Horizon3 NodeZero

No entries match these filters. Clear filters

1. updated seen Nov 4, 2026 · issue 130

   NodeZero adds Git repository reconstruction, SQL Server trusted-link testing, and Integration Router entity-type routing in its October 2026 release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Protect a fragile OT device on a non-default port by excluding it from TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. scanning during a pentest.
   📍In the pentest scope configuration, go to Scope › Exclude TCP Ports and enter the port numbers (e.g. 102, 502) you want NodeZero to skip.
   Throttle Nuclei scans against a production web app to avoid overwhelming it during active-hours testing.
   📍In the pentest configuration, locate the Nuclei Scan Intensity option and set it to a lower throttling level before launching the op.
   Send only critical findings to your SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration while routing asset data to a separate ticketing workflow.
   📍In the Integration Router settings, open the target workflow, select Entity Types, and choose the specific entity types (e.g. findings, assets) to send to that destination.
   • Scope tests with a new Scope > Exclude TCP Ports option to protect fragile assets from specific TCP ports during a pentest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Control Nuclei scan intensity with a new Nuclei Scan Intensity (throttling) option to reduce load on sensitive targets.
   • Filter and route Integration Router workflows by entity type, letting you choose which entity types are sent to each destination.
   • External Asset Discovery now reconstructs exposed Git repositories from discovered attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. and captures service banners on nonstandard ports for broader visibility.
   • NodeZero now tests Microsoft SQL Server trusted links as part of its attack surface coverage.

   +5 more show less

   • Azure tests now cover the contents of blobs and file shares inside Azure storage accounts and respect minimum runtimes.
   • Expanded target-app login now supports SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. and identity-gated portals, and maintains persistent authenticated sessions.
   • WebApp Pentest now uses AI agents constrained by guardrails, plus new Risk Assessment and Safety Overrides features to identify potentially risky routes for blocking or testing.
   • Engagement Reports now support filtering and sorting.
   • Subdomain discovery now offers more user control over scope.
   • Scope tests with a new Scope > Exclude TCP Ports option to protect fragile assets from specific TCP ports during a pentest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Control Nuclei scan intensity with a new Nuclei Scan Intensity (throttling) option to reduce load on sensitive targets.
   • NodeZero now tests Microsoft SQL Server trusted links as part of its attack surface coverage.

   7 more in Everything

2. announced seen Oct 28, 2026 · issue 123

   NodeZero integrates with Palo Alto Networks Cortex XSOAR, pushing high/critical findings as actionable incidents with 1-Click Verify.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   After installing the NodeZero integration from the Cortex Marketplace, route incoming NodeZero incidents through an existing XSOAR playbook for enrichment and remediation assignment.
   📍In Cortex XSOAR, go to Marketplace › search NodeZero › Install. Then open Settings › Integrations › NodeZero and configure your NodeZero API credentials. New high- and critical-severity NodeZero findings will appear automatically as incidents under Incidents › NodeZero Findings.
   After applying a fix, use 1-Click Verify to retest a specific finding directly from Cortex XSOAR without re-running a full pentest.
   📍In Cortex XSOAR, open the NodeZero incident for the remediated finding › click Actions › select 1-Click Verify to trigger NodeZero to retest only that finding and update the incident status based on whether it remains exploitable.
   • Adds a certified NodeZero integration on the Cortex Marketplace that automatically ingests NodeZero high- and critical-severity open findings into Cortex XSOAR as actionable incidents, complete with affected asset data, exploitation evidence, and remediation guidance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables 1-Click Verify from within the remediation workflow to retest eligible findings and confirm whether they remain exploitable after a fix is applied.
   • Supports continuous Find-Fix-Verify-Repeat workflows: remediated findings stop returning as open incidents in Cortex XSOAR, while unresolved exploitable weaknesses continue to surface for action.

   3 details in Everything

3. announced Oct 27, 2026 · issue 123

   Horizon3 NodeZero: Enables 1-Click Verify from within the NodeZero–XSOAR workflow to retest a remediated finding and confirm whether it remains exploitable.

   └──▷ HOW TO FIND IT
   After NodeZero completes an autonomous pentest, have XSOAR playbooks automatically receive and route the exploitable findings — then retest a patched asset without leaving the XSOAR workflow.
   📍In Cortex XSOAR, go to Marketplace › search NodeZero › Install the certified NodeZero integration. Configure the integration with your NodeZero credentials, then use an existing or new playbook to consume incoming NodeZero incidents. After patching, trigger 1-Click Verify on the incident to confirm the finding is no longer exploitable.
4. announced Oct 15, 2026 · issue 113

   NodeZero gains a Torq integration with GraphQL API access, scheduled verification tests, and automated remediation workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   After Torq remediates a credential exposure, use a User role API key to schedule a 1-Click Verify retest and confirm the weakness is no longer exploitable before closing the ticket.
   📍In Torq, add a Schedule NodeZero Verification Test step using a User role Horizon3 API key and the gateway URL for your region, select 1-Click Verify against the original pentest ID, then add a Get Weakness Resolution Status step — if status is resolved, close the finding; otherwise route it back for review.
   • Adds a Torq integration that retrieves pentests, weaknesses, attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., hosts, and credentials from NodeZero via a Horizon3 API key and gateway URL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Exposes a GraphQL query step in Torq that opens the full Horizon3 API to workflow builders beyond the pre-built action steps.
   • Supports two API key permission levels: a User role key that can both retrieve results and schedule NodeZero verification tests, and a Read-only key that can retrieve results but cannot start tests.
   • Enables Torq workflows to schedule 1-Click Verify retests of specific weaknesses, reusing the original pentest configuration, and retrieve resolution status for each weakness to drive automated ticket closure or re-escalation.

   4 details in Everything

5. changelog Oct 12, 2026 · issue 104

   NodeZero gains network pivoting for external tests, CrowdStrike Falcon Next-Gen SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration, and new WebApp pentest controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Enable network pivoting on an external pentest to automatically enumerate and attack hosts discovered during the operation, beyond the originally scoped targets.
   📍In the NodeZero console, create or edit an External pentest operation, then under Attack Configuration enable Network Pivoting to allow the operation to pivot to additional hosts discovered at runtime.
   Reduce account lockout risk during password spray campaigns by enabling rate-limiting controls in attack configuration before launching an operation.
   📍In the NodeZero console, open Attack Configuration for your operation and use the on/off toggle and rate-limiting options under Password Spray to set a safe request cadence before launching.
   • Adds network pivoting for external tests, enabling NodeZero to reach additional hosts discovered during an operation beyond the originally configured scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a new integration with CrowdStrike Falcon Next-Gen SIEM.
   • Adds new on/off and rate-limiting options for Password Spray, credential pivoting, and post-exploitation attack configuration to minimize account lockouts.
   • Adds custom login field configuration and support for longer secrets in WebApp pentest operations.
   • Expands ServiceNow VR integration with additional matching fields for more-reliable interoperation.

   +2 more show less

   • Expands Integration Settings with broader search, filtering, and Activity Log details.
   • Adds clearer feedback in WebApp pentest when a Runner or read-only state limits an action.
   • Adds network pivoting for external tests, enabling NodeZero to reach additional hosts discovered during an operation beyond the originally configured scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a new integration with CrowdStrike Falcon Next-Gen SIEM.

   5 more in Everything

6. docs update Oct 10, 2026 · issue 100

   NodeZero WebApp Internal tests now require AWS Bedrock Runtime endpoints in us-east-1, us-east-2, and eu-central-1.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds bedrock-runtime.us-east-1.amazonaws.com, bedrock-runtime.us-east-2.amazonaws.com, and bedrock-runtime.eu-central-1.amazonaws.com to the required allowlist for WebApp Internal tests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Deprecates *.docker.com, *.docker.io, and docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com from the network requirements allowlist.
   • Adds bedrock-runtime.us-east-1.amazonaws.com, bedrock-runtime.us-east-2.amazonaws.com, and bedrock-runtime.eu-central-1.amazonaws.com to the required allowlist for WebApp Internal tests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !*.docker.com, *.docker.io, and docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com are deprecated — firewall allowlists that still reference only these Docker endpoints may need updating as NodeZero shifts away from them.
7. updated seen Oct 8, 2026 · issue 097
   • New integration CrowdStrike Falcon Next-Gen SIEM integration
8. updated seen Oct 6, 2026 · issue 096

   NodeZero adds network pivoting for external tests, new attack config controls, and expanded WebApp pentest options in September 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Enable network pivoting on an external pentest to automatically chase newly discovered hosts beyond the originally scoped IP range.
   📍In the NodeZero console, create or edit an External pentest op, go to Attack Configuration, and enable Network Pivoting to allow the op to pivot to additional hosts discovered during the operation.
   Tune Password Spray aggressiveness to avoid account lockouts in a target Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. environment.
   📍In the NodeZero console, open Attack Configuration for your op, locate the Password Spray section, and use the on/off toggle and rate-limiting controls to set an acceptable spray rate before launching.
   • Adds network pivoting for external tests, enabling NodeZero to pivot beyond the originally configured scope to include additional hosts discovered during an operation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds new on/off and rate-limiting options for Password Spray, credential pivoting, and post-exploitation to control attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. and minimize account lockouts.
   • Supports custom login fields and longer secrets in WebApp Pentest configuration, with clearer feedback when a Runner or read-only state limits an action.
   • Expands ServiceNow VR integration with additional matching fields for more-reliable interoperation.
   • Adds expanded search, filtering, and Activity Log details to Integration Settings.

