https://cybertoolchain.io/tools/horizon3-nodezero New releases and features in Horizon3 NodeZero, tracked by The Cyber Toolchain. en Wed, 04 Nov 2026 07:51:18 GMT https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Wed, 04 Nov 2026 07:51:18 GMT NodeZero adds Git repository reconstruction, SQL Server trusted-link testing, and Integration Router entity-type routing in its October 2026 release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Scope tests with a new `Scope > Exclude TCP Ports` option to protect fragile assets from specific TCP ports during a pentest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Control Nuclei scan intensity with a new `Nuclei Scan Intensity` (throttling) option to reduce load on sensitive targets. • Filter and route Integration Router workflows by entity type, letting you choose which entity types are sent to each destination. • External Asset Discovery now reconstructs exposed Git repositories from discovered attack surface and captures service banners on nonstandard ports for broader visibility. • NodeZero now tests Microsoft SQL Server trusted links as part of its attack surface coverage. • Azure tests now cover the contents of blobs and file shares inside Azure storage accounts and respect minimum runtimes. • Expanded target-app login now supports SSL VPNs and identity-gated portals, and maintains persistent authenticated sessions. • WebApp Pentest now uses AI agents constrained by guardrails, plus new Risk Assessment and Safety Overrides features to identify potentially risky routes for blocking or testing. • Engagement Reports now support filtering and sorting. • Subdomain discovery now offers more user control over scope. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Mon, 12 Oct 2026 08:07:54 GMT NodeZero gains network pivoting for external tests, CrowdStrike Falcon Next-Gen SIEM integration, and new WebApp pentest controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds network pivoting for external tests, enabling NodeZero to reach additional hosts discovered during an operation beyond the originally configured scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new integration with CrowdStrike Falcon Next-Gen SIEM. • Adds new on/off and rate-limiting options for Password Spray, credential pivoting, and post-exploitation attack configuration to minimize account lockouts. • Adds custom login field configuration and support for longer secrets in WebApp pentest operations. • Expands ServiceNow VR integration with additional matching fields for more-reliable interoperation. • Expands Integration Settings with broader search, filtering, and Activity Log details. • Adds clearer feedback in WebApp pentest when a Runner or read-only state limits an action. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Thu, 08 Oct 2026 00:05:33 GMT NodeZero adds a new integration with CrowdStrike Falcon Next-Gen SIEM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds integration with CrowdStrike Falcon Next-Gen SIEM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Tue, 06 Oct 2026 07:36:14 GMT NodeZero adds network pivoting for external tests, new attack config controls, and expanded WebApp pentest options in September 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds network pivoting for external tests, enabling NodeZero to pivot beyond the originally configured scope to include additional hosts discovered during an operation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new on/off and rate-limiting options for Password Spray, credential pivoting, and post-exploitation to control attack surface and minimize account lockouts. • Supports custom login fields and longer secrets in WebApp Pentest configuration, with clearer feedback when a Runner or read-only state limits an action. • Expands ServiceNow VR integration with additional matching fields for more-reliable interoperation. • Adds expanded search, filtering, and Activity Log details to Integration Settings. • Expands Rapid Response and attack coverage to include PaperCut, GeoTools and GeoServer, Oracle E-Business Suite, Microsoft SharePoint, Citrix NetScaler, and GitLab. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Tue, 01 Sep 2026 23:55:28 GMT NodeZero adds WebApp and Azure pentests, Australian data residency, Activity/Artifacts tabs, and expanded AD/Identity capabilities. • New WebApp pentest op type: crawl, discover, and test production, staging, and private web applications with authenticated workflows, automated route discovery, and proof-based findings. • New Azure Cloud pentest op type: assess Azure control planes and VM workloads in a single assumed-breach assessment combining Azure API enumeration with an Internal pentest. • New Activity & Artifacts tabs: the Action Log now extends from Real-Time View into post-op results, and both views gain a dedicated Artifacts tab to deconflict NodeZero activity from malicious attacks. • Australia data residency: platform traffic and pentest data can now be kept within the Australian region for data-sovereignty compliance. • New dedicated Identity Details view for Active Directory & Identity assessments. • Adds Kerberos ticket extraction during credential dumping in Active Directory assessments. • Safer authentication workflows in Active Directory & Identity ops. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Tue, 01 Sep 2026 23:55:28 GMT NodeZero adds WebApp and Azure pentests, Australian data residency, Activity/Artifacts tabs, and expanded AD/Identity capabilities. • New WebApp pentest op type: crawl, discover, and test production, staging, and private web applications with authenticated workflows, automated route discovery, and proof-based findings. • New Azure Cloud pentest op type: assess Azure control planes and VM workloads in a single assumed-breach assessment combining Azure API enumeration with an Internal pentest. • New Activity & Artifacts tabs: the Action Log now extends from Real-Time View into post-op results, and both views gain a dedicated Artifacts tab to deconflict NodeZero activity from malicious attacks. • Australia data residency: platform traffic and pentest data can now be kept within the Australian region for data-sovereignty compliance. • New dedicated Identity Details view for Active Directory & Identity assessments. • Adds Kerberos ticket extraction during credential dumping in Active Directory assessments. • Safer authentication workflows in Active Directory & Identity ops. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Mon, 31 Aug 2026 20:33:10 GMT NodeZero adds Azure Cloud Pentest and Azure Entra ID support, including AD Password Audit capabilities. • New Azure Cloud Pentest capability lets practitioners set up an Azure connection, run cloud pentests, manage connections, and perform manual cleanup. • New AD Password Audit feature audits Active Directory passwords within Azure Entra ID. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Mon, 31 Aug 2026 20:33:10 GMT NodeZero adds Azure Cloud Pentest and Azure Entra ID support, including AD Password Audit capabilities. • New Azure Cloud Pentest capability lets practitioners set up an Azure connection, run cloud pentests, manage connections, and perform manual cleanup. • New AD Password Audit feature audits Active Directory passwords within Azure Entra ID. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Wed, 19 Aug 2026 20:22:13 GMT NodeZero adds a Rapid Response API for programmatic access to time-sensitive attack surface intelligence. • Introduces the Rapid Response API, enabling programmatic access to rapid-response findings and intelligence. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Thu, 06 Aug 2026 13:14:03 GMT NodeZero July 2026 adds flexible Tripwire deployment, AD enhancements, expanded Rapid Response coverage, and MCP Server security upgrades. • More-flexible Tripwire deployment reduces reliance on the Remote Access Tool (RAT), cutting Endpoint Detection and Response (EDR) noise during deployments. • Expanded Rapid Response coverage adds exploitability testing for Cisco Unified Communications Manager, SonicWall SMA1000, Adobe ColdFusion, and ManageEngine ADAudit Plus. • Active Directory enhancements improve group enumeration, NTLM posture assessment, and DCSync detection. • MCP Server updates deliver stronger authentication, a streamlined toolset, and expanded documentation for safer integrations. • Vulnerability Management Hub adds port information and improved sorting for completed pentests. • MSP enhancements strengthen contract enforcement, asset allocation, and co-branding controls for managed service provider environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/api https://docs.horizon3.ai/api Wed, 05 Aug 2026 11:27:36 GMT Horizon3 NodeZero exposes a public GraphQL API for automation and integration with the Horizon3 Portal. • New public GraphQL API provides programmatic access to a subset of Horizon3 Portal functionality, enabling automation, integration, and advanced workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Wed, 05 Aug 2026 00:30:19 GMT • External Pentest workflow rebuilt: reusable Scopes replace Asset Groups, with improved bulk asset management and uploads for large external attack surfaces. • Rapid Response coverage added for Starlette/LiteLLM BadHost, Apache Solr, Palo Alto Networks PAN-OS, Nginx UI, Ivanti Sentry, Check Point Remote Access VPN, Splunk Enterprise, Cisco Unified Communications Manager, and Squid. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Tue, 04 Aug 2026 10:52:09 GMT NodeZero June 2026: Rapid Response asset-level exploitability, Real-Time View redesign, and External Pentest Scopes rebuild • Rapid Response now surfaces personalized asset-level exploitability status, remediation guidance, and verification feedback to distill vulnerability noise. • Real-Time View (RTV) redesigned with a visual timeline, event-log summaries, and granular event details with flexible filtering to help distinguish NodeZero testing from real attacks. • External Pentest rebuilt: replaces Asset Groups with reusable Scopes, improves bulk asset management and uploads, and enhances support for large external attack surfaces. • MSP and license-management improvements let parent accounts manage clients' product access, asset allocations, and custom branding from a single pane. • Expanded Threat Actor Intelligence (Elite-tier feature) made available to Pro and Core accounts for a limited time. • Tripwires gains CSV export, credential rotation, and improved Active Directory validation. • Multi-tenant email notifications now include account names to help MSPs and Enterprises triage alerts across subclients. • Cross-domain credential injection added for more realistic modeling and validation of multi-domain attacks. • Runner visibility upgraded with Command History, Credentials, and Past Pentests tabs. • FedRAMP High customers can now access the Horizon3-hosted MCP Server. • New `No Longer Found` status added to the Vulnerability Management Hub (VMH), with enhanced sorting and filtering by Host, Weakness ID, and Downstream Impact. • Automated weakness retrieval added for Palo Alto Cortex XSOAR integration. • Expanded API support for subclient management. • NodeZero Federal external attack support enabled across all federal environments. • Linux privilege escalation implants and NetBIOS support added for AD operations. • Pentest summaries redesigned with Sankey diagrams carrying CISA KEV badges to highlight actively exploited vulnerabilities. • Co-Branding now supports downloading co-branded sample reports in groups and enforcing parent branding across child accounts. • Subclients can now draw from parent asset pools for more flexible MSP/MSSP resource management. • Client deletion now returns scanned asset allocation to parent within 30 days (previously 60-day hold). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/ https://docs.horizon3.ai/release_notes/ Mon, 13 Jul 2026 10:07:08 GMT NodeZero June 2026: Rapid Response overhaul, Real-Time View redesign, and External Pentest rebuild with reusable Scopes • Adds asset-level exploitability status, personalized remediation guidance, and verification feedback to Rapid Response, reducing vulnerability noise. • Redesigns Real-Time View (RTV) with a visual timeline, event-log summaries, and granular event details to help distinguish NodeZero testing activity from real attacks. • Rebuilds External Pentesting to replace Asset Groups with reusable Scopes, with improved bulk asset management, uploads, and support for large external attack surfaces. • Expands Rapid Response coverage to include Starlette/LiteLLM BadHost, Apache Solr, Palo Alto Networks PAN-OS, Nginx UI, Ivanti Sentry, Check Point Remote Access VPN, Splunk Enterprise, Cisco Unified Communications Manager, and Squid. • Adds MSP license-management improvements enabling parent accounts to manage clients' product access, asset allocations, and custom branding more easily. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2026.06/ https://docs.horizon3.ai/release_notes/2026.06/ Mon, 01 Jun 2026 00:00:00 GMT NodeZero June 2026 adds reusable Scopes for external pentesting, OCSF export in Real-Time View, and Executive Summary PDF reports • Adds `Scopes` as reusable entities to replace legacy Asset Groups for defining external testing boundaries • Exports granular event logs from the Real-Time View (RTV) Event Metadata Table in OCSF (Open Cybersecurity Schema Framework) format • Adds a new Executive Summary Segmentation PDF report type accessible via the Portal • Allows bulk uploading of CSV or plain-text files for external asset management • Enables direct loading of large CIDR ranges (/16 through /32) in External Asset Management • Adds TGT (Ticket Granting Ticket) creation submodule to simulate AS-REQ exploitation and capture credentials Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2026.05/ https://docs.horizon3.ai/release_notes/2026.05/ Fri, 01 May 2026 00:00:00 GMT NodeZero May 2026 adds NetBIOS domain support for AD audits, Linux PE implants, and asset management enhancements. • Adds `NetBIOS` domain name support for Active Directory auditing workflows and secretsdump operations • Adds new Linux privilege escalation implant support for copy/fail techniques associated with CISA KEVs • Adds `weakness alias badges` within the Vulnerability Management Hub to improve identification and filtering of related weaknesses • Enables direct search within the Runner selection drop-down when launching operations • Allows MSP parent accounts to view and set contracted asset counts directly via the Asset Allocation modal • Adds an `asset lock status badge` to show temporary asset allocation restrictions in MSP interfaces Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2026.04/ https://docs.horizon3.ai/release_notes/2026.04/ Wed, 01 Apr 2026 00:00:00 GMT NodeZero April 2026 adds resume ops, co-branded group reports, 30-day client deletion, inventory exports and new attack content modules. • Adds the ability to resume interrupted pentests directly from the pentest detail page in the Portal UI. • Enables downloading co-branded sample reports in groups via the Portal UI. • Adds optional enforcement of parent account branding across child accounts in the Portal UI. • Allows parents to schedule deletion of a client to return scanned asset allocation in 30 days via the Portal’s Client Management page. • Adds support for selected items, IP ranges, and scopes in inventory CSV export capabilities. • Adds `last external domain` and `last host tab` fields to inventory data records. • Adds a new Oracle Cloud Infrastructure (OCI) user permission enumeration module. • Adds support for DNS hostname enumeration on domain-joined Linux machines during internal operations. • Adds CISA KEV badges on weaknesses in redesigned sankey diagrams within pentest summaries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2026.03/ https://docs.horizon3.ai/release_notes/2026.03/ Sun, 01 Mar 2026 00:00:00 GMT NodeZero adds ServiceNow VR sync, Tripwire CSV export, AD validation, ESC11 support and more. • Adds `ServiceNow VR integration` to synchronize NodeZero findings with ServiceNow Vulnerability Response • Adds CSV export for all Tripwire data including metadata fields such as name, type, file path, monitored processes, status, and deployment date • Adds Active Directory credential validation for Tripwire jobs against domain-joined systems • Adds utility to assist in rotating service account passwords for Tripwires • Adds ESC11 support within Active Directory Certificate Services (ADCS) • Adds SSH ControlMaster Hijack attack module targeting abuse of SSH ControlMaster sockets • Adds new `Schedules` tab