The NodeZero Platform by Horizon3.ai Reviews

The use cases for The NodeZero Platform by Horizon3.ai include Attack Surface Monitoring primarily, followed by third-party risk management and Attack Surface Management, as well as social media monitoring. These are probably the three biggest use cases.

What I appreciate the most about The NodeZero Platform by Horizon3.ai is its distinctive competitive advantage, which is the ability to bundle multiple security solutions into one single tool. While there is competition, there is nothing quite like The NodeZero Platform by Horizon3.ai at the moment, at least to my knowledge. That is the biggest USP.

Otherwise, it is a question of time. If you benchmark a pure play Attack Surface Management tool alongside The NodeZero Platform by Horizon3.ai, then sometimes The NodeZero Platform by Horizon3.ai may do a better job, whereas sometimes the other tool might do a better job. It is a question of always catching up, much as the different AI models evolve. At some point, ChatGPT was super good, then suddenly it became Gemini and today it is flawed. Competition is constantly ongoing. However, the area where The NodeZero Platform by Horizon3.ai has done pretty well is to build multiple tools and stack them into one single solution, and that is something which competition has not really done. I have no answers to why, but that is the biggest thing with The NodeZero Platform by Horizon3.ai.

The feature that allows security teams to fix and retest vulnerabilities instantly is part of the Attack Surface Management functionality of The NodeZero Platform by Horizon3.ai. The whole idea of ASM is continuous monitoring of vulnerabilities, so the minute you actually fix it and you say that it is fixed, it will go back and check against the same particular use case. That is the functionality being discussed.

The downsides of The NodeZero Platform by Horizon3.ai are that it is an expensive tool; it is a very expensive tool.

Since The NodeZero Platform by Horizon3.ai is integrated, for people who are not looking for everything but just one particular functionality, compared to any other tool, The NodeZero Platform by Horizon3.ai tends to be a little more expensive.

I have probably been working on it for a year.

In terms of stability, I have not seen any issues with The NodeZero Platform by Horizon3.ai; I have not experienced lagging, crashing, or downtime.

I do not know the underlying architecture of The NodeZero Platform by Horizon3.ai; it is a SaaS solution, and since it has not crashed ever, and it is not a business-critical application, it is not your ERP. So frankly, even if they did crash, it would be very hard to notice unless we really manage to try and use it at that time and we get caught. The whole idea of The NodeZero Platform by Horizon3.ai is to work in the shadows and just keep pushing alerts to you. You only log into the tool when you want to. The idea is it works behind the shadows; so even if there was a downtime of, for example, five minutes or ten minutes, it is not your ERP system and you will not really notice it.

There is no single tool which can really say it has all the features that The NodeZero Platform by Horizon3.ai has. However, I have tried other tools which offer some parts of The NodeZero Platform by Horizon3.ai functionality. For example, I have used different third-party risk management tools, ASM tools such as SpyCompass, and IzoLogic for dark web monitoring and things of that nature, which are different tools, but they serve different areas; whereas The NodeZero Platform by Horizon3.ai is a combination of everything.

The initial deployment of The NodeZero Platform by Horizon3.ai is absolutely straightforward and simple; all I need to do is request for an instance, specify these things, and there is nothing really to install apart from the agent server that I need to install. It is not a big deal.

In terms of the platform's real attack capabilities, The NodeZero Platform by Horizon3.ai identifies vulnerabilities in my on-premises systems as good as any other vulnerability scanning solution that is out there. It does a very good job of finding real vulnerabilities and prioritizing them based on the criticality of the asset and contextualization of the organization's nature, which is very standard to any typical vulnerability scanning solution that is out there.

For The NodeZero Platform by Horizon3.ai overall, I would rate it an eight out of ten, with ten being the highest and one being the lowest.

Public Cloud

The primary use case for the NodeZero Platform is as an extension to existing vulnerability management systems. Initially, it complemented solutions like Qualys or Tenable. However, there has been a shift towards using NodeZero to replace existing vulnerability management solutions altogether. The motivations include cost savings and addressing issues that traditional vulnerability managers might report but do not actually affect system security.

Deploying the NodeZero Platform is straightforward for me as it involves just a Docker container in a network or a network segment, saving time and eliminating the need for agents on every endpoint. Its autonomous operation, safe for production use, makes it practical to schedule pen tests during business hours. The tripwires feature acts like a honeypot, providing network alerts for potential threats. These factors make it an effective tool for enhancing security in organizations.