   +1 more show less

   • Expands Rapid Response and attack coverage to include PaperCut, GeoTools and GeoServer, Oracle E-Business Suite, Microsoft SharePoint, Citrix NetScaler, and GitLab.
   • Adds network pivoting for external tests, enabling NodeZero to pivot beyond the originally configured scope to include additional hosts discovered during an operation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   5 more in Everything

9. docs update Sep 22, 2026 · issue 082

   NodeZero gains Expanded Scope (Network Pivoting) — tunnel, Azure VM, and RFC 1918RFC 1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic. pivot techniques with scoped include/exclude controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Enable Tunnel Pivoting with a targeted include subnet and a sensitive exclude subnet to map the full blast radius from a compromised perimeter host without touching production infrastructure.
   📍In the external pentest configuration, under Expanded Scope (Network Pivoting), toggle the section On. Enable Tunnel Pivoting. In the Include field enter the CIDR block of the internal network segment NodeZero is authorized to reach (e.g. 10.10.5.0/24). In the Exclude field enter any subnets off-limits (e.g. 10.10.5.128/25). Save and launch the test.
   Quickly enumerate all RFC 1918 space reachable from a compromised host by using Add Full Private IP Space instead of manually enumerating subnets.
   📍In the external pentest configuration, under Expanded Scope (Network Pivoting), toggle On and click Add Full Private IP Space. This populates the Include scope with 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 automatically. Add any off-limits ranges to the Exclude field, then launch the test.
   Assess lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. risk into Azure VMs that are not publicly routable by enabling Azure VM Run Command Pivot on an external pentest.
   📍In the external pentest configuration, under Expanded Scope (Network Pivoting), toggle On and enable Azure VM Run Command Pivot. Add the relevant Azure VM subnet CIDRs to the Include field. After the test completes, review the Attack Graph for the dedicated pivot node and check the Impacts tab for Post-Pivot badges on Critical findings.
   • Adds Expanded Scope (Network Pivoting) toggle to external pentest configuration, enabling NodeZero's attack engine to follow discovered footholds beyond the originally configured scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Tunnel Pivoting technique, which creates L3 tunnels through compromised hosts and deploys attack assets on internal networks outside the configured scope.
   • Adds Azure VM Run Command Pivot technique, allowing NodeZero to use Azure Run Command to pivot to VMs with IPs outside the configured scope.
   • Adds Add Full Private IP Space option that automatically inserts 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 into the Include scope for full RFC 1918 enumeration.
   • Adds Include field for specifying additional subnets (IP CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. blocks or CSV upload) that NodeZero is authorized to reach via pivoting.

   +2 more show less

   • Adds Exclude field for specifying subnets (IP CIDR blocks or CSV upload) that NodeZero is not authorized to test even if reachable via pivoting.
   • Surfaces pivot-based findings across the Summary tab (Network Pivot Achieved callout and per-subnet Pivot badges), Impacts tab (Pivot and Post-Pivot badges with Critical highlighting), Attack Graph (dedicated pivot node), and Hosts tab.

   7 details in Everything

10. docs update Sep 22, 2026 · issue 082

    NodeZero OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. deployment now supported on Nutanix AHV/AOSNutanix AHV/AOSA hypervisor (AHV) and operating system (AOS) made by Nutanix for running virtualised workloads on their hyper-converged infrastructure, giving cyber tools a managed VM platform with built-in storage and networking. (Prism Central)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Deploy the NodeZero OVA on a Nutanix AHV/AOS cluster when your environment runs Prism Central instead of VMware or other hypervisors.
    📍1. Log in to Prism Central (AOS). 2. Go to Infrastructure › Compute › OVAs › Upload OVA. 3. Under Choose OVA File, click Select File and select the downloaded NodeZero OVA. 4. Once uploaded, select the OVA in the OVAs section, open the Action drop-down, and choose Deploy as VM. 5. (Optional) Rename the VM. Remove the default subnet and select the correct Subnet. 6. Set BIOS mode to UEFI (do NOT enable Secure Boot). Click Next, Review, then Create VM. 7. Switch to the Nutanix Cluster UI (AHV), find the new VM in table view, and click Power On. 8. Select Launch Console to reach the initial NodeZero login screen.
11. docs update Sep 22, 2026 · issue 082

    NodeZero OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. now supports Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license., enabling quick VM deployments on Nutanix hypervisors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds Nutanix AHV as a supported hypervisor for the preconfigured OVA image, alongside VMware and VirtualBox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

12. announced seen Sep 16, 2026 · issue 076

    NodeZero findings now flow into CrowdStrike Falcon Next-Gen SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. for correlation with endpoint, identity, and cloud telemetry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    When setting up the NodeZero integration to send validated findings into Falcon Next-Gen SIEM for your organization.
    📍In the CrowdStrike Marketplace, navigate to the Horizon3 AI NodeZero listing at marketplace.crowdstrike.com/listings/horizon3-ai-nodezero/, then follow the installation steps to enable the integration and begin ingesting NodeZero findings into Falcon Next-Gen SIEM.
    • Integrates NodeZero validated findings and exposure data into CrowdStrike Falcon Next-Gen SIEM, available via the CrowdStrike Marketplace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables correlation of validated NodeZero exposure data with endpoint, identity, cloud, and other security telemetry during SIEM investigations.
    • Incorporates NodeZero validated exposure information into existing security operations workflows within Falcon Next-Gen SIEM.

    3 details in Everything

13. docs update Sep 14, 2026 · issue 074

    NodeZero external pentests now support multi-Scope testing with per-Scope breakdowns in test reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable multi-Scope coverage for an external pentest so the resulting report breaks down findings by each authorized Scope.
    📍In the external pentest configuration, enable the External Scope toggle to authorize assets across multiple Scopes. Leave it off to restrict testing to a single selected Scope.
14. docs update Sep 14, 2026 · issue 074

    NodeZero adds AWS, Azure Cloud, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. Hybrid, and Entra ID Hybrid Pentest as new test types⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds AWS test as a new NodeZero test type for attacking and assessing AWS environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Azure Cloud test as a new NodeZero test type for attacking and assessing Azure Cloud environments.
    • Adds Entra ID Hybrid test as a new NodeZero test type for assessing Entra ID Hybrid identity environments.
    • Adds Entra ID Hybrid Pentest as a new NodeZero test type for full pentest coverage of Entra ID Hybrid environments.

    4 details in Everything

15. docs update Sep 2, 2026 · issue 062

    NodeZero 2026.08 adds WebApp and Azure Cloud pentests, Australia data residency, and new Activity & Artifacts tabs.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    After an op completes, use the Artifacts tab to review files NodeZero collected and correlate its actions against IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity./SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. alerts to rule out false positives.
    📍In the NodeZero console, open a completed pentest, select the Activity tab, then switch to the Artifacts tab to browse collected artifacts alongside the Action Log entries.
    • New Azure Cloud pentest type combines Azure API enumeration with an Internal pentest for assumed-breach assessment of both cloud control planes and workloads running on Azure VMs.
    • New Activity & Artifacts tabs added to both Real-Time View and post-op test results, with the Action Log extended across both views to help distinguish NodeZero activity from malicious attacks.
    • New targeted Rapid Response tests for critical vulnerabilities in Metabase, GitLab Community and Enterprise Editions, and Ivanti Endpoint Manager, plus expanded certificate and Amazon S3 takeover detection.
    • Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. and Identity upgrades include a dedicated Identity Details view, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket extraction during credential dumping, and safer authentication workflows.

    4 details in Everything

16. updated seen Sep 1, 2026 · issue 062

    NodeZero adds WebApp and Azure pentests, Australian data residency, Activity/Artifacts tabs, and expanded AD/Identity capabilities.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Run a WebApp pentest against a staging application to discover routes and get proof-based findings before a production release.
    📍In NodeZero, go to Launch Op › WebApp Pentest, enter your target URL, configure authenticated workflow credentials, and start the assessment.
    Assess an Azure environment end-to-end — from control plane enumeration to lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. on VMs — in a single assumed-breach op.
    📍In NodeZero, go to Launch Op › Azure Cloud Pentest, supply your Azure credentials/scope, and select the combined Azure API + Internal pentest assessment mode.
    • New WebApp pentest op type: crawl, discover, and test production, staging, and private web applications with authenticated workflows, automated route discovery, and proof-based findings.
    • New Azure Cloud pentest op type: assess Azure control planes and VM workloads in a single assumed-breach assessment combining Azure API enumeration with an Internal pentest.
    • New Activity & Artifacts tabs: the Action Log now extends from Real-Time View into post-op results, and both views gain a dedicated Artifacts tab to deconflict NodeZero activity from malicious attacks.
    • Australia data residency: platform traffic and pentest data can now be kept within the Australian region for data-sovereignty compliance.
    • New dedicated Identity Details view for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. & Identity assessments.

    +2 more show less

    • Adds KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket extraction during credential dumping in Active Directory assessments.
    • Safer authentication workflows in Active Directory & Identity ops.

    7 details in Everything

17. updated seen Sep 1, 2026 · issue 010

    NodeZero adds WebApp and Azure pentests, Australian data residency, Activity/Artifacts tabs, and expanded AD/Identity capabilities.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Run a WebApp pentest against a staging application to discover routes and get proof-based findings before a production release.
    📍In NodeZero, go to Launch Op › WebApp Pentest, enter your target URL, configure authenticated workflow credentials, and start the assessment.
    Assess an Azure environment end-to-end — from control plane enumeration to lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. on VMs — in a single assumed-breach op.
    📍In NodeZero, go to Launch Op › Azure Cloud Pentest, supply your Azure credentials/scope, and select the combined Azure API + Internal pentest assessment mode.
    • New WebApp pentest op type: crawl, discover, and test production, staging, and private web applications with authenticated workflows, automated route discovery, and proof-based findings.
    • New Azure Cloud pentest op type: assess Azure control planes and VM workloads in a single assumed-breach assessment combining Azure API enumeration with an Internal pentest.
    • New Activity & Artifacts tabs: the Action Log now extends from Real-Time View into post-op results, and both views gain a dedicated Artifacts tab to deconflict NodeZero activity from malicious attacks.
    • Australia data residency: platform traffic and pentest data can now be kept within the Australian region for data-sovereignty compliance.
    • New dedicated Identity Details view for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. & Identity assessments.