to the Runner detail page • Adds faceted filtering by exit status and pagination controls to the Advanced Command Filtering Agent Commands view Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2026.02/ https://docs.horizon3.ai/release_notes/2026.02/ Sun, 01 Feb 2026 00:00:00 GMT NodeZero Feb 2026 adds LDAPS, cross-domain creds, VMH fields, HVT categories, and FedRAMP MCP access. • Adds `MCP Server` access at `https://mcp.gov-horizon3ai.com/mcp` for FedRAMP High customers • Adds LDAPS support to internal attack modules for secure Active Directory enumeration • Adds new `HVT categories` and improved pattern matching for business risk identification • Allows injection of cross-domain credentials in Password Audit and internal pentests • Adds optional `LLM action log` to Pentest report downloads • Expands VMH API with `port`, `protocol`, and `IP byte count` fields plus clarified timestamps • Adds new filtering/sorting options across Pentests, VMH, and Results views (e.g. Kubernetes namespace, Operator version, Weakness ID) • Adds Command History, Credentials injection, and Past Pentests tabs to the Runner detail page • Allows MSP subclients to draw from parent asset pools Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2026.01/ https://docs.horizon3.ai/release_notes/2026.01/ Thu, 01 Jan 2026 00:00:00 GMT NodeZero 2026.01 adds 'No Longer Found' VMH status, Cortex XSOAR fetch-incidents command, USER role subclient API access, and Federal external attack support • Adds `"No Longer Found"` status to Vulnerability Management Hub (VMH) for tracking remediated vulnerabilities • Adds `fetch-incidents` command to Palo Alto Cortex XSOAR integration for automated weakness retrieval • Extends authorization roles to allow the `USER` role to access subclient account endpoints via API • Enables NodeZero Federal external attack capabilities across all federal environments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.12/ https://docs.horizon3.ai/release_notes/2025.12/ Mon, 01 Dec 2025 00:00:00 GMT NodeZero December 2025 adds Downstream Impact Type filter, Closed status in VMH, Federal cloud cracking, AD Tripwires archive, and new Rapid Response tests. • Adds `Downstream Impact Type` filter to the Vulnerability Management Hub to prioritize weaknesses by potential reach • Introduces a user-selectable `Closed` status in VMH for lifecycle tracking of remediated issues • Enables undoing a status update in VMH to correct accidental data entry errors • Adds a notes pop-up in the "Group by Weakness ID" view within VMH for quick context viewing/editing • Brings cloud-based hash cracking capabilities to NodeZero Federal environments • Exposes Threat Informed Perspectives as a new capability in NodeZero Federal • Enables Vulnerability Management Hub access for NodeZero Federal customers • Adds the ability to archive deleted domains directly from the Portal for Active Directory Tripwires • Updates AD Tripwires Portal UX flows to streamline updates for AD Agent and Event Collector components Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.11/ https://docs.horizon3.ai/release_notes/2025.11/ Sat, 01 Nov 2025 00:00:00 GMT NodeZero Nov 2025 adds VRI early access, AI-enriched HVT data, cloud cracking GA, and asset discovery optimization. • Adds `Vulnerability Risk Intelligence` solution with new weakness details and reporting capabilities • Adds `CISA filters` to the weaknesses table in Vulnerability Risk Intelligence • Highlights AI-enriched items with a `genAI` badge in the credentials table • Enables cloud cracking for all production operations in both US and EU regions • Optimizes External Asset Discovery with an 85% reduction in result set size and faster query times • Adds automatic massive ETL triggering for asset jobs when size estimates exceed defined thresholds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.10/ https://docs.horizon3.ai/release_notes/2025.10/ Wed, 01 Oct 2025 00:00:00 GMT NodeZero October 2025 adds HVT/ADP simulation, MCP GA, AD Tripwires, and SCCM TAKEOVER-1 support • Generally Available the Hosted Managed Control Plane (MCP) Server for automated orchestration. • Adds High-Value Targeting (HVT) and Advanced Data Pilfering (ADP) capabilities to simulate sophisticated asset targeting and data exfiltration. • Adds support for exploiting the TAKEOVER-1 misconfiguration in Microsoft SCCM to compromise managed machines. • Adds NTLM credential support to key internal network attack modules. • Introduces Active Directory (AD) Tripwire capabilities with dedicated 'Tripwire Jobs' navigation. • Allows bulk enable/disable of tripwires across multiple templates from the Templates overview page. • Adds new Rapid Response tests for critical vulnerabilities in Redis, Oracle EBS, and WatchGuard Fireware OS. • Improves Vulnerability Hub performance with 50% faster 'Weaknesses Over Time' queries and optimized data tables. