In short: NodeZero Flex is Horizon3.ai's episodic edition of its autonomous penetration testing platform. It runs internal, external, cloud, Kubernetes and Microsoft Entra ID tests, Active Directory password audits, insider threat and phishing impact tests, with attack paths, fix actions and one-click verify. Each asset is counted every time it is tested.
What NodeZero Flex is
NodeZero Flex gives you Horizon3.ai's autonomous penetration testing engine for occasional use. Rather than committing to continuous testing, you run tests when they are useful: once a quarter, ahead of an ISO 27001 or PCI DSS audit, after a merger or a network redesign, or before renewing cyber insurance.
Each test behaves like a real attacker. NodeZero discovers what is on the network, harvests and reuses credentials where it can, exploits misconfigurations and known vulnerabilities, and chains them into paths towards domain admin, sensitive data or cloud control. It follows whatever path your environment actually allows. You can run tests with or without credentials to compare what an outsider and an insider could each achieve.
What is included
| Capability | Included in Flex |
|---|---|
| Internal network pentest | Yes |
| External pentest | Yes |
| Cloud pentest (AWS and Azure, including Microsoft Entra ID) | Yes |
| Kubernetes pentest | Yes |
| Active Directory password audit | Yes |
| Insider threat and phishing impact testing | Yes |
| Fix actions with one-click verify | Yes |
| Reports for executives and auditors | Yes |
| Vulnerability Management Hub | Yes |
| Endpoint security effectiveness | Yes |
| Scheduled testing and Threat Informed Perspectives | No, see NodeZero Core |
The Active Directory password audit shows how well your password policy holds up and which accounts NodeZero could compromise through weak or reused passwords. Phishing impact testing shows what an attacker could reach with credentials captured from a phished user. Endpoint security effectiveness shows whether your EDR spotted and stopped the techniques NodeZero used. Web application testing is a separate NodeZero WebApp product.
How it is licensed
| Option | How it works |
|---|---|
| Unit | Assets: servers, workstations, network devices, cloud resources and internet-facing services |
| Counting | Each asset counts every time it is tested; one machine under several identifiers is one asset |
| Minimum | A minimum asset quantity applies; we confirm it and the term in your quote |
| Support | Horizon3.ai standard support included |
Because Flex counts assets per test, it is usually the economical choice if you test a few times a year. If you expect to test monthly or after every change, NodeZero Core with unlimited testing is usually better value. Ask us for a quote for both and we will show you the difference.
Requirements and deployment
External tests run from Horizon3.ai's cloud and need only an authorised scope of domains and IP ranges. Internal tests run from a NodeZero host that you place in the network segment where the test should start:
- Host: Horizon3.ai's preconfigured virtual machine image, or a manual install on Ubuntu 20.04 LTS or later or RHEL 9 or later
- Resources: at least 2 CPU cores, 8 GB RAM and 40 GB free disk (4 cores and 16 GB RAM recommended)
- Container runtime: Docker 20.10 or later, or Podman 4.0 or later, for manual installs
- Network: a stable internet connection from the host and access to the networks in scope
- No EDR on the host, because it can stop NodeZero running its attacks
Cloud and Entra ID tests use access you grant to the tenant being tested. There are no agents to deploy on your devices.
Who it suits and how we help
NodeZero Flex suits mid-sized organisations that want penetration test evidence several times a year without booking a consultant each time, and IT teams that want to verify their own fixes. It is useful preparation for Cyber Essentials Plus and for answering supplier security questionnaires.
Forever Systems supplies the licence, helps you build the NodeZero host, agrees each test's scope and timing with you, and explains the findings in plain English with a prioritised fix list. We then re-run verification once fixes are in. Licences and renewals sit on your single Forever Systems account. For Active Directory hygiene between tests, see Netwrix PingCastle.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between NodeZero Flex and NodeZero Core?
Flex is for occasional testing, with each asset counted every time it is tested. Core allows unlimited testing with each asset counted once a year, and adds scheduled tests and Threat Informed Perspectives.
Does NodeZero Flex test Microsoft Entra ID?
Yes. Flex includes cloud pentests of AWS and Azure, and Microsoft Entra ID is in scope as part of the Azure testing.
What do I need to run an internal NodeZero test?
A NodeZero host placed in the network you want to test: Horizon3.ai's preconfigured virtual machine, or a Linux machine running Docker or Podman, with no EDR installed on it. We help you set it up.
Can I verify fixes without paying for a full retest?
NodeZero includes one-click verify for fix actions, so you can confirm that a specific weakness has been closed without repeating the whole test.