    +2 more show less

    • Adds KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket extraction during credential dumping in Active Directory assessments.
    • Safer authentication workflows in Active Directory & Identity ops.

    7 details in Everything

18. NodeZero September 2026 Sep 2026 · release notes

    NodeZero Sept 2026 adds network pivoting for external tests, WebApp long credentials, API filtering, and ServiceNow integration fields.

    • Adds Attempts per User and Spray Window configuration options in Password Spray settings to control rate-limiting and reduce account lockouts
    • Adds name and dns_domain matching fields to the ServiceNow VR integration for more-reliable interoperation
    • Adds @ symbol support and secrets longer than 110 characters to WebApp injected-credential usernames
    • Adds filtering capability to the Runners API to locate Runners that handle large credentials
    • Adds subdomain takeover testing for dangling CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. targets without requiring additional authorizations

    +4 more show less

    • Adds Elasticsearch scanning support for HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. targets with certificate verification previously causing silent skips
    • Adds fingerprints for self-hosted Git servers in asset discovery
    • Adds CSV export capability to Real-Time View > Artifacts and Activity > Artifacts tabs
    • Adds filter chips to the Rapid Response advisories table

    9 details in Everything

19. docs update Aug 31, 2026 · issue 060

    NodeZero adds Azure Cloud Pentest support with role-based gray-box testing and pre-launch quota validation.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Run an identity- and configuration-focused Azure pentest using the Reader role to test with minimal permissions.
    📍In the NodeZero portal, go to Pentests › Run Assessment › Infrastructure › Azure Cloud Pentest. Enter your pentest name, select your Tenant ID and Subscription ID, choose a subnet for NodeZero VM deployment, then set Role to Reader. Submit the form — NodeZero will run pre-launch validation checks before launching.
    Enable deeper gray-box testing including infrastructure provisioning by selecting the Contributor role for a subscription with required tags.
    📍In the NodeZero portal, go to Pentests › Run Assessment › Infrastructure › Azure Cloud Pentest. Select Tenant ID and Subscription ID, pick a subnet, set Role to Contributor, and supply any required tag key-value pairs in the Tags field to satisfy subscription or resource group policy. Click Run Pentest after pre-launch validation passes.
    • New Azure Cloud Pentest type available from the Pentests page under Run Assessment > Infrastructure > Azure Cloud Pentest, scoped per Tenant ID and Subscription ID.
    • Role-based testing lets you select built-in Azure roles (Reader, Contributor, Virtual Machine Contributor) or any custom roles on the subscription to control gray-box depth.
    • Pre-launch validation checks subnet IP space, NSG outbound connectivity on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. 443, regional vCPU quotas (minimum 4 Total Regional vCPUs and 4 Standard DSv3 Family vCPUs), VM and network interface quotas, allowed VM SKUs (Standard_D4s_v3 required), allowed locations, denied resource types (Microsoft.Compute/virtualMachines), and managed-disk policy before the pentest is allowed to launch.
    • Tag enforcement support: if the subscription or resource group requires tag-value pairs or tag keys, they can be supplied in the Tags field during configuration to satisfy Azure policy.
    • Real-Time View provides live progress tracking and instant feedback on identified vulnerabilities as the pentest runs.

    5 details in Everything

20. docs update Aug 31, 2026 · issue 060

    NodeZero adds Azure Cloud Connection setup, enabling Azure tenant and subscription authorization for Azure Cloud Pentests.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Export all Azure subscription IDs as a CSV to bulk-upload during connection setup, avoiding manual ID entry for large environments.
    📍ResourceContainers | where type == microsoft.resources/subscriptions | project id = subscriptionId
    Navigate to the Azure Cloud Connection creation form in NodeZero Portal to start connecting your Azure tenant.
    📍In the NodeZero Portal, go to Pentests › Cloud Connections, click + Connection, select Azure, fill in Tenant Name and Tenant ID, add subscriptions (or upload a CSV with an id column), click Create Connection, then accept the Horizon3 Cloud Connector consent prompt in Azure as a Global Administrator.
    • New Pentests > Cloud Connections section in the NodeZero Portal lets practitioners create and manage Azure cloud connections for running Azure Cloud Pentests.
    • Supports adding Azure subscriptions via direct Subscription ID entry or by uploading a CSV file with a required id column header.
    • Tenant verification step reads Microsoft-verified domains from Microsoft Entra to confirm tenant ownership before granting access.
    • Permissions verification step confirms that the Horizon3 Cloud Connector Custom Role PowerShell script ran successfully and that the managed identity can authenticate.
    • After a verified connection, practitioners can launch an Azure Cloud Pentest directly with a Run Pentest button or add additional tenants via Add Another Tenant.

    +1 more show less

    • Provides a Check Again recovery path when admin consent polling times out, avoiding the need to restart the full connection flow.

    6 details in Everything

21. docs update Aug 31, 2026 · issue 060

    NodeZero adds Azure Cloud Pentest: assumed-breach assessment combining Azure API enumeration with an Internal Pentest, deployed via managed identity.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Use a read-only IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. posture audit by assigning the Reader role at launch, so NodeZero enumerates Azure resources without write-level attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
    📍In the NodeZero Portal, launch a new Azure Cloud Pentest › select your Cloud Connector (tenant) and target subscription › select the subnet with outbound internet access › set the subscription-level role to Reader › start the test.
    Run deeper gray-box testing by assigning Contributor at launch, giving NodeZero write-level Azure API attack surface in addition to directory enumeration via Global Reader.
    📍In the NodeZero Portal, launch a new Azure Cloud Pentest › select your Cloud Connector (tenant) and target subscription › select the subnet with outbound internet access › set the subscription-level role to Contributor › start the test.
    • New Azure Cloud Pentest type combines Azure API enumeration with an Internal Pentest in a single run, covering both cloud resources and workloads on Azure VMs — no on-premises infrastructure required.
    • NodeZero deploys a temporary Standard_D4s_v3 VM into a subscriber-selected subnet and authenticates via a managed identity, eliminating the need to inject long-lived Azure credentials.
    • A Horizon3 Cloud Connector Custom Role is provisioned with 28 permissions across Microsoft.Authorization, Microsoft.Compute, Microsoft.ManagedIdentity, Microsoft.Network, and Microsoft.Resources — the minimum needed to deploy and tear down the test VM.
    • Dynamic, just-in-time role assignment grants the managed identity Global Reader at the Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. tenant level and a subscriber-chosen subscription-level role (e.g., Reader, Contributor, or VM Contributor) only for the duration of the pentest, revoking both at teardown.
    • The RoleManagement.ReadWrite.Directory Entra ID application permission and Microsoft.Authorization/roleAssignments/write subscription permission are required for the Cloud Connector to perform just-in-time role assignment — both are flagged as high-privilege and surfaced in the consent modal for review before granting admin consent.

    +3 more show less

    • A Cloud Connector scopes to a single Azure tenant and can authorize multiple subscriptions within it; separate connectors are required for separate tenants.
    • The subscription selected at launch is the only subscription enumerated for Azure resources; Entra ID is always in scope at the tenant level.
    • NodeZero deploys resources into a resource group named H3-NodeZero-rg-[suffix] and automatically removes all four resources (VM, OS disk, network interface, user-assigned managed identity) when the pentest completes.

    8 details in Everything

22. docs update Aug 31, 2026 · issue 060

    NodeZero adds a WebApp test type for web application penetration testing.

    ⤢ ⤢ ⤢ ⤢
23. updated seen Aug 31, 2026 · issue 060

    NodeZero adds Azure Cloud Pentest and Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. support, including AD Password Audit capabilities.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Audit Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. passwords in your Azure Entra ID environment to identify weak or compromised credentials.
    📍In the NodeZero console, navigate to Azure Entra ID › AD Password Audit, connect your Azure tenant, and launch the audit.
    • New Azure Cloud Pentest capability lets practitioners set up an Azure connection, run cloud pentests, manage connections, and perform manual cleanup.
    • New AD Password Audit feature audits Active Directory passwords within Azure Entra ID.

    2 details in Everything

24. updated seen Aug 31, 2026 · issue 010

    NodeZero adds Azure Cloud Pentest and Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. support, including AD Password Audit capabilities.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Audit Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. passwords in your Azure Entra ID environment to identify weak or compromised credentials.
    📍In the NodeZero console, navigate to Azure Entra ID › AD Password Audit, connect your Azure tenant, and launch the audit.
    • New Azure Cloud Pentest capability lets practitioners set up an Azure connection, run cloud pentests, manage connections, and perform manual cleanup.
    • New AD Password Audit feature audits Active Directory passwords within Azure Entra ID.

    2 details in Everything

25. docs update Aug 19, 2026 · issue 050

    NodeZero Rapid Response exposes a GraphQL API for querying advisories, listing affected assets, annotating remediation status, and exporting data.

    ⤢ ⤢ ⤢ ⤢
26. updated seen Aug 19, 2026 · issue 050

    NodeZero adds a Rapid Response API for programmatic access to time-sensitive attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. intelligence.

    ⤢ ⤢ ⤢ ⤢
    • Introduces the Rapid Response API, enabling programmatic access to rapid-response findings and intelligence.

    1 detail in Everything

27. docs update Aug 17, 2026 · issue 048

    NodeZero WebApp Pentest launch page documented: AI-driven Extended Agents, user-registration crawling, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. IP allowlisting, and per-run request-rate control.

