Horizon3.ai Built an AI Hacker - Now 7,000 Companies Pay It to Break In

The most unsettling part of Horizon3.ai's origin story lasts seven minutes and 19 seconds. In an early test at a financial-services company, its software moved through the network and obtained Domain Administrator access. The bank had the modern security stack one would expect. According to Horizon3.ai, none of those tools raised an alarm. The products were present; the proof that they worked together was not.

That demonstration contains the whole company. Horizon3.ai does not primarily sell another catalog of possible flaws. Its NodeZero platform behaves like an attacker inside a customer's authorized environment, safely combines weak credentials, bad configurations and exploitable software into attack paths, and shows where those paths end. Then it tells the customer what to fix. After the repair, a button reruns the relevant attack to see whether the door is actually closed.

It is a modest workflow with an immodest label: Horizon3.ai calls NodeZero an AI hacker. Yet the useful distinction is less theatrical. Traditional vulnerability scanners are superb list makers. Human penetration testers are inventive but scarce, costly and usually booked for a point-in-time engagement. NodeZero occupies the broad strip between them - more active than a scanner, more repeatable than a consulting project.

The report was the first thing to fail

Horizon3.ai was founded in late 2019 by Snehal Antani, previously CTO at Splunk and CTO of the U.S. Joint Special Operations Command, and Anthony Pillitiere, a former deputy CTO in U.S. Special Operations. The broader founding team mixed offensive-security specialists, national-security veterans and enterprise engineers. Their diagnosis was blunt: organizations did not lack security tools. They lacked evidence that those tools stopped a realistic attack.

The old pentest cadence made the evidence problem worse. A consultant arrived once a year, spent days or weeks probing a snapshot of the network, and delivered a dense report. By the time every finding had an owner, the network had changed. Cloud accounts appeared. Credentials drifted. A patch altered an attack path. The expensive artifact remained correct about the past.

“We don't have a security tools problem; we have a security effectiveness problem.”Horizon3.ai, Series B announcement

What changed the founders' pitch was watching customers use the product again. Horizon3.ai said early teams moved from one annual pentest to as many as 16 in a month. Pillitiere called the “find, fix, verify” cycle the aha moment. A report was no longer the finish line. It was the middle of a loop.

A machine that shows its work

For an internal test, a customer starts a lightweight Docker host or virtual appliance. There is no persistent agent to scatter across every endpoint. External tests run from Horizon3.ai's cloud. NodeZero discovers reachable assets, chooses tactics, exploits permitted weaknesses, pivots when it finds credentials or trust relationships, and presents the activity in real time. Dedicated test infrastructure is ephemeral and isolated.

The interface answers a remediation question that severity scores often dodge: what is the smallest change that breaks the most dangerous paths? One insecure Java configuration might sit inside dozens of routes to critical systems. Fixing it can remove a large fraction of the reachable impact at once. The customer sees command output and proof of exploitation, not merely a red badge beside a CVE.

That model now spans internal and external networks, AWS, Azure, Kubernetes, Active Directory passwords, phishing impact and business-critical web applications. Rapid Response targets newly important vulnerabilities and checks whether customer assets are actually exploitable. Threat Informed Perspectives starts from a chosen foothold - a stolen SSO credential, for example - and measures blast radius and time to impact.

Tripwires is the clever extension. During a pentest, NodeZero learns which assets and credentials sit on attractive roads. It can place honeytokens there. If a real intruder later touches a fake AWS credential or tempting database dump, the decoy alerts the security team. The attack map becomes the alarm-placement plan.

The economics of attacking yourself

Horizon3.ai sells annual SaaS subscriptions, generally through custom quotes. Antani publicly described a benchmark of about $50 per covered asset per year for unlimited testing, although package, scope, geography and channel terms vary. Tripwires and Rapid Response are included in some tiers and sold as add-ons in others. The company also equips resellers, MSPs and MSSPs to wrap NodeZero in managed services, with multi-tenant administration and white-label reporting.

The economic claim becomes tangible in a disclosed M&A use case. A manufacturer ran 60 internal pentests across 38,000 hosts at target companies. Deployments averaged about 15 minutes, and the program cost less than half the price of a manual pentest per target organization. More important, each target could follow the repair instructions and verify the work before the acquirer inherited the network.

Investors followed the usage. Horizon3.ai raised $30 million in 2021, $40 million in 2023 and $100 million in 2025. In August 2026, NightDragon and NEA co-led a $250 million Series E at a valuation above $2 billion, up from $650 million at the prior round. The company said it would use the money to deepen its AI systems, expand globally and grow its partner channel. Days later, it committed $20 million specifically to partner-led growth.

Who trusts an autonomous intruder?

The customer roster is described more often by category than by logo: multinational banks, major healthcare networks, pharmaceutical and semiconductor manufacturers, critical-infrastructure operators, four Fortune 10 companies and the U.S. Defense Industrial Base. That discretion is unsurprising. Publicly announcing exactly how an offensive platform fits inside a sensitive network can defeat the mood.

Government adoption provides a harder credential. NodeZero Federal holds FedRAMP High authorization, and the platform is the offensive-security engine in the NSA Cybersecurity Collaboration Center's continuous autonomous penetration testing program for Defense Industrial Base suppliers. A product designed to attack production has crossed one of software's more cautious procurement thresholds.

The company is widening distribution rather than building every service itself. Pax8 puts NodeZero in front of MSPs in North America and Europe. World Wide Technology packages it into an infrastructure-readiness assessment. Brinqa links attack-path evidence to exposure management and remediation orchestration. Horizon3.ai also joined Anthropic's Project Glasswing, an effort focused on critical-infrastructure defense.

Where the robot should stop

Autonomous pentesting does not erase the human red team. A machine is strongest on repeatable terrain: checking networks, identities, cloud permissions and known techniques at a frequency no consulting calendar can match. A bespoke team remains valuable for novel research, social engineering, physical access, unusual business logic and the ambiguous judgment calls around a live adversary exercise.

Nor does more testing cure a weak operating model. If a company cannot assign owners, obtain maintenance windows or repair systemic identity and segmentation problems, daily tests will faithfully rediscover the same mess. If production testing cannot be authorized, the platform loses its central advantage. If a buyer needs a narrow certification artifact once a year, a focused human engagement may be simpler.

There is also a category problem. Pentera is the obvious direct comparison, while Picus, SafeBreach, AttackIQ, Cymulate and XM Cyber approach adjacent parts of validation and exposure management. Tenable, Qualys and Rapid7 live closer to scanning and vulnerability operations. Horizon3.ai's differentiation depends on keeping its promise of safe exploitation and useful prioritization as those categories converge.

The boring payoff is the good one

Horizon3.ai's marketing now leans into an “AI versus AI” future. The phrase helped frame a financing round, and the threat is not imaginary. But the current product does not need science-fiction attackers to justify itself. Networks change faster than annual assessments. Security teams drown in unranked findings. Executives confuse purchased controls with effective controls. Those are ordinary problems, and NodeZero gives them a mechanical answer.

The company's sharpest idea is not that a machine can hack. It is that a defensive program should be able to show its homework repeatedly. Attack, repair, retest. Horizon3.ai took a dramatic craft, found the routine inside it, and turned that routine into software. The robot gets the billing. The repeat button built the business.