How much does Horizon3.ai cost?

List prices in US dollars per asset on the packaging page. NodeZero Flex (episodic) is $15 per asset each time it is tested, on a 12 month term with no add ons. Core (continuous) is $50, Pro (adds Tripwires and Rapid Response) $65 and Elite (adds risk based exposure management and vulnerability prioritization) $85 per asset, with unlimited pentests and each asset counted once per 12 months. NodeZero WebApp Flex is $10,000 per app from a 12 month prepaid pool, and WebApp Continuous is priced per app on request. Standard support is included, Enhanced is 10% of the annual subscription ($7,500 a year minimum) and Premier 20% ($25,000 a year minimum). Every package is bought through a quote.

What are the best alternatives to Horizon3.ai?

Based on documented capability coverage across the Agentic Index 14 point taxonomy, the closest alternatives to Horizon3.ai among security and SOC agents are Qevlar AI, Idira, Okta, Operant AI. Each is graded on the same public evidence, and no vendor pays for placement.

Does Horizon3.ai support MCP and tool calling?

Full under the Agentic Index verification standard. Horizon3.ai publishes public evidence of Model Context Protocol (MCP) support, tool calling, and API or SDK extensibility for connecting agents to external tools. Evidence basis: Outside systems reach NodeZero through a GraphQL API and h3-cli. Horizon3 also hosts an MCP server with regional endpoints in the US, EU, AU and FedRAMP High, OAuth 2.1 and six enumerated tools, and through setup_pentest_scope it can start. Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Does Horizon3.ai have SOC 2, SSO and role based access control?

Full under the Agentic Index verification standard. Horizon3.ai publishes public evidence of enterprise security and identity controls, covering a compliance posture such as SOC 2 or ISO 27001, single sign on (SSO or SAML), and role based access control (RBAC). Evidence basis: NodeZero Federal runs in a FedRAMP High environment, and Horizon3 holds Cyber Essentials Plus certification covering its NodeZero EU network on AWS. Across the platform, OIDC single sign on works with Okta, Entra ID, Google, Ping and Keyclo. Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Can Horizon3.ai be self hosted or run in a private VPC?

Full under the Agentic Index verification standard. Horizon3.ai publishes public evidence of self hosted or private VPC deployment, along with data residency options for controlling where agent data is processed and stored. Evidence basis: Internal tests run from a NodeZero host in the customer environment, as an OVA or VHD VM, in Docker or on a Linux host, with NodeZero Runner for distributed testing. The platform has named US, EU, AU and FedRAMP High environments, and the E. Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Back to vendors

Horizon3.ai

Q: Who is Horizon3.ai for?

enterprise security teams, federal and government agencies (FedRAMP High), healthcare, finance, and manufacturing organizations, MSSPs and offensive security teams

Also known as: Horizon3, NodeZero, NodeZero Federal

Visit site

Security / SOC agentindependentVerified 2026-10-24

Entry priceFrom $15 per asset per test on Flex. Core $50, Pro $65 and Elite $85 per asset a year with unlimited testing. WebApp Flex $10,000 per app.Full pricing detail

NodeZero autonomous penetration testing across internal, external, cloud, Kubernetes and web app surfaces, with proven attack paths, daily scheduling, Quick Verify retests, a GraphQL API, a hosted MCP server and a FedRAMP High environment for federal use. List prices per asset, from $15 a test on Flex and $50 a year on Core.

Horizon3.ai makes NodeZero, an autonomous penetration testing platform that runs real attack techniques against a customer's environment without installed agents. NodeZero navigates the network without scripts, compromises credentials, moves laterally and escalates privilege, chaining weaknesses with hundreds of offensive tools into proven attack paths, each delivered with a step by step summary and proof of the exploit.

Operations cover internal, external, cloud (AWS and Azure), Kubernetes and web application pentesting, Active Directory password audits, phishing impact testing and Tripwires, which raise alerts when attackers touch planted decoys. Customers set scope and attack configuration, can schedule pentests to run every day without intervention, watch tests in RealTime View, and retest fixes with Quick Verify. Internal tests run from a NodeZero host inside the customer's network.

The platform has US, EU and AU environments, the EU one a data sovereignty site in Germany covered by Cyber Essentials Plus certification, and NodeZero Federal runs in a FedRAMP High environment. NodeZero pushes findings to Splunk, Microsoft Sentinel, CrowdStrike Falcon Next-Gen SIEM, Jira and ServiceNow, and offers a GraphQL API, the h3-cli and a hosted MCP server whose tools read pentest results and can start a new pentest. The platform supports OIDC single sign on and role based user access.

It is sold in four packages with list prices per asset, from Flex at $15 per asset each time it is tested to Core, Pro and Elite at $50, $65 and $85 per asset a year with unlimited testing, and web app pentesting starts at $10,000 per app.