    ⤢ ⤢ ⤢ ⤢
    • Adds Extended Agents option to WebApp pentests, enabling AI-driven exploratory testing that dynamically selects application areas to investigate and designs its own follow-up requests — intended to surface business-logic flaws that rules-based testing misses.
    • Adds Enable User Registration check box so NodeZero can self-register test accounts through the application's registration flow, then feed those credentials into authenticated coverage expansion.
    • Adds Get IP before starting pentest check box for External WebApp pentests, causing NodeZero to pause before testing begins and email the source IP so it can be added to WAF or rate-limiter allowlists before the run resumes.
    • Adds Request Rate selector with Cautious and Balanced (default) levels to trade test duration against load on the target application.
    • Adds Runner selector for Internal WebApp pentests, letting practitioners choose an existing NodeZero Runner with network connectivity to the target application.

    +2 more show less

    • Exposes free, passive Run Enumeration test type to evaluate NodeZero coverage before committing a license to an attack test.
    • Adds Save as Template option on the pentest configuration page to preserve a specific run configuration for reuse in future tests.

    7 details in Everything

28. docs update Aug 17, 2026 · issue 048

    NodeZero adds a full Web Application pentest configuration surface: scoping, testing rules, credentials, and route discovery.

    ⤢ ⤢ ⤢ ⤢
    • New Inventory > Applications > Custom page serves as the central hub for managing WebApp configurations, test runs, and test results — including per-pentest coverage gaps via Last Tested links.
    • New Inventory > Applications > Potential Web Applications tab surfaces applications NodeZero discovered through prior pentests; clicking Designate and selecting Custom promotes them to the configurable Custom tab.
    • New Configure Custom Web Application flow lets practitioners define a web application by Name, Main URL (FQDN), Access Type (Yes - external, cloud to cloud or No - internal via runner), and Application Environment (Dev/Staging/Trial or Production).
    • New OpenAPI/Swagger Upload field accepts an endpoints specification in OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth./Swagger format (YAML or JSON) to seed route discovery with endpoints not linked in the application UI.
    • New Testing Rules section controls which routes and HTTP methods (GET, POST, PUT, DELETE, PATCH, TRACE, HEAD, OPTIONS) NodeZero tests; preset buttons Add Read-only Methods and Add All Methods auto-populate Includes; Application Environment selection pre-populates defaults automatically.

    +4 more show less

    • New Add a Custom Testing Rule option lets practitioners specify a method, host URL, and route pattern, then set the rule to Include or Exclude — enabling exclusion of specific routes from attack testing.
    • New Configure Credentials section supports credential types username/password, bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else., session cookie, and API-key header; supports SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. providers including Entra, Okta, Auth0, PingID, and Keycloak; supports TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.-based MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. via authenticator apps, uploaded QR code images, or backup codes.
    • New Test Connectivity button on the Main URL field verifies application reachability before saving configuration.
    • Exclusion rules take precedence over inclusion rules in Testing Rules, allowing practitioners to set broad Include presets and narrow Exclude exceptions for specific routes.

    9 details in Everything

29. docs update Aug 17, 2026 · issue 048

    NodeZero adds autonomous WebApp Pentest with authenticated crawling, attack execution, and proof-based findings across public and private apps.

    ⤢ ⤢ ⤢ ⤢
    • New WebApp Pentest test type autonomously crawls, authenticates, and attacks web applications, producing proof-based findings rather than unvalidated scanner assertions.
    • Supports both internet-reachable and private/VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.-gated applications via a NodeZero Runner with network connectivity to the target.
    • Accepts an optional endpoints specification in Swagger/OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. format to guide route discovery during test configuration.
    • Supports customer-supplied 2captcha or CapMonster credentials to improve coverage on applications that present CAPTCHA challenges.
    • Free, passive Enumeration test available under Pentests > + Pentest > WebApp to evaluate coverage before committing a license to an attack run.

    +5 more show less

    • Applications are configured and persisted as reusable objects under Inventory > Applications > Configure Custom Web Application, with per-run overrides set at pentest launch.
    • WebApp pentest results are exportable as PDF and CSV reports for external sharing.
    • Test scope covers URL query parameters, HTTP headers, key-value pairs in request bodies, and cookie values discovered during the crawl phase.
    • Attack phase chains and pivots across networks using every access path obtained during the test, mirroring sophisticated attacker behavior.
    • Follows NodeZero's existing RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. model — users with pentest permissions in an organization can launch WebApp tests subject to product and inventory controls.

    10 details in Everything

30. docs update seen Aug 6, 2026 · issue 037

    NodeZero Tripwires automatically place decoy files and credentials along critical attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. during pentests to enable early threat detection.

    ⤢ ⤢ ⤢ ⤢
    • Introduces NodeZero Tripwires, decoy files and credentials automatically deployed by NodeZero along critical attack paths during autonomous pentests — triggering an immediate alert if a malicious actor interacts with them.
    • Deploys up to two tripwires per asset during testing, placed at points where NodeZero has gained access via a Remote Access Tool (RAT) or direct file write.
    • Adds a Tripwires dashboard in the NodeZero Portal for visibility into deployed tripwires across your environment.
    • Tripwires are included in NodeZero Elite and Pro license packages and available as an add-on for other tiers.

    4 details in Everything

31. updated seen Aug 6, 2026 · issue 037

    NodeZero July 2026 adds flexible Tripwire deployment, AD enhancements, expanded Rapid Response coverage, and MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. security upgrades.

    ⤢ ⤢ ⤢ ⤢
    • More-flexible Tripwire deployment reduces reliance on the Remote Access Tool (RAT), cutting Endpoint Detection and Response (EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.) noise during deployments.
    • Expanded Rapid Response coverage adds exploitability testing for Cisco Unified Communications Manager, SonicWall SMA1000, Adobe ColdFusion, and ManageEngine ADAudit Plus.
    • Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. enhancements improve group enumeration, NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. posture assessment, and DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. detection.
    • MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server updates deliver stronger authentication, a streamlined toolset, and expanded documentation for safer integrations.
    • Vulnerability Management Hub adds port information and improved sorting for completed pentests.

    +1 more show less

    • MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. enhancements strengthen contract enforcement, asset allocation, and co-branding controls for managed service providermanaged service providerA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. environments.

    6 details in Everything

32. docs update seen Aug 6, 2026 · issue 037

    NodeZero 2026.07 adds flexible Tripwire deployment, AD enhancements, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. updates, and MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. controls

    ⤢ ⤢ ⤢ ⤢
    • More-flexible Tripwire deployment reduces reliance on the Remote Access Tool (RAT), cutting EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. noise from endpoint detection and responseendpoint detection and responseEndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. systems.
    • Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. enhancements improve group enumeration, NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. posture assessment, and DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. detection.
    • MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server updates deliver stronger authentication, a streamlined toolset, and expanded documentation for safer integrations.
    • Vulnerability Management Hub adds port information and improved sorting for completed pentests.
    • MSP enhancements strengthen contract enforcement, asset allocation, and co-branding controls.

    +1 more show less

    • Expands attack coverage to include critical vulnerabilities in Cisco Unified Communications Manager, SonicWall SMA1000, Adobe ColdFusion, and ManageEngine ADAudit Plus.

    6 details in Everything

33. api-docs-cfcbf60ea3eb seen Aug 5, 2026 · issue 036

    Horizon3 NodeZero exposes a public GraphQL API for automation and integration with the Horizon3 Portal.

    ⤢ ⤢ ⤢ ⤢
34. updated seen Aug 5, 2026 · issue 036
    ⤢ ⤢ ⤢ ⤢
    • External Pentest workflow rebuilt: reusable Scopes replace Asset Groups, with improved bulk asset management and uploads for large external attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
    • Rapid Response coverage added for Starlette/LiteLLM BadHost, Apache Solr, Palo Alto Networks PAN-OS, Nginx UI, Ivanti Sentry, Check Point Remote Access VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., Splunk Enterprise, Cisco Unified Communications Manager, and Squid.
35. docs update seen Aug 4, 2026 · issue 035

    NodeZero adds an MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. hosted by Horizon3 with OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly. auth and multi-user support.

    ⤢ ⤢ ⤢ ⤢
36. docs update seen Aug 4, 2026 · issue 035

    NodeZero Tripwires: honeytoken decoys deployed to high-risk assets to silently detect attacker activity.

    ⤢ ⤢ ⤢ ⤢
    • Introduces Tripwires, a honeytoken capability that deploys silent decoy credentials to assets flagged as high-risk by NodeZero autonomous pentest results — tokens communicate only when triggered, alerting Horizon3's cloud infrastructure.
    • Tripwires use real credentials generated by Horizon3 that blend into the network environment, making them attractive targets for attackers without generating noise until activated.

    2 details in Everything

37. updated seen Aug 4, 2026 · issue 035

    NodeZero June 2026: Rapid Response asset-level exploitability, Real-Time View redesign, and External Pentest Scopes rebuild

    ⤢ ⤢ ⤢ ⤢
    • Rapid Response now surfaces personalized asset-level exploitability status, remediation guidance, and verification feedback to distill vulnerability noise.
    • Real-Time View (RTV) redesigned with a visual timeline, event-log summaries, and granular event details with flexible filtering to help distinguish NodeZero testing from real attacks.
    • External Pentest rebuilt: replaces Asset Groups with reusable Scopes, improves bulk asset management and uploads, and enhances support for large external attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
    • MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. and license-management improvements let parent accounts manage clients' product access, asset allocations, and custom branding from a single pane.
    • Expanded Threat Actor Intelligence (Elite-tier feature) made available to Pro and Core accounts for a limited time.

