Horizon3 provides its NodeZero platform to HackRange free of charge, so our students can see how autonomous penetration testing works, and so we can keep our own environment secure. Here is what NodeZero does, and why we chose it.
Horizon3 provides NodeZero to HackRange free of charge. HackRange operates as a 100% non-profit, but it is not registered with the IRS as a 501(c)(3). Horizon3 supported us anyway. Our students get hands on time with autonomous pentesting, and our infrastructure is safer for it.
NodeZero is a continuous autonomous penetration testing platform from Horizon3. In Horizon3's words, it "autonomously executes real attack techniques, without agents or disruption," showing exactly how attackers move, what they access, how to stop them, and verifying fixes. Its cycle is simple: hack, fix, verify, repeat.
As Horizon3 puts it, "NodeZero isn't a scanner." Instead of handing you a list of theoretical vulnerabilities, NodeZero chains real weaknesses, such as harvested credentials, misconfigurations, and exploitable vulnerabilities, into proven attack paths. It "provides proof of the exploit, its impact on your organization, and mitigation recommendations," and once you have fixed an issue, a quick verify re-tests it to confirm the fix worked.
NodeZero covers internal, external, cloud, and Kubernetes pentesting, Active Directory password audits, web application pentesting, Rapid Response testing for newly exploited vulnerabilities, and Tripwires for threat detection.
Horizon3 was founded in 2019 and is headquartered in San Francisco. Co-founder and CEO Snehal Antani previously served as CTO of JSOC, CTO at Splunk, and CIO at GE Capital, and the team is a mix of US Special Operations, US National Security, and cybersecurity industry veterans.
The platform is trusted at the highest levels. NodeZero powers the NSA's Continuous Autonomous Penetration Testing (CAPT) program, which the NSA offers at no cost to Defense Industrial Base suppliers, and NodeZero Federal holds FedRAMP High authorization. Horizon3 reports more than 7,000 customers, including 4 of the Fortune 10.
We looked at the commercial alternatives before choosing NodeZero. These are the reasons it won, in our own experience running it against our own infrastructure.
NodeZero runs from one Docker host. There is nothing to install on the servers and workstations it tests, nothing to keep patched on every endpoint, and nothing left behind when the test is over.
We did not have to poke firewall holes all over our network to make it work. NodeZero reaches Horizon3's cloud with outbound connections, tests from inside the network the way an attacker would, and validates the segmentation we already have instead of asking us to weaken it.
NodeZero has never caused an outage to HackRange infrastructure. That matches Horizon3's own record: the company states NodeZero "has achieved zero downtime across all production tests."
More than once, NodeZero has identified misconfigurations and real vulnerabilities in our environment that led to genuine impact, and we fixed them before anyone else could use them.
Compliance driven security asks whether a box has been checked. Risk based security asks what an attacker could actually do. A scanner report full of high CVSS scores can bury the one misconfiguration that hands over the domain, while a "medium" finding chained with a reused password can be the real path to your data.
NodeZero works the way an attacker works. It shows the full attack path, the data or systems reached, and the proof, so teams spend their time on what is exploitable and impactful. Horizon3 describes the result as "proven impact" and "clarity of action": confidence about exactly what to fix now and what can wait. That is the mindset we teach at HackRange, and NodeZero lets our students see it with real evidence.
Many commercial providers tie their non-profit programs to formal IRS status. Microsoft, Google, and Dropbox DocSend, for example, all require 501(c)(3) status or its equivalent. HackRange operates as a 100% non-profit, but it is not registered with the IRS as a 501(c)(3). Horizon3 supported us anyway, providing NodeZero free of charge because of what HackRange does for its students.
Deployment is refreshingly light, and it is all documented in Horizon3's technical documentation.
A Linux host (Ubuntu 20.04 or later, or RHEL 9 or later) with Docker 20.10+ or Podman 4.0+, starting at 2 CPU cores, 8 GB of RAM, and 40 GB of disk. Or use Horizon3's preconfigured OVA.
The host talks out to Horizon3's portal over HTTPS. The optional NodeZero Gateway routes that traffic through static IPs, keeping egress rules short and specific.