One of the areas where improvement is needed is in the visibility and reporting for large enterprises. The existing GUI or NodeZero insights provide better visibility, but there's still room for enhancement. Moreover, there is a need to automate interactions with other systems, particularly in triggering or opening tickets in ServiceNow. Adding the application layer would also be valuable for clients.

I have used the solution for 1.5 years.

No issues were encountered in deploying the NodeZero Platform. Once the firewalls are open and communication with the cloud is enabled, it's a matter of installing a Docker container or VMware and opening the ports for smooth operation.

I rate the stability of the NodeZero Platform a ten out of ten. We have not encountered any issues on the platform regarding accessibility, performance, or stability.

I rate the scalability of the NodeZero Platform a ten out of ten. We have conducted pen tests in environments with hundreds of thousands of IP addresses without any scalability issues. The platform is built for large scale deployment and operation.

I rate their support an eight out of ten. The support is skilled and effective, although there are sometimes delays due to bandwidth issues, possibly due to the size of the team.

Positive

Initially, NodeZero and similar solutions were used alongside existing vulnerability management solutions like Qualys or Tenable. However, there has been a shift towards replacing these existing solutions as businesses seek to address vulnerability issues more efficiently.

The initial setup is very easy, rated 10 out of 10. It involves straightforward steps of installing a Docker container, configuring firewalls, and ensuring communication with the cloud.

The deployment process involves an initial meeting with the client to choose the deployment method—either on a VMware or Docker container. This is followed by defining and setting up firewall rules. After preparing everything, deploying the Docker container or VMware takes a few minutes, and the pen test can begin.

I rate the pricing a six out of ten. Pricing is moderate compared to competitors but depends on the solutions in comparison. While cheaper than XM Cyber and human pen testers, it's more expensive than vulnerability managers.

I evaluated Pentera and XM Cyber alongside the NodeZero Platform at various points. Pentera was assessed about two years ago, and we have clients currently using XM Cyber.

I rate the NodeZero Platform an eight out of ten. The platform is scalable and stable, suitable for large enterprises and businesses. It needs improvement in areas like visibility, reporting, and automation with third-party systems. The overall product rating is eight.

Hybrid Cloud

Amazon Web Services (AWS)

To meet standards, I am required to do penetration testing periodically. This is something I can do on-demand anytime I choose, or I can set it up to recur on a recurring schedule.

The NodeZero Platform has a great cost, and its usability is straightforward. It can be deployed in the cloud. There is an on-premise container that I need to spin up to allow it to run in my environment, but it is automatically updated because it is cloud-based. It uses AI to try and gain access to my network and learns from the environment as it goes, providing a report on vulnerabilities, and demonstrates how their system exploits them to either elevate privilege or gain access to specific credentials or devices.

I haven't really come across anything that I say needs to be improved with it, other than the container runner, which tends to lose time. It does not always sync with the cloud versions, so I have to do it manually.

I have used the solution for over a year.

Initially, there were some devices that, when it scanned, it caused network issues. So I had to exclude those, but that was fairly simple to do.

I reached out to support and they were very responsive. I would rate them a nine out of ten.

Positive

I have reviewed other penetration testing solutions but haven't used them due to cost constraints, as they were really expensive compared to the NodeZero Platform.

The initial setup was simple and easy to operate.

The pricing is much more affordable than traditional penetration tests.

I have reviewed other penetration testing solutions but did not use any due to cost constraints.

I would advise taking advantage of the support when you have it. For Horizon360 NodeZero, they are always responsive. Let them show you how to use it and the best way to get the most out of it. Overall, I'd rate NodeZero at nine to 9.5 out of ten.

Public Cloud

The solution is used for penetration testing.

Penetration testing and scans are useful features. These features are the reason why we started using the product.

We run the penetration testing and look at the reports. The reports are quite useless. We are looking for a different product. The tool did not help enhance our organization's cybersecurity posture. The reports had a lot of false positives. They didn't detect anything. The tool didn’t identify any vulnerabilities. The solution must detect threats and vulnerabilities.

I have been using the solution for about a year. I am using the latest version of the solution.

We didn’t have any issues with stability.

We didn’t have any issues with scalability. We didn’t need it.

My team interacts with the support team. I haven't heard any complaints.

The solution is deployed on the cloud. The initial deployment was easy.

We haven’t seen a return on investment.

We used another solution parallelly. We got help from a third-party vendor to do that. I will definitely not recommend the product to others. It was quite useless for us. It didn't give us any useful results. Overall, I rate the solution a one out of ten.