    +14 more show less

    • Tripwires gains CSV export, credential rotation, and improved Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. validation.
    • Multi-tenant email notifications now include account names to help MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. and Enterprises triage alerts across subclients.
    • Cross-domain credential injection added for more realistic modeling and validation of multi-domain attacks.
    • Runner visibility upgraded with Command History, Credentials, and Past Pentests tabs.
    • FedRAMP HighFedRAMP HighA US federal authorization tier for cloud services, managed by GSA, certifying that a provider meets the strictest NIST 800-53 controls required to handle the most sensitive unclassified government data. customers can now access the Horizon3-hosted MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface..
    • New No Longer Found status added to the Vulnerability Management Hub (VMH), with enhanced sorting and filtering by Host, Weakness ID, and Downstream Impact.
    • Automated weakness retrieval added for Palo Alto Cortex XSOAR integration.
    • Expanded API support for subclient management.
    • NodeZero Federal external attack support enabled across all federal environments.
    • Linux privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. implants and NetBIOS support added for AD operations.
    • Pentest summaries redesigned with Sankey diagrams carrying CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. badges to highlight actively exploited vulnerabilities.
    • Co-Branding now supports downloading co-branded sample reports in groups and enforcing parent branding across child accounts.
    • Subclients can now draw from parent asset pools for more flexible MSP/MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. resource management.
    • Client deletion now returns scanned asset allocation to parent within 30 days (previously 60-day hold).

    19 details in Everything

38. NodeZero August 2026 Aug 2026 · release notes

    NodeZero adds WebApp & Azure Cloud pentests, AU data residency, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. extraction, and Rapid Response API docs.

    • Adds WebApp pentest for crawling and testing production, staging, and private web applications with authenticated workflows.
    • Introduces Azure Cloud pentest, an assumed-breach assessment combining Azure API enumeration with internal VM workload testing.
    • Extends the Action Log via a new Activity tab in both Real-Time View and post-operation results.
    • Adds an Artifacts tab to Activity and Real-Time views to distinguish NodeZero activity from malicious attacks.
    • Enables downloading Activity events in Open Cybersecurity Schema Framework (OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work.) format as CSV files via a new download option.

    +13 more show less

    • Launches dedicated Australian infrastructure (AU region) for portal access and pentest data residency.
    • Adds detection for expired SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS certificates (H3-2021-0025) and public self-signed certificates (H3-2021-0026) in RBEM.
    • Implements tiered port scanning for External Asset Discovery to improve host-discovery efficiency.
    • Enables authorized subdomain-takeover testing specifically for Amazon S3 buckets in External Asset Discovery.
    • Adds a dedicated Identity Details page for user and identity information.
    • Expands Windows credential collection to extract Kerberos tickets from memory during credential dumping.
    • Adds just-in-time (JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility.) Ticket-Granting Ticket (TGT) refreshes to improve authentication reliability during AD pentests.
    • Adds subnet details and pagination controls to the Impacts > Hosts tab in Attack Paths.
    • Adds a Sync Ticket button on Rapid Response asset detail views when ticketing integrations are configured.
    • Provides public API documentation for the Rapid Response endpoint to facilitate SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. and dashboard integration.
    • Shows a distinct empty-state view on the EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. tab when no EDR coverage is detected on target endpoints.
    • Allows deselecting AWS Credential Pivot in the Attack Configuration for supported tests.
    • Standardizes report timestamps to UTC format.

    18 details in Everything

39. updated seen Jul 13, 2026 · issue 014

    NodeZero June 2026: Rapid Response overhaul, Real-Time View redesign, and External Pentest rebuild with reusable Scopes

    └──▷ HOW TO FIND IT
    When an alert fires during an active pentest, use the redesigned Real-Time View timeline and event-log filters to quickly confirm whether activity is NodeZero-generated or a genuine threat actor.
    📍In the NodeZero Portal, open an active pentest and navigate to Real-Time View, then use the timeline scrubber and event-detail filters to isolate events by source and timestamp.
    • Adds asset-level exploitability status, personalized remediation guidance, and verification feedback to Rapid Response, reducing vulnerability noise.
    • Redesigns Real-Time View (RTV) with a visual timeline, event-log summaries, and granular event details to help distinguish NodeZero testing activity from real attacks.
    • Rebuilds External Pentesting to replace Asset Groups with reusable Scopes, with improved bulk asset management, uploads, and support for large external attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
    • Expands Rapid Response coverage to include Starlette/LiteLLM BadHost, Apache Solr, Palo Alto Networks PAN-OS, Nginx UI, Ivanti Sentry, Check Point Remote Access VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., Splunk Enterprise, Cisco Unified Communications Manager, and Squid.
    • Adds MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. license-management improvements enabling parent accounts to manage clients' product access, asset allocations, and custom branding more easily.

    5 details in Everything

40. NodeZero July 2026 Jul 2026 · release notes

    NodeZero July 2026 adds UTC Tripwire timestamps, AD group enumeration, NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. posture detection, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.-based DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers..

    • Tripwire alert timestamps are now in Coordinated Universal Time (UTC).
    • Added support for enumerating and storing Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. (AD) group information.
    • Added NTLM posture detection to identify domains where NTLM is disabled.
    • Replaced secretsdump-based DCSync detection with LDAP Access Control List (ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.) scanning.
    • Tripwires for AWS Credential File and MySQL Dump File no longer require the Remote Access Tool (RAT).

    +3 more show less

    • MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. now supports refreshing tokens to minimize manual sign-ins.
    • Scope configuration rejects bare public suffixes such as .co.uk and .ind.br.
    • Re-enabled Subdomain Takeover configuration option in NodeZero Portal.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The general-purpose MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server tool run_h3_graphql_request is deprecated in favor of new scoped tools.
41. NodeZero June 2026 Jun 2026 · release notes

    NodeZero June 2026 adds reusable Scopes for external pentesting, OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. export in Real-Time View, and Executive Summary PDF reports

    • Adds Scopes as reusable entities to replace legacy Asset Groups for defining external testing boundaries
    • Exports granular event logs from the Real-Time View (RTV) Event Metadata Table in OCSF (Open Cybersecurity Schema Framework) format
    • Adds a new Executive Summary Segmentation PDF report type accessible via the Portal
    • Allows bulk uploading of CSV or plain-text files for external asset management
    • Enables direct loading of large CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges (/16 through /32) in External Asset Management

    +1 more show less

    • Adds TGT (Ticket Granting Ticket) creation submodule to simulate AS-REQ exploitation and capture credentials

    6 details in Everything

42. NodeZero May 2026 May 2026 · release notes

    NodeZero May 2026 adds NetBIOS domain support for AD audits, Linux PE implants, and asset management enhancements.

    • Adds NetBIOS domain name support for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. auditing workflows and secretsdump operations
    • Adds new Linux privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. implant support for copy/fail techniques associated with CISA KEVs
    • Adds weakness alias badges within the Vulnerability Management Hub to improve identification and filtering of related weaknesses
    • Enables direct search within the Runner selection drop-down when launching operations
    • Allows MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. parent accounts to view and set contracted asset counts directly via the Asset Allocation modal

    +1 more show less

    • Adds an asset lock status badge to show temporary asset allocation restrictions in MSP interfaces

    6 details in Everything

43. NodeZero April 2026 Apr 2026 · release notes

    NodeZero April 2026 adds resume ops, co-branded group reports, 30-day client deletion, inventory exports and new attack content modules.

    • Adds the ability to resume interrupted pentests directly from the pentest detail page in the Portal UI.
    • Enables downloading co-branded sample reports in groups via the Portal UI.
    • Adds optional enforcement of parent account branding across child accounts in the Portal UI.
    • Allows parents to schedule deletion of a client to return scanned asset allocation in 30 days via the Portal’s Client Management page.
    • Adds support for selected items, IP ranges, and scopes in inventory CSV export capabilities.

    +4 more show less

    • Adds last external domain and last host tab fields to inventory data records.
    • Adds a new Oracle Cloud Infrastructure (OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant.) user permission enumeration module.
    • Adds support for DNS hostname enumeration on domain-joined Linux machines during internal operations.
    • Adds CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. badges on weaknesses in redesigned sankey diagrams within pentest summaries.

    9 details in Everything

44. NodeZero March 2026 Mar 2026 · release notes

    NodeZero adds ServiceNow VR sync, Tripwire CSV export, AD validation, ESC11 support and more.

    • Adds ServiceNow VR integration to synchronize NodeZero findings with ServiceNow Vulnerability Response
    • Adds CSV export for all Tripwire data including metadata fields such as name, type, file path, monitored processes, status, and deployment date
    • Adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. credential validation for Tripwire jobs against domain-joined systems
    • Adds utility to assist in rotating service account passwords for Tripwires
    • Adds ESC11 support within Active Directory Certificate Services (ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise.)

    +3 more show less

    • Adds SSH ControlMaster Hijack attack module targeting abuse of SSH ControlMaster sockets
    • Adds new Schedules tab to the Runner detail page
    • Adds faceted filtering by exit status and pagination controls to the Advanced Command Filtering Agent Commands view

    8 details in Everything

45. NodeZero February 2026 Feb 2026 · release notes

    NodeZero Feb 2026 adds LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext., cross-domain creds, VMH fields, HVT categories, and FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. access.

