SwarmAttacker vs NodeZero

NodeZero is the autonomous pentesting platform of Horizon3.ai, a US company founded in 2019. It runs production-safe attacks against a customer's live environment from an assumed-breach position across internal networks, Active Directory, cloud, Kubernetes and external assets, with a web-application module that became generally available in July 2026. Internal tests launch from a customer-hosted Docker runner; external and cloud tests run from Horizon3's cloud; results live in a SaaS portal with an API and an MCP server.

Its use of AI is deliberately narrow. Horizon3 states that NodeZero never uses generative AI to create or execute exploits; large language models, hosted on Amazon Bedrock and chosen by the vendor, only rank high-value targets, suggest next steps when a test stalls, analyse pilfered data and write narratives. Exploits themselves are deterministic and pre-validated, which lets the company promise production safety and zero downtime. There is no customer model choice and no ChatGPT login, and customisation is limited to toggling built-in attack categories and saving templates.

Horizon3's headline efficacy claim is being the first AI to fully solve the Game of Active Directory range in 14 minutes, alongside production-scale statistics from hundreds of thousands of tests. It is FedRAMP High authorised, sells largely through managed security providers, serves 7,000 or more customers, and raised a $250 million Series E at a valuation above two billion dollars in August 2026. Pricing is quote-based, and reviewers cite runner setup friction and rigid configuration.