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.09/ https://docs.horizon3.ai/release_notes/2025.09/ Mon, 01 Sep 2025 00:00:00 GMT NodeZero September 2025 adds a hosted MCP server with OAuth 2.1, EDR for all account types, and enhanced AD Tripwire diagnostics. • Adds the NodeZero MCP (Model Context Protocol) Server hosted by Horizon3.ai, enabling AI agents to integrate pentesting capabilities into agentic workflows with OAuth 2.1 authentication and multiple user support • Provisions EDR feature for all account types, including Flex and C+ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.08/ https://docs.horizon3.ai/release_notes/2025.08/ Fri, 01 Aug 2025 00:00:00 GMT NodeZero August 2025 adds Rapid Response coverage for Xerox, Fortinet, Citrix, CrushFTP, and AD Golden Ticket attacks. • Adds Rapid Response cards testing Xerox FreeFlow Core (CVE-2025-8356), Fortinet FortiSIEM (CVE-2025-25256), Citrix NetScaler ADC/Gateway (CVE-2025-7776), and CrushFTP (CVE-2025-54309) • Adds Golden Ticket technique support for Active Directory cross-domain attacks • Expands domain trust enumeration capabilities in Active Directory attack content • Displays CVE aliases (e.g., `CitrixBleed2`) and H3 Weakness IDs in Rapid Response UI • Adds 'child of' indicator in account settings to clarify MSP client hierarchy • Displays subclient assets directly on the asset page for MSP visibility • Adds Client Account column to the Templates page Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.07/ https://docs.horizon3.ai/release_notes/2025.07/ Tue, 01 Jul 2025 00:00:00 GMT NodeZero July 2025 adds Threat Actor mapping GA, Rapid Response tests for CitrixBleed 2 and others, MCP Server GA, Jira integration, and Meta Flag. • Adds `Threat Actor` tab in Weakness Details to link pentest results to known adversary groups • Adds `Pentest Summary Sankey Chart` visualization for threat actor mapping • Adds `Weakness Filtering` to narrow views to specific adversaries • Highlights known threat actor CVE usage in attack chains via Attack Graph Integration • GA release of the `MCP Server` with Bring Your Own LLM support • Rapid Response tests for CitrixBleed 2 (CVE-2025-5777), PAN-OS GlobalProtect XSS, Wing FTP, FortiWeb SQLi, CrushFTP, Infoblox NetMRI, and Flowise • Critical exploits for Microsoft SharePoint Toolshell, Cisco ISE, FortiWeb, and SonicWall SMA XSS • Rolls-up asset counts in Templates and Assets pages for parent accounts • Enables SSO-only subclient access by allowing subclients to disable basic authentication • Adds `Meta Flag` for Loot & BloodHound enabling self-service subclient management • Enables direct Jira integration in the Vulnerability Management Hub via new tickets Breaking changes: • "Not Vulnerable" label in Rapid Response results renamed to "Not Exploitable" • N-Day Test Results now titled `Rapid Response Test Results` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.06/ https://docs.horizon3.ai/release_notes/2025.06/ Sun, 01 Jun 2025 00:00:00 GMT NodeZero June 2025 adds Vulnerability Management Hub for prioritization and a Flex onboarding wizard via new UI workflows. • Adds the Vulnerability Management Hub to prioritize, verify, and remediate weaknesses. • Adds a guided Flex New User Wizard to create clients, runners, and pentests. • Adds bulk allocation and improved parent-level visibility for MSP accounts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.05/ https://docs.horizon3.ai/release_notes/2025.05/ Thu, 01 May 2025 00:00:00 GMT NodeZero adds Flex Access pay-as-you-go option, SMB Tripwire deployment, aarch64 RAT support, and parent MSP resource visibility • Introduces `Flex Access` as a new pay-as-you-go entry point for one-time pentesting without continuous commitment. • Adds `SMB-based deployment method` for Tripwires to improve implant delivery reliability. • Extends RAT support to `aarch64` Linux targets for post-exploitation. • Improves RAT deployment over SSH by evading `noexec` mount points during startup. • Enables `MSP parent accounts` to view subclient resources (API Keys, NodeZero Runners) without manual switching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.04/ https://docs.horizon3.ai/release_notes/2025.04/ Tue, 01 Apr 2025 00:00:00 GMT NodeZero April 2025 adds custom Tripwire job launching, MSP multi-tenant management, trial API keys, CLI env vars, and RBCD lateral movement. • Launches `custom jobs` for targeted sensor deployment via the Dashboard or Tripwires pages • Adds multi-tenant client management capabilities: move pentests between subclients, rename accounts, and reset passwords • Enables Trial users to generate API keys for testing integrations • H3 CLI now supports environment variables for scripting workflows • Validates certificate credentials with GenericAll or GenericWrite rights via Resource-Based Constrained Delegation (RBCD) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.03/ https://docs.horizon3.ai/release_notes/2025.03/ Sat, 01 Mar 2025 00:00:00 GMT NodeZero March 2025 adds MSP subclient management, Chrome/Okta cookie theft, Metasploit implant deployment, and runner IP reporting. • MSPs can create and manage subclients to allocate Insights, Tripwires, and Rapid Response features in a single step. • Deleted subclients now trigger a 60-day asset lockout before reclamation, visible via a UI countdown timer. • NodeZero gains the ability to steal locked Chrome cookies and decrypt them offline. • Attackers can hijack valid Okta sessions using stolen and decrypted session cookies. • Post-exploitation implants can be deployed directly through a new Metasploit integration. • Runners now report their IP addresses to improve asset attribution, requiring an update via `h3-cli`. • Attack Graph visualizations now provide clearer vector tracing for exploit chains and lateral movement. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.02/ https://docs.horizon3.ai/release_notes/2025.02/ Sat, 01 Feb 2025 00:00:00 GMT NodeZero February 2025 adds MTTR trends, CISA KEV filtering, ZMap scan speed tuning, Shadow Credential attack content, and 'Add Once, Later' scheduling. • Adds `Mean-Time-To-Remediation` (MTTR) trend charts in Insights for weaknesses that have been mitigated • Adds CISA KEV filtering option in NodeZero Insights to display only CISA Known Exploited Vulnerabilities • Adds `Scan Options` menu with `Normal` (1500 pps) and `Slow` (150 pps) ZMap scope discovery settings • Adds `Shadow Credential Attack` content leveraging `GenericAll/GenericWrite` permissions for privilege escalation • Adds "Add Once, Later" scheduling option for pentest templates to increase setup flexibility Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2025.01/ https://docs.horizon3.ai/release_notes/2025.01/ Wed, 01 Jan 2025 00:00:00 GMT NodeZero Jan 2025 adds PDF export for Insights, Azure Service Principal cert injection, and IVanti exploit content. • Insights data can now be exported into a document for executive reporting • Credential injection options have been added for Azure pentesting • Users can upload a CSV to define IP scope during pentest setup Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.12/ https://docs.horizon3.ai/release_notes/2024.12/ Sun, 01 Dec 2024 00:00:00 GMT NodeZero launches Insights dashboard; improves K8s workload detection and adds attack content for several critical CVEs • Introduces the NodeZero Insights product, a data analytics and management dashboard for monitoring security initiatives and compliance checklists. • Improves Kubernetes workload type identification accuracy during penetration testing assessments. • Adds attack content for CyberPanel Remote Code Execution vulnerability CVE-2024-51378. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.11/ https://docs.horizon3.ai/release_notes/2024.11/ Fri, 01 Nov 2024 00:00:00 GMT NodeZero adds Kubernetes pentesting, Insider Threat scenarios, Azure MA privilege escalation, Slack token compromise, and new RAT access methods in November 2024 release. • Adds Kubernetes pentesting capability via the NodeZero K8s Operator for testing pods, nodes, clusters, and namespaces • Introduces the 'Insider Threat Pentest' operational scenario allowing Windows AD credential injection during test setup • Adds privilege escalation within Azure environments using Automation Account Managed Identities with PowerShell runbook TTPs • Enables Slack token compromise upon endpoint breach, visible as 'H3-2024-0050 - Slack User Compromise' with new impact type 'Third-Party SaaS User Compromise' • Adds four new Remote Access Tool (RAT) implant access methods: Windows Management Instrumentation RCE, Windows Remote Management RCE, PAN-OS-CVE-2024-0012, and PAN-OS-CVE-2024-9474 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.10/ https://docs.horizon3.ai/release_notes/2024.10/ Tue, 01 Oct 2024 00:00:00 GMT NodeZero adds MFA Azure credential injection via Device Code Flow, Tripwires webhooks for Sentinel/Splunk, and new AWS/Azure attack content. • Adds OAuth 2.0 device authorization grant (Device Code Flow) to inject MFA-protected Azure Entra ID credentials during an Entra ID Pentest • Adds webhook configurations on the Settings page for Tripwires data export to Microsoft Sentinel and Splunk Cloud • Tripwires is now available for MSP Client and Sub-Client accounts with improvements to alerting and notifications UX • Adds capability to pilfer secrets, certificates, and keys from Azure KeyVault • Adds AWS Privilege Escalation Detection for three new weaknesses: Pass Role and EC2 Run Instances (H3-2024-45), Pass Role and CloudFormation Create Stack (H3-2024-43), and Pass Role, Lambda Create Function, and Lambda Invoke (H3-2024-44) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.09/ https://docs.horizon3.ai/release_notes/2024.09/ Sun, 01 Sep 2024 00:00:00 GMT NodeZero adds Tripwires GA, hybrid-joined Azure pivot attacks, and K8s/S3 token discovery to the pentest engine. • Tripwires are now Generally Available, with support for AWS credential file, MySQL Dump file, and Windows Suspicious Process Monitor types • Pentest configuration page now includes an opt-in toggle to drop tripwires during execution • New Tripwires Management page allows viewing and managing dropped tripwires alongside pentest results • Tripwire alerts can be integrated with Splunk Cloud via configurable webhooks for event ingestion • Team members can now be granted access to the Tripwires feature through User Management • Main pentest page includes a '1CV' badge and tooltip to identify 1-Click Verify pentests • Pentest summary page adds a summary table showing status and associated tests for 1CV pentests • Rapid Response tests support enhanced tagging and filtering options for faster retrieval • Weaknesses CSV export now includes Impact, Mitigations, and References columns • Hybrid-Joined Intune Device Exploitation allows pivoting from Azure to on-premise RCE on Windows, MacOS, and Linux devices using interactsh • Kubernetes Service Account token discovery now scans SMB, NFS, and S3 file shares for exposed tokens • AWS Cognito exploit content expanded to target unauthenticated roles assigned IAM permissions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.08/ https://docs.horizon3.ai/release_notes/2024.08/ Thu, 01 Aug 2024 00:00:00 GMT NodeZero Aug 2024 adds team Rapid Response access, sample report co-branding, ReadOnlyAccess cloud connections with expiry, and RAT support for rapid tests • Adds `Rapid Response` toggle in User Management to grant alert visibility and email notifications to team members. • Enables co-branding of sample operation reports via a new menu option in the Sample Op viewer for MSP/MSSP/C+ licenses. • Introduces a new Cloud Connection type using the `ReadOnlyAccess` AWS Managed Policy for inspecting S3 objects and Lambda functions. • Adds optional expiration settings to Cloud Connections to limit temporary access duration. • Adds configuration options for Rapid Response tests to support NodeZero RAT for deeper impact analysis. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.07/ https://docs.horizon3.ai/release_notes/2024.07/ Mon, 01 Jul 2024 00:00:00 GMT NodeZero July 2024 adds AWS and Azure gray-box pentests, a new test category workflow, and attack content for GeoServer and WhatsUp Gold. • Introduces `NodeZero AWS Pentest`, a gray-box assessment using a read-only role to analyze AWS accounts • Introduces `NodeZero Azure Entra ID Pentest`, a gray-box pentest using injected Entra ID and privileged AD credentials for hybrid environment analysis • Adds a new `Pentest Setup Workflow` allowing selection across four categories: Infrastructure Attack Surface, Identity Attack Surface, Operational Scenario Testing, and Rapid Response • Enhances AWS analysis with `Lambda Function Code Extraction` to detect sensitive information like AWS credentials • Enhances AWS analysis with `EC2 Instance User Data Extraction` to analyze for sensitive information such as AWS keys Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.06/ https://docs.horizon3.ai/release_notes/2024.06/ Sat, 01 Jun 2024 00:00:00 GMT NodeZero adds Azure token pilfering via RAT, NTLM endpoint checks, and exploits for SolarWinds, Ivanti, and more in v2024.06. • Office 365 Azure Token Pilfering: Expanding our RAT capabilities to capture Azure access tokens from Office 365 applications, potentially escalating to serious compromises. • Enhanced Credential Leak Checks: Added sophisticated checks for exposed NTLM endpoints and a new classification for a Jupyter Windows Credential Leak. • SolarWinds and Ubiquiti Exploits: New exploits for SolarWinds Serv-U and Ubiquiti UniFi Video vulnerabilities, targeting critical infrastructures. • Azure AD Domain Admin Exploitation via Cloud Kerberos Trust: Node Zero now leverages Cloud Kerberos Trust to potentially elevate privileges in Azure AD. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.05/ https://docs.horizon3.ai/release_notes/2024.05/ Wed, 01 May 2024 00:00:00 GMT NodeZero May 2024 adds Rapid Response Alert Center and custom scheduling templates • Adds `Rapid Response Center` in the Portal for early alerts and actionable intelligence on emerging threats. • Allows Org Admins to receive emails detailing affected assets by IP, Domain, or Hostname from the Rapid Response center. • Enables single-exploit deployment tests for emerging threats directly from the Rapid Response center. • Adds `Phishing Sankey Chart` and `Pictogram Visualization` to the Phishing Pentest Summary Page. • Expands Template Management UI with `Weekly`, `Monthly`, `Quarterly`, or `Custom` scheduling cadences. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.04/ https://docs.horizon3.ai/release_notes/2024.04/ Mon, 01 Apr 2024 00:00:00 GMT NodeZero adds Rapid Response Alert Center, auto-injected Azure creds, and new attack modules for Kemp, Entra, IMDS, AWS RDS, GlobalProtect, MLFlow • Adds the `Rapid Response Alert Center` for early alerts and actionable intelligence on emerging threats. • Enables `N-Day tests` from an `external` perspective in `Rapid Response Tests for External Pentests`. • Makes `Injected Credentials for Azure` visible on the Real Time View (RTV) page. • Allows automatic injection of Azure credentials into scheduled pentests via a NodeZero Runner using `Auto-Injected Azure Credentials`. • Permits attaching a `schedule` to any template in the `Schedule UI`, requiring a Runner for internal-type templates. • Makes `Auto-Injected Credentials` visible and configurable in the `Template Tab UI`. • Adds attack content targeting Progress Kemp LoadMaster RCE (CVE-2024-1212). • Adds support for forging Entra ID credentials via Entra Seamless SSO Silver Ticket Attack using the `AZUREADSSOACC$` account. • Adds capability to query Azure Instance Metadata Service (IMDS) with enhanced RAT capabilities. • Adds AWS RDS Database Enumeration, including default credential checks. • Adds testing support for GlobalProtect critical infrastructure protection (CVE-2024-3400). • Extends Fortinet Server SQLi RCE Exploit to targets in version 7.2.X. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.03/ https://docs.horizon3.ai/release_notes/2024.03/ Fri, 01 Mar 2024 00:00:00 GMT NodeZero March 2024 adds Rapid Response tests, AWS Lambda enumeration, faster AD audit and template UI • Adds Rapid Response Tests for internal pentests to surgically verify high-impact vulnerabilities through the “Run a Pentest” screen. • Enhances Active Directory Password Audit performance, dumping NTDS secrets 10 times faster. • Adds AWS Lambda function enumeration for sensitive data like environment variable AWS keys. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.02/ https://docs.horizon3.ai/release_notes/2024.02/ Thu, 01 Feb 2024 00:00:00 GMT NodeZero Feb 2024 adds sticky table headers, dashboard layout toggles, GDPR cookie consent, new attack modules for Ivanti/GitLab/ConnectWise, Azure user creation, AWS metadat • Adds sticky table headers to the Portal UI for better readability in large data tables • Adds vertical and horizontal dashboard layout toggle under user settings • Adds GDPR-compliant cookie consent prompt for EU Portal instances • Enables NodeZero to create Azure users and elevate them to Global Admins Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2024.01/ https://docs.horizon3.ai/release_notes/2024.01/ Mon, 01 Jan 2024 00:00:00 GMT NodeZero adds Phishing Impact Test, vertical attack path display, and new credential filters. • Launches the 'Phishing Impact Test' to measure potential phishing impact, starting with the most susceptible employees. • Adds a Vertical Display option for Attack Paths alongside Concise/Detailed views for clearer security narrative. • Adds 'Filter by Injected Creds' and 'Filter by Phished Creds' table filters in Impacts, Weaknesses, and Credentials tables. • Enhances External Asset Discovery to identify status and warnings for potentially unauthorized hosts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2023.11/ https://docs.horizon3.ai/release_notes/2023.11/ Wed, 01 Nov 2023 00:00:00 GMT NodeZero 2023.11 adds Azure Refresh/Access token auth, CSV exports for pentest data, 'Move Pentest' UI action, and Cyanide 'H3N0' log suffix. • Allows authentication to Azure attack flows using Azure Refresh and Access Tokens. • Adds "Move Pentest" option in the pentest action menu to transfer pentests between accounts. • Enables downloading External IPs results as a CSV file. • Enables downloading AD Password Audit results as a CSV file. • Updates Cyanide machine name generation to include a static 'H3N0' suffix for log tracking. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2023.10/ https://docs.horizon3.ai/release_notes/2023.10/ Sun, 01 Oct 2023 00:00:00 GMT NodeZero October 2023 adds auto-injected credentials for Runner scheduled operations and new attack content. • Adds automatic credential injection for regularly scheduled pentest operations using NodeZero Runners • Integrates Shodan's top 100 ports into the external host discovery TCP scan with an optimized timing profile • Improves Azure authentication to support both Azure Refresh and Azure Access Tokens • Refreshes the fix action report with a new table of contents for affected hosts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2023.09/ https://docs.horizon3.ai/release_notes/2023.09/ Fri, 01 Sep 2023 00:00:00 GMT NodeZero adds phishing simulation test type, systemd auto-restart for Runner, protected data scanning, and expanded attack modules. • Adds the 'Phishing' new test type to simulate internal phishing campaigns. • Enables registration of the NodeZero Runner as a system service using `h3-cli` and `systemd` for auto-restart on reboot. • Displays 'Protected Data' results (US Passport Number, US Tax ID Number, Credit Card Number, ABA Routing Number, US Social Security Number) in the Data Tab during pentests. • Adds Azure VM Access attack content to list accessible VMs and attempt code execution or file access in Sharepoint/OneDrive with compromised credentials. • Adds AWS Database Enumeration to detail DynamoDB permissions associated with AWS users. • Adds Log4shell Implant Module effective against log4shell and general JNDI exploits including ColdFusion RCE. • Adds H2 Embedded Database Exploit module (H3-2023-0028) targeting misconfigurations in H2 embedded appliances. • Enhanced Password Spray modules now use usernames extracted from injected credentials. • Enables 'Filter by Signed/Not Signed' option in the Certificates tab. • Adds sorting and filtering capabilities for the 'Pentests - Scheduled Group View'. • Updates the 'Hosts Count' card on the summary page to display 'Compromised / Total Hosts'. • Adds 'Exposure Score' summary to the Executive Summary PDF with Co-Branding Support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2023.08/ https://docs.horizon3.ai/release_notes/2023.08/ Tue, 01 Aug 2023 00:00:00 GMT NodeZero 2023.08 adds ShadowCoerce/DFSCoerce/Printerbug for PetitPotam, Phishing Impact Test, proxy support, SSO beta, and new attack content. • Adds `ShadowCoerce`, `DFSCoerce`, and `Printerbug` coercion methods to leverage PetitPotam exploits • Introduces `Phishing Impact Test` (beta) to automatically capture and use credentials from phishing simulations • Shifts proxy configuration to the host's Docker layer, managed via the NodeZero helper script • Opens Single Sign-On (SSO) in open beta for paid accounts with OIDC-compatible identity providers • Adds 'Modern' and 'Light' color themes and an updated navigation bar to the Portal UI • Adds attack content for Juniper Junos OS SRX Firewalls, cPanel, H2 Database, Adobe ColdFusion, and Metabase Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2023.07/ https://docs.horizon3.ai/release_notes/2023.07/ Sat, 01 Jul 2023 00:00:00 GMT NodeZero July 2023 adds new vulnerability detections and Remote Access Tool capabilities • Added detection and exploits for new weaknesses • Added new Remote Access Tool capabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero https://docs.horizon3.ai/release_notes/2023.06/ https://docs.horizon3.ai/release_notes/2023.06/ Thu, 01 Jun 2023 00:00:00 GMT NodeZero June 2023 adds OIDC SSO, AD Password Audit operation, RAT deployment, bulk asset authorization, Runner Management page, and BloodHound data collection. • Adds experimental Single Sign-On support using OpenID Connect (OIDC) to the NodeZero Portal • Introduces `Password Audit` as a new operation type for auditing Active Directory user password strength and similarity • Enables deployment of Remote Access Tools (RATs) during operations to conduct post-exploitation techniques like credential dumping • Adds bulk-authorization capability for External Assets via the Portal UI • Launches a dedicated Runner Management page in the Portal for controlling automated Docker container deployments • Collects and provides downloadable BloodHound data files following completed Pentest operations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/horizon3-nodezero