environments are dynamic, and things change quickly. In one case, I assumed a group policy was fixing an SMB issue across the network, but NodeZero revealed a few devices were still vulnerable. That allowed us to go back, identify the gap, and validate the fix—all using the platform.

The learning curve was minimal. Setup took just a couple of hours at most. Once installed, I simply choose the endpoints and let it run. There are safety warnings for potentially disruptive scans, which I appreciate—it helps prevent unintended issues like system crashes.

As someone who isn’t a dedicated security engineer, I find the platform comprehensive. However, I’d benefit from additional training on specific features, like their honeypot and tripwire system. Deeper education on these would help me take fuller advantage of the tool.

I’ve been using NodeZero for one year.

The platform has been stable overall. It did crash our phone system once, but that was due to a Mitel vulnerability—not NodeZero itself. That incident actually led us to strengthen our firewall rules by eliminating “any-any” configurations and narrowing down allowed ports.

NodeZero is highly scalable. I have around 1,000 public IPs and about 20 internal VLANs that can be scanned. The IP-based pricing can add up, but it’s manageable and worth the investment.

Scheduling scans is simple. I run external tests every Saturday at 3:30 AM and receive detailed notifications about any issues. It gives me confidence knowing the system is being continuously evaluated.

Customer support has been excellent. The team is responsive, knowledgeable, and eager to walk me through any questions or features. I’d give them a perfect 10 out of 10.

Positive

Before NodeZero, I relied solely on manual penetration testing. The switch was driven by the need for more frequent, flexible, and cost-effective testing.

Initial setup was straightforward. I downloaded an OVA file, deployed it in Hyper-V, powered it on, and used a few simple CLI commands via SSH. Monthly maintenance is easy too—just a quick update command and it's done in seconds.

Pricing is competitive and aligns with what I paid for manual testing—but with more flexibility. Traditional pen tests usually limit you to a few subnets, while NodeZero lets me scan a much broader range without added cost.

I’d rate the NodeZero Platform a 10 out of 10. It’s a powerful, cost-effective, and reliable tool that gives me peace of mind in maintaining a secure IT environment.

The primary use case for the NodeZero Platform is as an extension to existing vulnerability management systems. Initially, it complemented solutions like Qualys or Tenable. However, there has been a shift towards using NodeZero to replace existing vulnerability management solutions altogether. The motivations include cost savings and addressing issues that traditional vulnerability managers might report but do not actually affect system security.

Deploying the NodeZero Platform is straightforward for me as it involves just a Docker container in a network or a network segment, saving time and eliminating the need for agents on every endpoint. Its autonomous operation, safe for production use, makes it practical to schedule pen tests during business hours. The tripwires feature acts like a honeypot, providing network alerts for potential threats. These factors make it an effective tool for enhancing security in organizations.

One of the areas where improvement is needed is in the visibility and reporting for large enterprises. The existing GUI or NodeZero insights provide better visibility, but there's still room for enhancement. Moreover, there is a need to automate interactions with other systems, particularly in triggering or opening tickets in ServiceNow. Adding the application layer would also be valuable for clients.

I have used the solution for 1.5 years.

No issues were encountered in deploying the NodeZero Platform. Once the firewalls are open and communication with the cloud is enabled, it's a matter of installing a Docker container or VMware and opening the ports for smooth operation.

I rate the stability of the NodeZero Platform a ten out of ten. We have not encountered any issues on the platform regarding accessibility, performance, or stability.

I rate the scalability of the NodeZero Platform a ten out of ten. We have conducted pen tests in environments with hundreds of thousands of IP addresses without any scalability issues. The platform is built for large scale deployment and operation.

I rate their support an eight out of ten. The support is skilled and effective, although there are sometimes delays due to bandwidth issues, possibly due to the size of the team.

Positive

Initially, NodeZero and similar solutions were used alongside existing vulnerability management solutions like Qualys or Tenable. However, there has been a shift towards replacing these existing solutions as businesses seek to address vulnerability issues more efficiently.

The initial setup is very easy, rated 10 out of 10. It involves straightforward steps of installing a Docker container, configuring firewalls, and ensuring communication with the cloud.

The deployment process involves an initial meeting with the client to choose the deployment method—either on a VMware or Docker container. This is followed by defining and setting up firewall rules. After preparing everything, deploying the Docker container or VMware takes a few minutes, and the pen test can begin.

I rate the pricing a six out of ten. Pricing is moderate compared to competitors but depends on the solutions in comparison. While cheaper than XM Cyber and human pen testers, it's more expensive than vulnerability managers.

I evaluated Pentera and XM Cyber alongside the NodeZero Platform at various points. Pentera was assessed about two years ago, and we have clients currently using XM Cyber.

I rate the NodeZero Platform an eight out of ten. The platform is scalable and stable, suitable for large enterprises and businesses. It needs improvement in areas like visibility, reporting, and automation with third-party systems. The overall product rating is eight.

Hybrid Cloud

Amazon Web Services (AWS)

To meet standards, I am required to do penetration testing periodically. This is something I can do on-demand anytime I choose, or I can set it up to recur on a recurring schedule.

The NodeZero Platform has a great cost, and its usability is straightforward. It can be deployed in the cloud. There is an on-premise container that I need to spin up to allow it to run in my environment, but it is automatically updated because it is cloud-based. It uses AI to try and gain access to my network and learns from the environment as it goes, providing a report on vulnerabilities, and demonstrates how their system exploits them to either elevate privilege or gain access to specific credentials or devices.

I haven't really come across anything that I say needs to be improved with it, other than the container runner, which tends to lose time. It does not always sync with the cloud versions, so I have to do it manually.

I have used the solution for over a year.

Initially, there were some devices that, when it scanned, it caused network issues. So I had to exclude those, but that was fairly simple to do.

I reached out to support and they were very responsive. I would rate them a nine out of ten.

Positive

I have reviewed other penetration testing solutions but haven't used them due to cost constraints, as they were really expensive compared to the NodeZero Platform.

The initial setup was simple and easy to operate.

The pricing is much more affordable than traditional penetration tests.

I have reviewed other penetration testing solutions but did not use any due to cost constraints.

I would advise taking advantage of the support when you have it. For Horizon360 NodeZero, they are always responsive. Let them show you how to use it and the best way to get the most out of it. Overall, I'd rate NodeZero at nine to 9.5 out of ten.

Public Cloud

The solution is used for penetration testing.

Penetration testing and scans are useful features. These features are the reason why we started using the product.

We run the penetration testing and look at the reports. The reports are quite useless. We are looking for a different product. The tool did not help enhance our organization's cybersecurity posture. The reports had a lot of false positives. They didn't detect anything. The tool didn’t identify any vulnerabilities. The solution must detect threats and vulnerabilities.

I have been using the solution for about a year. I am using the latest version of the solution.

We didn’t have any issues with stability.

We didn’t have any issues with scalability. We didn’t need it.

My team interacts with the support team. I haven't heard any complaints.

The solution is deployed on the cloud. The initial deployment was easy.

We haven’t seen a return on investment.

We used another solution parallelly. We got help from a third-party vendor to do that. I will definitely not recommend the product to others. It was quite useless for us. It didn't give us any useful results. Overall, I rate the solution a one out of ten.