    • Adds MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. access at https://mcp.gov-horizon3ai.com/mcp for FedRAMP HighFedRAMP HighA US federal authorization tier for cloud services, managed by GSA, certifying that a provider meets the strictest NIST 800-53 controls required to handle the most sensitive unclassified government data. customers
    • Adds LDAPS support to internal attack modules for secure Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. enumeration
    • Adds new HVT categories and improved pattern matching for business risk identification
    • Allows injection of cross-domain credentials in Password Audit and internal pentests
    • Adds optional LLM action log to Pentest report downloads

    +4 more show less

    • Expands VMH API with port, protocol, and IP byte count fields plus clarified timestamps
    • Adds new filtering/sorting options across Pentests, VMH, and Results views (e.g. Kubernetes namespace, Operator version, Weakness ID)
    • Adds Command History, Credentials injection, and Past Pentests tabs to the Runner detail page
    • Allows MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. subclients to draw from parent asset pools

    9 details in Everything

46. NodeZero January 2026 Jan 2026 · release notes

    NodeZero 2026.01 adds No Longer Found VMH status, Cortex XSOAR fetch-incidents command, USER role subclient API access, and Federal external attack support

    • Adds "No Longer Found" status to Vulnerability Management Hub (VMH) for tracking remediated vulnerabilities
    • Adds fetch-incidents command to Palo Alto Cortex XSOAR integration for automated weakness retrieval
    • Extends authorization roles to allow the USER role to access subclient account endpoints via API
    • Enables NodeZero Federal external attack capabilities across all federal environments

    4 details in Everything

47. NodeZero December 2025 Dec 2025 · release notes

    NodeZero December 2025 adds Downstream Impact Type filter, Closed status in VMH, Federal cloud cracking, AD Tripwires archive, and new Rapid Response tests.

    • Adds Downstream Impact Type filter to the Vulnerability Management Hub to prioritize weaknesses by potential reach
    • Introduces a user-selectable Closed status in VMH for lifecycle tracking of remediated issues
    • Enables undoing a status update in VMH to correct accidental data entry errors
    • Adds a notes pop-up in the Group by Weakness ID view within VMH for quick context viewing/editing
    • Brings cloud-based hash cracking capabilities to NodeZero Federal environments

    +4 more show less

    • Exposes Threat Informed Perspectives as a new capability in NodeZero Federal
    • Enables Vulnerability Management Hub access for NodeZero Federal customers
    • Adds the ability to archive deleted domains directly from the Portal for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Tripwires
    • Updates AD Tripwires Portal UX flows to streamline updates for AD Agent and Event Collector components

    9 details in Everything

48. NodeZero November 2025 Nov 2025 · release notes

    NodeZero Nov 2025 adds VRI early access, AI-enriched HVT data, cloud cracking GA, and asset discovery optimization.

    • Adds Vulnerability Risk Intelligence solution with new weakness details and reporting capabilities
    • Adds CISA filters to the weaknesses table in Vulnerability Risk Intelligence
    • Highlights AI-enriched items with a genAI badge in the credentials table
    • Enables cloud cracking for all production operations in both US and EU regions
    • Optimizes External Asset Discovery with an 85% reduction in result set size and faster query times

    +1 more show less

    • Adds automatic massive ETL triggering for asset jobs when size estimates exceed defined thresholds

    6 details in Everything

49. NodeZero October 2025 Oct 2025 · release notes

    NodeZero October 2025 adds HVT/ADP simulation, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. GA, AD Tripwires, and SCCM TAKEOVER-1 support

    • Generally Available the Hosted Managed Control Plane (MCP) Server for automated orchestration.
    • Adds High-Value Targeting (HVT) and Advanced Data Pilfering (ADP) capabilities to simulate sophisticated asset targeting and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
    • Adds support for exploiting the TAKEOVER-1 misconfiguration in Microsoft SCCM to compromise managed machines.
    • Adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. credential support to key internal network attack modules.
    • Introduces Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. (AD) Tripwire capabilities with dedicated Tripwire Jobs navigation.

    +3 more show less

    • Allows bulk enable/disable of tripwires across multiple templates from the Templates overview page.
    • Adds new Rapid Response tests for critical vulnerabilities in Redis, Oracle EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives., and WatchGuard Fireware OS.
    • Improves Vulnerability Hub performance with 50% faster Weaknesses Over Time queries and optimized data tables.

    8 details in Everything

50. NodeZero September 2025 Sep 2025 · release notes

    NodeZero September 2025 adds a hosted MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server with OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly., EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. for all account types, and enhanced AD Tripwire diagnostics.

    • Adds the NodeZero MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) Server hosted by Horizon3.ai, enabling AI agents to integrate pentesting capabilities into agentic workflows with OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..1 authentication and multiple user support
    • Provisions EDR feature for all account types, including Flex and C+

    2 details in Everything

51. NodeZero August 2025 Aug 2025 · release notes

    NodeZero August 2025 adds Rapid Response coverage for Xerox, Fortinet, Citrix, CrushFTP, and AD Golden Ticket attacks.

    • Adds Rapid Response cards testing Xerox FreeFlow Core (CVE-2025-8356), Fortinet FortiSIEM (CVE-2025-25256), Citrix NetScaler ADC/Gateway (CVE-2025-7776), and CrushFTP (CVE-2025-54309)
    • Adds Golden Ticket technique support for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. cross-domain attacks
    • Expands domain trust enumeration capabilities in Active Directory attack content
    • Displays CVE aliases (e.g., CitrixBleed2) and H3 Weakness IDs in Rapid Response UI
    • Adds child of indicator in account settings to clarify MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. client hierarchy

    +2 more show less

    • Displays subclient assets directly on the asset page for MSP visibility
    • Adds Client Account column to the Templates page

    7 details in Everything

52. NodeZero July 2025 Jul 2025 · release notes

    NodeZero July 2025 adds Threat Actor mapping GA, Rapid Response tests for CitrixBleed 2 and others, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. GA, Jira integration, and Meta Flag.

    • Adds Threat Actor tab in Weakness Details to link pentest results to known adversary groups
    • Adds Pentest Summary Sankey Chart visualization for threat actor mapping
    • Adds Weakness Filtering to narrow views to specific adversaries
    • Highlights known threat actor CVE usage in attack chains via Attack Graph Integration
    • GA release of the MCP Server with Bring Your Own LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. support

    +6 more show less

    • Rapid Response tests for CitrixBleed 2 (CVE-2025-5777), PAN-OS GlobalProtect XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., Wing FTP, FortiWeb SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., CrushFTP, Infoblox NetMRI, and Flowise
    • Critical exploits for Microsoft SharePoint Toolshell, Cisco ISE, FortiWeb, and SonicWall SMA XSS
    • Rolls-up asset counts in Templates and Assets pages for parent accounts
    • Enables SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-only subclient access by allowing subclients to disable basic authentication
    • Adds Meta Flag for Loot & BloodHound enabling self-service subclient management
    • Enables direct Jira integration in the Vulnerability Management Hub via new tickets

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Not Vulnerable label in Rapid Response results renamed to Not Exploitable
    • !N-Day Test Results now titled Rapid Response Test Results
53. NodeZero June 2025 Jun 2025 · release notes

    NodeZero June 2025 adds Vulnerability Management Hub for prioritization and a Flex onboarding wizard via new UI workflows.

    • Adds the Vulnerability Management Hub to prioritize, verify, and remediate weaknesses.
    • Adds a guided Flex New User Wizard to create clients, runners, and pentests.
    • Adds bulk allocation and improved parent-level visibility for MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. accounts.

    3 details in Everything

54. NodeZero May 2025 May 2025 · release notes

    NodeZero adds Flex Access pay-as-you-go option, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. Tripwire deployment, aarch64 RAT support, and parent MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. resource visibility

    • Introduces Flex Access as a new pay-as-you-go entry point for one-time pentesting without continuous commitment.
    • Adds SMB-based deployment method for Tripwires to improve implant delivery reliability.
    • Extends RAT support to aarch64 Linux targets for post-exploitation.
    • Improves RAT deployment over SSH by evading noexec mount points during startup.
    • Enables MSP parent accounts to view subclient resources (API Keys, NodeZero Runners) without manual switching.

    5 details in Everything

55. NodeZero April 2025 Apr 2025 · release notes

    NodeZero April 2025 adds custom Tripwire job launching, MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. multi-tenant management, trial API keys, CLI env vars, and RBCDRBCDResource-based constrained delegation, an Active Directory setting controlling which accounts may act for users when accessing a particular service. An attacker who can change it may impersonate users. lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access..

    • Launches custom jobs for targeted sensor deployment via the Dashboard or Tripwires pages
    • Adds multi-tenant client management capabilities: move pentests between subclients, rename accounts, and reset passwords
    • Enables Trial users to generate API keys for testing integrations
    • H3 CLI now supports environment variables for scripting workflows
    • Validates certificate credentials with GenericAll or GenericWrite rights via Resource-Based Constrained DelegationResource-Based Constrained DelegationResource-based constrained delegation, an Active Directory setting controlling which accounts may act for users when accessing a particular service. An attacker who can change it may impersonate users. (RBCD)

    5 details in Everything

56. NodeZero March 2025 Mar 2025 · release notes

    NodeZero March 2025 adds MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. subclient management, Chrome/Okta cookie theft, Metasploit implant deployment, and runner IP reporting.

    • MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. can create and manage subclients to allocate Insights, Tripwires, and Rapid Response features in a single step.
    • Deleted subclients now trigger a 60-day asset lockout before reclamation, visible via a UI countdown timer.
    • NodeZero gains the ability to steal locked Chrome cookies and decrypt them offline.
    • Attackers can hijack valid Okta sessions using stolen and decrypted session cookies.
    • Post-exploitation implants can be deployed directly through a new Metasploit integration.

    +2 more show less

    • Runners now report their IP addresses to improve asset attribution, requiring an update via h3-cli.
    • Attack Graph visualizations now provide clearer vector tracing for exploit chains and lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access..

    7 details in Everything

57. NodeZero February 2025 Feb 2025 · release notes

    NodeZero February 2025 adds MTTR trends, CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. filtering, ZMap scan speed tuning, Shadow Credential attack content, and Add Once, Later scheduling.