Horizon3's docs state that inbound port settings "apply to the host itself, and not on perimeter firewalls," and advise against altering network segmentation, because NodeZero is meant to validate it.
Horizon3 says you can set up and start your first NodeZero pentest in minutes, with defaults designed for safe execution, with or without credentials.
The NodeZero Runner and command line tools support scheduled and fully automated, touchless deployments for continuous testing.
When the operation is complete, the host can simply be shut down or removed. There are no agents to hunt down across the estate.
Autonomous pentesting is covered in Week 10 of the HackRange mentorship, and NodeZero gives students a real platform to learn from rather than slides. They watch an autonomous attacker discover hosts, harvest and reuse credentials, move laterally, and reach sensitive data, then read the proof, prioritize the fixes, and verify them. It connects directly to our Red Team and Offensive Security and Blue Team and Defense learning paths, and to our overview of autonomous pentesting with Horizon3 NodeZero.
The security testing market is full of capable commercial products. Vulnerability scanners such as Tenable Nessus, Qualys, and Rapid7 are the backbone of many vulnerability management programs. Breach and attack simulation platforms such as SafeBreach, AttackIQ, and Cymulate help teams test their security controls. Pentera is also a well known name in automated security validation, and traditional manual penetration tests from skilled consultancies remain valuable.
NodeZero belongs to none of those categories. It is continuous autonomous penetration testing: it does not simulate known techniques to grade your controls, it safely carries out real attacks and proves what an attacker could reach. For a program that wants proof of real risk, safely, in production, NodeZero stood apart in the areas below.
| Capability | NodeZero (continuous autonomous pentesting) |
Vulnerability scanner (e.g. Tenable Nessus) |
Breach and attack simulation (e.g. SafeBreach) |
|---|---|---|---|
| What it does | Safely exploits weaknesses and chains them into proven attack paths | Identifies flaws, missing patches, and misconfigurations | Simulates attacker behavior to test security controls |
| How findings are prioritized | Proven impact, with proof of each exploit | Scores such as CVSS, EPSS, and VPR | Control pass or fail per simulated technique |
| What runs in your network | One Docker or Podman host, no agents | Scanner installation | Simulators deployed in network segments, the cloud, or on endpoints |
| Confirms your fix worked | Quick verify re-runs the attack against the fix | Rescan for the vulnerability | Rerun the simulation |
Product details are as published on each vendor's website on October 30, 2026, and may change. See the sources below.
NodeZero is an autonomous penetration testing platform from Horizon3. It safely executes real attack techniques, without agents, to show how an attacker could move through an environment and what they could reach, provides proof of each exploit with remediation guidance, and lets you verify fixes.
Horizon3 provides NodeZero to HackRange free of charge. Students use it to see how autonomous penetration testing works, and HackRange uses it to help secure its own environment.
NodeZero runs from a single Docker or Podman host, or a preconfigured OVA, with no agents installed on the systems it tests. It needs outbound HTTPS access to Horizon3's cloud. Horizon3's documentation states that its inbound port settings apply to the NodeZero host itself, not to perimeter firewalls, and advises not to change network segmentation for a test.
Horizon3 states that NodeZero has achieved zero downtime across all production tests. In HackRange's experience, NodeZero has never caused an outage to our infrastructure.
A vulnerability scanner identifies flaws and assigns scores such as CVSS, EPSS, or a vendor priority rating. NodeZero exploits weaknesses safely, chains them into attack paths, and provides proof of impact, so teams fix what an attacker could actually use first. That is risk based security rather than compliance based security.
No. HackRange operates as a 100% non-profit but is not an IRS registered 501(c)(3). Many commercial providers require formal IRS status for their non-profit programs. Horizon3 supported HackRange anyway.
Don't assume you're secure. If you want to know what an attacker could actually do in your network, safely and with proof, take a look at NodeZero.
Facts on this page were checked against the following official sources on October 30, 2026. Statements about deployment ease, outages, and findings in our environment reflect HackRange's own experience.
Horizon3, NodeZero, Tenable, Nessus, Qualys, Rapid7, SafeBreach, AttackIQ, Cymulate, and Pentera are trademarks of their respective owners. The Horizon3 logo is used to recognize Horizon3's support of HackRange.