In short: Autonomous penetration testing uses software to safely attack your environment the way a real adversary would, chaining weaknesses into attack paths without a human tester driving each step. Horizon3.ai NodeZero runs internal, external, cloud and Kubernetes tests on demand, shows proof of each attack path and lets you re-test to verify fixes.
What autonomous penetration testing is
A vulnerability scanner lists weaknesses. A penetration test tries to exploit them, to show what an attacker could actually reach. Autonomous penetration testing automates that second step: the platform discovers your assets, tries credentials and exploits safely, pivots from one foothold to the next and records each path it finds to sensitive systems or data.
Because no consultant has to be booked, tests can run whenever you change something, after a new vulnerability is announced, or on a regular schedule. That fits the NCSC's view that penetration testing is a way to gain assurance that your vulnerability management is working, rather than the main way you discover problems.
How NodeZero works: find, fix, verify
Horizon3.ai describes NodeZero's workflow in three steps:
- Find: NodeZero chains weaknesses together as an attacker would, such as weak or reused credentials, misconfigurations and exploitable vulnerabilities, and safely exploits them. Results are ranked by impact, and each attack path comes with step-by-step proof.
- Fix: every weakness comes with remediation guidance, and the platform highlights fixes that remove many attack paths at once, so you can prioritise effort.
- Verify: after remediation, a quick re-test confirms the path is closed. This closes the loop that an annual test leaves open.
Deployment. NodeZero needs no agents on your devices. For internal tests you paste a launch script into a Docker host or a virtual appliance (OVA) inside your network; external tests run from Horizon3.ai's cloud. Horizon3.ai sets up dedicated, short-lived resources for each test, and tests can be scheduled.
What it can test
| Test type | What it shows |
|---|---|
| Internal | What an attacker with a foothold inside your network could reach: lateral movement, credential reuse and paths to domain admin or sensitive data |
| External | What is exposed to the internet and whether it can be exploited from outside |
| Cloud, including Azure and Microsoft Entra ID | Attack paths into and across your cloud tenant, including credentialed tests that start from Entra ID credentials and pivots from on-premises systems into the cloud |
| Kubernetes | Attack paths in container clusters |
| Active Directory password audit | Weak, reused or breached passwords in your directory |
| Rapid Response | Whether newly disclosed, actively exploited vulnerabilities affect you |
| Phishing impact | Connects to your phishing simulations, captures the credentials of users who respond and shows what an attacker could reach with them |
The tests you can run depend on the NodeZero package you license: not every package includes cloud and Kubernetes testing, for example. Ask us for a quote and we will match the package to your estate.
Autonomous testing compared with a consultant-led test
Autonomous testing complements a traditional penetration test from a CREST-accredited company or, for government systems, an NCSC CHECK tester. It does not replace them.
| Autonomous (NodeZero) | Consultant-led penetration test | |
|---|---|---|
| How often | On demand, scheduled, or after every significant change | Usually annual or per project |
| Re-testing | Re-run yourself to verify fixes | Often a separate engagement |
| Strengths | Network, identity and credential attack paths at scale, repeatable and consistent | Business logic, bespoke web apps, social engineering, physical and creative testing |
| Human judgement | Automated decisions within safe limits | Experienced testers adapt to what they find |
| Evidence for | Ongoing assurance and remediation tracking | Contracts, regulators and frameworks that require a named, qualified tester |
Many organisations use both: autonomous testing throughout the year to keep the basics tight, and a consultant-led test where depth, a specific application or formal sign-off is required.
External exposure and dark web monitoring
Penetration testing shows what an attacker could do with access. External threat exposure tools show what they can already see. NordStellar from Nord Security, now presented as NordLayer Intelligence by NordStellar, monitors data breaches, infostealer logs and the dark web for your organisation's credentials, maps your external attack surface and spots lookalike domains used for impersonation. Leaked passwords found this way are exactly what NodeZero tries during a test, so the two work well together.
Forever Group also offers dark web monitoring as a managed service. To reduce the chance that staff hand over credentials in the first place, pair testing with security awareness training.
How we run it
- Scope and rules of engagement: which networks, tenants and cloud accounts are in scope, test windows and who to notify.
- First test and walkthrough: we run the test with you and explain the attack paths in business terms.
- Remediation plan: findings feed the prioritised plan from your cloud security assessment, with quick wins first. Common fixes include identity security changes, patching and segmentation.
- Re-test and repeat: verify each fix, then test on a schedule or after major changes.
Contact us to discuss scope and a quote.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is autonomous penetration testing?
It is penetration testing carried out by software rather than a person driving each step. The platform safely discovers assets, exploits weaknesses and chains them into attack paths, then reports proof and fixes. Tests can be repeated on demand to verify remediation.
Is autonomous penetration testing safe to run on a live network?
NodeZero is designed for production use. It uses safe exploitation techniques and needs no agents. You still agree scope, timing and exclusions before testing, as you would with any penetration test.
Can autonomous testing replace a CREST penetration test?
Not entirely. It is excellent for frequent, repeatable testing of network, identity and credential attack paths. Consultant-led tests from CREST-accredited companies, or CHECK testers for government systems, remain the right choice for bespoke applications, creative testing and where a contract or regulator requires a qualified human tester.
How often should we run a penetration test?
Traditional tests are often annual, but your environment changes far more often. With autonomous testing, many organisations test regularly and after significant changes or newly announced vulnerabilities, and always re-test after fixing critical findings.
Does NodeZero test Microsoft 365 and Azure?
NodeZero's cloud testing covers Azure, including Microsoft Entra ID attack paths, and some packages add Kubernetes testing. It is not a review of every Microsoft 365 setting, so pair it with a Microsoft 365 security assessment for the wider tenant and with CSPM for continuous checks on cloud configuration.