    • Adds Mean-Time-To-Remediation (MTTR) trend charts in Insights for weaknesses that have been mitigated
    • Adds CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. filtering option in NodeZero Insights to display only CISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing CVEs confirmed to have been actively exploited in the wild, which cyber tools use as a high-signal prioritization feed for patching and scanning.
    • Adds Scan Options menu with Normal (1500 pps) and Slow (150 pps) ZMap scope discovery settings
    • Adds Shadow Credential Attack content leveraging GenericAll/GenericWrite permissions for privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources.
    • Adds Add Once, Later scheduling option for pentest templates to increase setup flexibility

    5 details in Everything

58. NodeZero January 2025 Jan 2025 · release notes

    NodeZero Jan 2025 adds PDF export for Insights, Azure Service Principal cert injection, and IVanti exploit content.

    • Insights data can now be exported into a document for executive reporting
    • Credential injection options have been added for Azure pentesting
    • Users can upload a CSV to define IP scope during pentest setup

    3 details in Everything

59. NodeZero December 2024 Dec 2024 · release notes

    NodeZero launches Insights dashboard; improves K8s workload detection and adds attack content for several critical CVEs

    • Introduces the NodeZero Insights product, a data analytics and management dashboard for monitoring security initiatives and compliance checklists.
    • Improves Kubernetes workload type identification accuracy during penetration testing assessments.
    • Adds attack content for CyberPanel Remote Code Execution vulnerability CVE-2024-51378.

    3 details in Everything

60. NodeZero November 2024 Nov 2024 · release notes

    NodeZero adds Kubernetes pentesting, Insider Threat scenarios, Azure MA privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., Slack token compromise, and new RAT access methods in November 2024 release.

    • Adds Kubernetes pentesting capability via the NodeZero K8s Operator for testing pods, nodes, clusters, and namespaces
    • Introduces the Insider Threat Pentest operational scenario allowing Windows AD credential injection during test setup
    • Adds privilege escalation within Azure environments using Automation Account Managed Identities with PowerShell runbook TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind.
    • Enables Slack token compromise upon endpoint breach, visible as H3-2024-0050 - Slack User Compromise with new impact type Third-Party SaaS User Compromise
    • Adds four new Remote Access Tool (RAT) implant access methods: Windows Management Instrumentation RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., Windows Remote Management RCE, PAN-OS-CVE-2024-0012, and PAN-OS-CVE-2024-9474

    5 details in Everything

61. NodeZero October 2024 Oct 2024 · release notes

    NodeZero adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Azure credential injection via Device Code Flow, Tripwires webhooks for Sentinel/Splunk, and new AWS/Azure attack content.

    • Adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. device authorization grant (Device Code Flow) to inject MFA-protected Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. credentials during an Entra ID Pentest
    • Adds webhook configurations on the Settings page for Tripwires data export to Microsoft Sentinel and Splunk Cloud
    • Tripwires is now available for MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Client and Sub-Client accounts with improvements to alerting and notifications UX
    • Adds capability to pilfer secrets, certificates, and keys from Azure KeyVault
    • Adds AWS Privilege Escalation Detection for three new weaknesses: Pass Role and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Run Instances (H3-2024-45), Pass Role and CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. Create Stack (H3-2024-43), and Pass Role, Lambda Create Function, and Lambda Invoke (H3-2024-44)

    5 details in Everything

62. NodeZero September 2024 Sep 2024 · release notes

    NodeZero adds Tripwires GA, hybrid-joined Azure pivot attacks, and K8s/S3 token discovery to the pentest engine.

    • Tripwires are now Generally Available, with support for AWS credential file, MySQL Dump file, and Windows Suspicious Process Monitor types
    • Pentest configuration page now includes an opt-in toggle to drop tripwires during execution
    • New Tripwires Management page allows viewing and managing dropped tripwires alongside pentest results
    • Tripwire alerts can be integrated with Splunk Cloud via configurable webhooks for event ingestion
    • Team members can now be granted access to the Tripwires feature through User Management

    +7 more show less

    • Main pentest page includes a 1CV badge and tooltip to identify 1-Click Verify pentests
    • Pentest summary page adds a summary table showing status and associated tests for 1CV pentests
    • Rapid Response tests support enhanced tagging and filtering options for faster retrieval
    • Weaknesses CSV export now includes Impact, Mitigations, and References columns
    • Hybrid-Joined Intune Device Exploitation allows pivoting from Azure to on-premise RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. on Windows, MacOS, and Linux devices using interactsh
    • Kubernetes Service Account token discovery now scans SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., NFS, and S3 file shares for exposed tokens
    • AWS Cognito exploit content expanded to target unauthenticated roles assigned IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions

    12 details in Everything

63. NodeZero August 2024 Aug 2024 · release notes

    NodeZero Aug 2024 adds team Rapid Response access, sample report co-branding, ReadOnlyAccess cloud connections with expiry, and RAT support for rapid tests

    • Adds Rapid Response toggle in User Management to grant alert visibility and email notifications to team members.
    • Enables co-branding of sample operation reports via a new menu option in the Sample Op viewer for MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs./MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions./C+ licenses.
    • Introduces a new Cloud Connection type using the ReadOnlyAccess AWS Managed Policy for inspecting S3 objects and Lambda functions.
    • Adds optional expiration settings to Cloud Connections to limit temporary access duration.
    • Adds configuration options for Rapid Response tests to support NodeZero RAT for deeper impact analysis.

    5 details in Everything

64. NodeZero July 2024 Jul 2024 · release notes

    NodeZero July 2024 adds AWS and Azure gray-box pentests, a new test category workflow, and attack content for GeoServer and WhatsUp Gold.

    • Introduces NodeZero AWS Pentest, a gray-box assessment using a read-only role to analyze AWS accounts
    • Introduces NodeZero Azure Entra ID Pentest, a gray-box pentest using injected Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. and privileged AD credentials for hybrid environment analysis
    • Adds a new Pentest Setup Workflow allowing selection across four categories: Infrastructure Attack Surface, Identity Attack Surface, Operational Scenario Testing, and Rapid Response
    • Enhances AWS analysis with Lambda Function Code Extraction to detect sensitive information like AWS credentials
    • Enhances AWS analysis with EC2 Instance User Data Extraction to analyze for sensitive information such as AWS keys

    5 details in Everything

65. NodeZero June 2024 Jun 2024 · release notes

    NodeZero adds Azure token pilfering via RAT, NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. endpoint checks, and exploits for SolarWinds, Ivanti, and more in v2024.06.

    • Office 365 Azure Token Pilfering: Expanding our RAT capabilities to capture Azure access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. from Office 365 applications, potentially escalating to serious compromises.
    • Enhanced Credential Leak Checks: Added sophisticated checks for exposed NTLM endpoints and a new classification for a Jupyter Windows Credential Leak.
    • SolarWinds and Ubiquiti Exploits: New exploits for SolarWinds Serv-U and Ubiquiti UniFi Video vulnerabilities, targeting critical infrastructures.
    • Azure AD Domain Admin Exploitation via Cloud KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. Trust: Node Zero now leverages Cloud Kerberos Trust to potentially elevate privileges in Azure AD.

    4 details in Everything

66. NodeZero May 2024 May 2024 · release notes

    NodeZero May 2024 adds Rapid Response Alert Center and custom scheduling templates

    • Adds Rapid Response Center in the Portal for early alerts and actionable intelligence on emerging threats.
    • Allows Org Admins to receive emails detailing affected assets by IP, Domain, or Hostname from the Rapid Response center.
    • Enables single-exploit deployment tests for emerging threats directly from the Rapid Response center.
    • Adds Phishing Sankey Chart and Pictogram Visualization to the Phishing Pentest Summary Page.
    • Expands Template Management UI with Weekly, Monthly, Quarterly, or Custom scheduling cadences.

    5 details in Everything

67. NodeZero April 2024 Apr 2024 · release notes

    NodeZero adds Rapid Response Alert Center, auto-injected Azure creds, and new attack modules for Kemp, Entra, IMDS, AWS RDS, GlobalProtect, MLFlow

    • Adds the Rapid Response Alert Center for early alerts and actionable intelligence on emerging threats.
    • Enables N-Day tests from an external perspective in Rapid Response Tests for External Pentests.
    • Makes Injected Credentials for Azure visible on the Real Time View (RTV) page.
    • Allows automatic injection of Azure credentials into scheduled pentests via a NodeZero Runner using Auto-Injected Azure Credentials.
    • Permits attaching a schedule to any template in the Schedule UI, requiring a Runner for internal-type templates.

    +7 more show less

    • Makes Auto-Injected Credentials visible and configurable in the Template Tab UI.
    • Adds attack content targeting Progress Kemp LoadMaster RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVE-2024-1212).
    • Adds support for forging Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. credentials via Entra Seamless SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Silver Ticket Attack using the AZUREADSSOACC$ account.
    • Adds capability to query Azure Instance Metadata Service (IMDS) with enhanced RAT capabilities.
    • Adds AWS RDS Database Enumeration, including default credential checks.
    • Adds testing support for GlobalProtect critical infrastructure protection (CVE-2024-3400).
    • Extends Fortinet Server SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. RCE Exploit to targets in version 7.2.X.

    12 details in Everything

68. NodeZero March 2024 Mar 2024 · release notes

    NodeZero March 2024 adds Rapid Response tests, AWS Lambda enumeration, faster AD audit and template UI

    • Adds Rapid Response Tests for internal pentests to surgically verify high-impact vulnerabilities through the Run a Pentest screen.
    • Enhances Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Password Audit performance, dumping NTDS secrets 10 times faster.
    • Adds AWS Lambda function enumeration for sensitive data like environment variable AWS keys.