Vendor details

Canonical URL

https://horizon3.ai

Funding status

Founded 2019 by CEO Snehal Antani and former industry and U.S. National Security veterans; Inc. 5000 fastest-growing company; NodeZero is FedRAMP High Authorized (NodeZero Federal) and trusted by global governments, Fortune 10 enterprises, and major healthcare providers; hundreds of thousands of autonomous tests performed

Company status

independent

Use cases & customers

Primary use cases

continuous autonomous internal and external penetration testingcloud pentesting across AWS and AzureActive Directory password audits and credential-exposure testingweb application pentesting across app, identity, and infrastructureremediation verification with a find, fix, verify loop

Target customers

enterprise security teamsfederal and government agencies (FedRAMP High)healthcare, finance, and manufacturing organizationsMSSPs and offensive security teams

Deployment options

SaaS with US, EU (a data sovereignty site in Germany) and AU environmentsNodeZero host in the customer environment (OVA or VHD VM, Docker, Linux) and NodeZero RunnerNodeZero Federal in a FedRAMP High environment

Integrations

Pushes findings and Tripwire alerts to Splunk Cloud, Microsoft Sentinel and CrowdStrike Falcon Next-Gen SIEM, and tickets to Jira and ServiceNow; BloodHound integration; GraphQL API, h3-cli and a Horizon3-hosted MCP server (US, EU, AU and FedRAMP High endpoints, OAuth 2.1).

In practice

Your security team can afford only one outside pentest a year. You schedule NodeZero to run internal pentests every day from a host inside your network, and each proven attack path arrives with a step by step summary and proof of the exploit.

After patching a batch of critical findings, you need proof the fixes worked. You run Quick Verify against the earlier pentest, and the trends view shows which weaknesses are now closed.

A federal agency needs autonomous pentesting inside a FedRAMP High boundary. It runs NodeZero Federal, sends findings to Microsoft Sentinel or Splunk Cloud, and opens tickets for the fixes in ServiceNow.

Sources & related URLs

Research sources

https://horizon3.ai/ https://horizon3.ai/nodezero/ https://horizon3.ai/nodezero/internal-pentesting/ https://horizon3.ai/use-case/packaging/ https://horizon3.ai/news/

Agentic Index coverage score

8.5 / 14 capabilities · 61%

Integrations & Tool Calling	Full
Against the customer's network, cloud and applications, NodeZero orchestrates hundreds of offensive tools. Findings and Tripwire alerts flow to SIEMs (Splunk Cloud, Microsoft Sentinel and CrowdStrike Falcon Next-Gen SIEM), and tickets go to Jira and ServiceNow. Sourcedocs.horizon3.ai/portal/settings/integrations/crowdstrikeread 2026-09-28
Workflow Orchestration	Partial
One agent drives the attack. NodeZero navigates the network without scripts and chains weaknesses using hundreds of offensive tools, following its own attack logic. The pipeline is fixed. The customer sets scope, attack configuration and schedules but does not build the flow, and there are no other agents. Sourcehorizon3.ai/nodezeroread 2026-09-28
Knowledge Grounding & RAG	Partial
Each pentest maps the customer's hosts, services, credentials and attack paths, with BloodHound integration and high value targeting, building a fresh map of the estate on each run. There is no maintained retrieval structure the agent draws on, and Horizon3's corpus of past tests is its own, not the customer's. Sourcedocs.horizon3.airead 2026-09-28
Human Oversight & Guardrails	Partial
Customers set scope and attack configuration and monitor tests in RealTime View, and each test runs on isolated infrastructure that is used once. There is no approval step before NodeZero exploits or moves. When a pentest is started through MCP, the tool asks the assistant to confirm, a check that lives in the client, not in NodeZero. Sourcehorizon3.ai/nodezeroread 2026-09-28
Security, Identity & Governance	Full
NodeZero Federal runs in a FedRAMP High environment, and Horizon3 holds Cyber Essentials Plus certification covering its NodeZero EU network on AWS. Across the platform, OIDC single sign on works with Okta, Entra ID, Google, Ping and Keycloak, alongside user roles and access roles. Sourcedocs.horizon3.ai/portal/settings/sso and horizon3.ai/newsread 2026-10-24
Observability & Auditability	Full
RealTime View shows the state of a running test. Each proven attack path comes with a step by step summary and proof of the exploit, so the agent's own actions can be read in sequence, and statistics for each pentest are also exposed through the API and MCP. Sourcehorizon3.ai/nodezeroread 2026-09-28
Memory & State Persistence	Partial
Quick Verify tests prior findings again against earlier pentests, and a trends view tracks impacts and open weaknesses over time, so state carries between runs. There is no agent memory with a stated scope and lifetime, and learning from past tests is Horizon3's own claim. Sourcehorizon3.ai/nodezeroread 2026-09-28
Deployment & Data Residency	Full
Internal tests run from a NodeZero host in the customer environment, as an OVA or VHD VM, in Docker or on a Linux host, with NodeZero Runner for distributed testing. The platform has named US, EU, AU and FedRAMP High environments, and the EU environment is a data sovereignty site in Germany. Sourcedocs.horizon3.ai and horizon3.ai/newsread 2026-10-24
Prebuilt Agents, Templates & Packs	Partial
NodeZero ships with prebuilt operations covering internal, external, cloud, Kubernetes and WebApp pentests, AD password audits, phishing impact and Tripwires, plus attack configuration templates. These are operation types for the one agent, not separately named agents. Sourcehorizon3.ai/nodezeroread 2026-09-28
Triggers & Channel Coverage	Full
Pentests can be scheduled "to run every day thereafter" without user intervention, also through the CLI. Tripwires raise alerts when triggered, and Rapid Response sends threat notifications. Sourcehorizon3.ai/nodezeroread 2026-09-28
Model Flexibility & Routing	Not documented
Customers have no model choice or routing, and NodeZero's reasoning is internal. Sourcedocs.horizon3.airead 2026-09-28
APIs, SDKs & MCP Extensibility	Full
Outside systems reach NodeZero through a GraphQL API and h3-cli. Horizon3 also hosts an MCP server with regional endpoints in the US, EU, AU and FedRAMP High, OAuth 2.1 and six enumerated tools, and through setup_pentest_scope it can start a new pentest. Sourcedocs.horizon3.ai/portal/features/mcp/toolsread 2026-09-28
Testing, Debugging & Optimization	Not documented
Testing here points at the customer's estate, which NodeZero tests and whose fixes it verifies. There is no way to test or evaluate the agent itself. Sourcehorizon3.ai/nodezeroread 2026-09-28
Browser & Computer Use	Not documented
NodeZero attacks networks, cloud and applications through offensive tooling, and there is no browser or computer use. Sourcehorizon3.ai/nodezeroread 2026-09-28