    3 details in Everything

69. NodeZero February 2024 Feb 2024 · release notes

    NodeZero Feb 2024 adds sticky table headers, dashboard layout toggles, GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. cookie consent, new attack modules for Ivanti/GitLab/ConnectWise, Azure user creation, AWS metadat

    • Adds sticky table headers to the Portal UI for better readability in large data tables
    • Adds vertical and horizontal dashboard layout toggle under user settings
    • Adds GDPR-compliant cookie consent prompt for EU Portal instances
    • Enables NodeZero to create Azure users and elevate them to Global Admins

    4 details in Everything

70. NodeZero January 2024 Jan 2024 · release notes

    NodeZero adds Phishing Impact Test, vertical attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. display, and new credential filters.

    • Launches the Phishing Impact Test to measure potential phishing impact, starting with the most susceptible employees.
    • Adds a Vertical Display option for Attack Paths alongside Concise/Detailed views for clearer security narrative.
    • Adds Filter by Injected Creds and Filter by Phished Creds table filters in Impacts, Weaknesses, and Credentials tables.
    • Enhances External Asset Discovery to identify status and warnings for potentially unauthorized hosts.

    4 details in Everything

71. NodeZero November 2023 Nov 2023 · release notes

    NodeZero 2023.11 adds Azure Refresh/Access tokenAccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. auth, CSV exports for pentest data, Move Pentest UI action, and Cyanide H3N0 log suffix.

    • Allows authentication to Azure attack flows using Azure Refresh and Access Tokens.
    • Adds Move Pentest option in the pentest action menu to transfer pentests between accounts.
    • Enables downloading External IPs results as a CSV file.
    • Enables downloading AD Password Audit results as a CSV file.
    • Updates Cyanide machine name generation to include a static H3N0 suffix for log tracking.

    5 details in Everything

72. NodeZero October 2023 Oct 2023 · release notes

    NodeZero October 2023 adds auto-injected credentials for Runner scheduled operations and new attack content.

    • Adds automatic credential injection for regularly scheduled pentest operations using NodeZero Runners
    • Integrates Shodan's top 100 ports into the external host discovery TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. scan with an optimized timing profile
    • Improves Azure authentication to support both Azure Refresh and Azure Access Tokens
    • Refreshes the fix action report with a new table of contents for affected hosts

    4 details in Everything

73. NodeZero September 2023 Sep 2023 · release notes

    NodeZero adds phishing simulation test type, systemd auto-restart for Runner, protected data scanning, and expanded attack modules.

    • Adds the Phishing new test type to simulate internal phishing campaigns.
    • Enables registration of the NodeZero Runner as a system service using h3-cli and systemd for auto-restart on reboot.
    • Displays Protected Data results (US Passport Number, US Tax ID Number, Credit Card Number, ABA Routing Number, US Social Security Number) in the Data Tab during pentests.
    • Adds Azure VM Access attack content to list accessible VMs and attempt code execution or file access in Sharepoint/OneDrive with compromised credentials.
    • Adds AWS Database Enumeration to detail DynamoDB permissions associated with AWS users.

    +7 more show less

    • Adds Log4shell Implant Module effective against log4shell and general JNDI exploits including ColdFusion RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives..
    • Adds H2 Embedded Database Exploit module (H3-2023-0028) targeting misconfigurations in H2 embedded appliances.
    • Enhanced Password Spray modules now use usernames extracted from injected credentials.
    • Enables Filter by Signed/Not Signed option in the Certificates tab.
    • Adds sorting and filtering capabilities for the Pentests - Scheduled Group View.
    • Updates the Hosts Count card on the summary page to display Compromised / Total Hosts.
    • Adds Exposure Score summary to the Executive Summary PDF with Co-Branding Support.

    12 details in Everything

74. NodeZero August 2023 Aug 2023 · release notes

    NodeZero 2023.08 adds ShadowCoerce/DFSCoerce/Printerbug for PetitPotam, Phishing Impact Test, proxy support, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. beta, and new attack content.

    • Adds ShadowCoerce, DFSCoerce, and Printerbug coercion methods to leverage PetitPotam exploits
    • Introduces Phishing Impact Test (beta) to automatically capture and use credentials from phishing simulations
    • Shifts proxy configuration to the host's Docker layer, managed via the NodeZero helper script
    • Opens Single Sign-On (SSO) in open beta for paid accounts with OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.-compatible identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
    • Adds Modern and Light color themes and an updated navigation bar to the Portal UI

    +1 more show less

    • Adds attack content for Juniper Junos OS SRX Firewalls, cPanel, H2 Database, Adobe ColdFusion, and Metabase

    6 details in Everything

75. NodeZero July 2023 Jul 2023 · release notes

    NodeZero July 2023 adds new vulnerability detections and Remote Access Tool capabilities

    • Added detection and exploits for new weaknesses
    • Added new Remote Access Tool capabilities

    2 details in Everything

76. NodeZero June 2023 Jun 2023 · release notes

    NodeZero June 2023 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., AD Password Audit operation, RAT deployment, bulk asset authorization, Runner Management page, and BloodHound data collection.

    • Adds experimental Single Sign-On support using OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDC) to the NodeZero Portal
    • Introduces Password Audit as a new operation type for auditing Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. user password strength and similarity
    • Enables deployment of Remote Access Tools (RATs) during operations to conduct post-exploitation techniques like credential dumping
    • Adds bulk-authorization capability for External Assets via the Portal UI
    • Launches a dedicated Runner Management page in the Portal for controlling automated Docker container deployments

    +1 more show less

    • Collects and provides downloadable BloodHound data files following completed Pentest operations

    6 details in Everything

77. NodeZero May 2023 May 2023 · release notes

    NodeZero adds portal pentest scheduling, VirtualHost Kubernetes support, real-time credential status, and AWS IMDS injection.

    • Adds Pentest Scheduling in the Portal to configure future pentests directly via UI
    • Adds VirtualHost Support for Kubernetes modules
    • Adds Real-Time View status updates (Received, Confirmed) for injected credentials in External Pentests
    • Enables Real-Time View data for External Asset Discovery Operations
    • Adds new tab on the Asset Group page showing operations table with navigation to summaries or RTV

    +6 more show less

    • Adds new SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. button for Microsoft/Azure social sign-in on portal login
    • Adds new fields (Resources, Permissions, Cloud Provider, Cloud Service Name) to Data detail
    • Adds new fields (Host Names, OS, Subnet, HW, Device, Cloud Provider, Cloud Svc, Region) and Credentialed Access tab to Host detail
    • Adds attack capability to spray External Domain names for VirtualHost discovery (enabled via Attack Configuration)
    • Adds NodeZero check for IMDS (IMDSv1/v2) to harvest IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role credentials for AWS Role injection
    • Adds ability to refresh expired or expiring AWS keys in AWS Exec SSM and AWS Assume Roles modules

    11 details in Everything

78. NodeZero April 2023 Apr 2023 · release notes

    NodeZero April 2023 introduces Runners for agentless deployment, Network Enumeration operations, credential injection during pauses, and Host page enhancements.

    • Adds NodeZero Runners to enable automated deployment of NodeZero without needing to copy-paste the curl script
    • Adds Network Enumeration operation type for internal network attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. discovery without vulnerability exploitation
    • Adds ability to inject credentials immediately after scheduling a pentest and while a pentest is paused
    • Adds Download CSV Item to Fileshare and S3 Detail Pages

    4 details in Everything

79. NodeZero March 2023 Mar 2023 · release notes

    NodeZero March 2023 adds Veeam N-Day COA, bulk export for Impacts/Datastores, improved IP parsing and Quick Run template option.

    └──▷ HOW TO FIND IT
    Add complex IP ranges with mixed delimiters to a pentest scope
    📍192.168.0.0/24 192.168.1.0/26 192.168.0.128/25, 192.168.32.4/32 192.168.5.23
    • Added a Veeam N-Day COA (Course of Action) Card in Pentest Setup Modal to identify exploitable Veeam instances
    • Added Impacts and Datastores CSVs to bulk export archive
    • Enhanced IP parsing in pentest scopes to include newlines and comma-delimited input
    • Added Quick Run option for op templates in the new UI

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !New customers who sign up after April 1, 2023, will not have the Legacy Portal option
80. 2023.03 Mar 1, 2023 · release notes

    NodeZero 2023.03 enables new user experience by default

    └──▷ HOW TO FIND IT
    Access the updated UI upon logging in to use the latest attack simulation features
    📍Log into NodeZero console (UI enabled by default)
81. NodeZero February 2023 Feb 2023 · release notes

    NodeZero v2023.02 adds h3-cli for recurring pentest scheduling, external IP scoping, pause/resume ops, and new AWS/SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. detections.

    • Adds h3-cli command-line tool with support for scheduling pentests on a recurring basis via the H3 API
    • Adds ability to pause and resume pentest operations directly in the Portal UI
    • Adds External pentest IP Addresses to the scope configuration in the new user experience
    • Adds 1-Click-Verify for multiple weaknesses at once in the new user experience
    • Adds detection of AWS Cognito credentials in login forms (weakness H3-2022-0076) during External Operations

    +1 more show less

    • Adds discovery and enumeration of SMB credential files on NFS shares, SMB shares, and websites for credential pivoting

    6 details in Everything

82. NodeZero January 2023 Jan 2023 · release notes

    NodeZero adds ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account. exploitation, AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. command execution on EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., ManageEngine COA card, and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. detection.

    • Adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Certificate Services (ADCS) Privilege Escalation (ESC8) attack content for domain compromise via NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. relay to certificate enrollment web interfaces
    • Enables EC2 instance enumeration with injected/discovered credentials using SSM access for remote command execution on AWS EC2 instances
    • Adds New Manage Engine Course of Action (COA) card for testing ManageEngine SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Remote Code Execution weakness
    • Introduces detection and exploitation of Known Exploitable Vulnerabilities (KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) listed by CISA

    4 details in Everything