The Agentic Index coverage score grades every vendor Full, Partial or Not documented against the same 14 buyer facing capabilities, from public evidence only. Each capability links to how all vendors in the index score on it. How this evidence is graded

Product updates

September 15, 2026·IntegrationsVerified

Horizon3 released an integration that sends validated NodeZero pentest findings into CrowdStrike Falcon Next-Gen SIEM for correlation.

Bears on: Observability / auditability

View source

View all Horizon3.ai updates →Tracked since Sep 2026 · Verified from public vendor sources

Pricing

From $15 per asset per test on Flex. Core $50, Pro $65 and Elite $85 per asset a year with unlimited testing. WebApp Flex $10,000 per app.

Assets tested. Flex counts each asset every time it is tested, while Core, Pro and Elite count each asset once per 12 months. WebApp testing is priced per app.

Trial available

What is public

List prices per asset for all four packages, the WebApp Flex price per app, and the premium support percentages and minimums are public. Asset counts, any minimum purchase and trial terms are not.

Cost watchouts

Premium support adds 10% (Enhanced, $7,500 a year minimum) or 20% (Premier, $25,000 a year minimum) of the annual subscription, a designated support engineer is $50,000 a year, and web app testing is priced separately per app.

Variable cost rationale

The bill scales with the number of assets NodeZero identifies, and on Flex with how often each is tested. Core, Pro and Elite count each asset once a year however often it is tested.

Sales call required

Yes, required for paid access

Free / trial

No free tier or trial terms on the packaging page; demo available.

Lowest paid plan

NodeZero Flex, $15 per asset per test on a 12 month term.

Key ambiguities

No minimum asset count or minimum purchase is published, so a monthly entry figure cannot be worked out. The bill follows the number of assets NodeZero finds, and every package is bought through a quote.

Agentic Index verified 2026-10-24

Official pricing page

Related vendors

Alternatives to Horizon3.ai

The closest documented capability profiles to Horizon3.ai among security and SOC agents tracked by Agentic Index, ordered by similarity on the same 14 point evidence the rankings use. No vendor pays for placement.

Qevlar AI8.5 / 14Matches Horizon3.ai across all 14 documented capabilities
Idira8.0 / 14A lighter documented profile than Horizon3.ai
Okta8.5 / 14Fuller documented coverage on Human Oversight & Guardrails
Operant AI7.5 / 14A lighter documented profile than Horizon3.ai
HiddenLayer9.0 / 14Adds documented Testing, Debugging & Optimization
XBOW9.0 / 14Adds documented Browser & Computer UseHorizon3.ai vs XBOW →Video

Similarity is computed from each vendor's Agentic Index coverage score evidence, axis by axis, not from the totals. How this evidence is graded

Compare Horizon3.ai with other vendors →Compare all security and SOC agents →See where Horizon3.ai ranks →

Data confidence: high

Head to head

Horizon3.ai vs XBOWVideo