Horizon3.ai

What Horizon3.ai does

Horizon3.ai is a private, venture-backed cybersecurity company founded in 2019 in San Francisco by former U.S. Special Operations cyber operators, including co-founder and CEO Snehal Antani. The company is incorporated in Delaware, has 251–500 employees, and has raised $178.5 million in disclosed funding across six rounds, including a $100 million Series D led by NEA in June 2025. The company sells a single core platform — NodeZero — marketed as an AI-Native Proactive Security Platform that autonomously executes real-world attack techniques (without agents or production disruption) across internal, external, cloud (AWS and Azure), Kubernetes, Active Directory, and Azure Entra ID environments. NodeZero generates and executes exploit code, chains vulnerabilities into attack paths, and produces evidence-based remediation guidance using a combination of machine learning and generative AI; the platform has accumulated telemetry from more than 225,000 production pentests across 5,200+ organizations.

The business model is subscription-based ARR, sold through four primary channels: direct enterprise field sales targeting Fortune 10/250 and federal agencies; a heavy MSSP/MSP channel program (the Vanguard Partner Program) through which approximately 70% of customers are serviced; the AWS Marketplace (enabling EDP-fund purchases and Consulting Partner Private Offers); and federal-sector procurement through FedHIVE's FedRAMP High environment, the Department of War Platform One Solutions Marketplace, and the Tradewinds Solutions Marketplace. Pricing is not publicly disclosed, though the unlimited-pentest subscription model and 125% Net Dollar Retention / 94% Gross Dollar Retention metrics indicate land-and-expand economics. The customer base spans the NSA, four Fortune 10 enterprises, defense contractors, the Defense Industrial Base (713 suppliers via the NSA CAPT program), critical infrastructure operators, healthcare systems, higher education institutions, and MSSPs.

Horizon3.ai has reported 102% YoY ARR growth in FY2026, 137% YoY ARR growth in 1H 2025, and 2,962% three-year revenue growth (Inc. 5000 #1 in Security, 2025; Deloitte Technology Fast 500 #3). The platform is the engine behind the NSA's Continuous Autonomous Penetration Testing (CAPT) program and is integrated with ServiceNow Vulnerability Response, Splunk Cloud, Microsoft Sentinel, Jira, Okta, AWS IAM, and Azure Entra ID. Operational geographies include the United States, EMEA (with regional leadership appointed in 2025), and MENA (via the CyberKnight distribution partnership). Recent strategic priorities include the launch of NodeZero MCP Server, Threat Actor Intelligence, Threat Informed Perspectives, Rapid Response, and TX-RAMP Champ, alongside the WWT-led 'Defending at the Speed of AI' initiative (June 2026).

Name

Horizon3.ai

Legal name

Horizon3 AI, Inc.

Website

https://www.horizon3.ai

Company type

Private

Founded year

2019

Operating status

Operating

Headcount range

501–1,000 employees

Short description

Horizon3.ai offers the NodeZero AI-Native Proactive Security Platform, which autonomously executes real-world attack techniques across internal, external, cloud, Kubernetes, and Active Directory environments. It serves more than 5,200 organizations globally, including the NSA, Fortune 10 enterprises, defense contractors, and MSSPs.

Ownership category

akta.pro rank

Product category

Autonomous Penetration Testing Software

NAICS

Security Systems Services (except Locksmiths) (561621), Computer Systems Design and Related Services (54151)

SIC

Services-Computer Integrated Systems Design (7373), Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Network Security Managed Services (Firewall/IDS/IPS/SASE) (BPAEADAG)

akta.pro secondary industries

Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ), Responsible AI, Security & Privacy Platforms (Safety, Guardrails, PII) (HDAEANAG), On-Chain Monitoring, Threat Detection & Incident Response (FSAPAJAB), Smart Contract Execution Environments (EVM/WASM, runtimes, precompiles) (FSAPABAA)

Keywords

• Autonomous penetration testing
• Offensive security platform
• Vulnerability management
• Exposure validation
• AI security testing

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. NodeZero Subscription (ARR): Annual recurring revenue from NodeZero subscriptions; 102% YoY ARR growth reported in FY2026 with 125% Net Dollar Retention and 94% Gross Dollar Retention. Enterprise segment expanded 485% YoY in 1H 2025.
2. AWS Marketplace Sales: Subscription purchases transacted via AWS Marketplace, eligible for AWS Enterprise Discount Program (EDP) funds and Consulting Partner Private Offers (CCPO) through approved AWS Consulting Partners.
3. Channel / MSSP-Led Bookings: Approximately 70% of customers are serviced through managed security service providers (MSSPs); 32% of Q4 bookings sourced through the channel; Vanguard Partner Program and Partner Advisory Board support MSSP and reseller motions.
4. Federal / Public Sector Contracts: Federal contracts awarded via partnerships (e.g., GDIT has secured over $120 million in contracts through NightDragon portfolio companies including Horizon3.ai); FedRAMP High authorization via FedHIVE, Platform One Solutions Marketplace Awardable status, TX-RAMP Champ service.

Pricing tiers

Go-to-market motion4 records

Distribution channels6 records

Marketing channels10 records

Core offering

Horizon3.ai sells the NodeZero platform, an AI-Native Proactive Security Platform that autonomously executes real-world attack techniques across internal, external, cloud, Kubernetes, and Active Directory/Azure Entra ID environments to find, prove, fix, and verify exploitable vulnerabilities without requiring agents or causing production disruption. The platform is sold primarily through annual subscriptions and delivered to enterprises, MSSPs, federal agencies, and defense contractors, with approximately 70% of customers serviced through MSSP partners.

Product overview

Horizon3.ai delivers a single core platform, NodeZero®, marketed as an AI-Native Proactive Security Platform / Offensive Security Platform, augmented by a large library of named modules and use-case configurations. The core platform autonomously runs real attack techniques in production environments to find, fix, and verify exploitable vulnerabilities, while the surrounding modules extend coverage to specific surfaces and outcomes: Internal Pentesting, External Pentesting, Cloud Pentesting, Kubernetes Pentesting, AD Password Audit, Threat Informed Perspectives, Risk-Based Vulnerability Management, Vulnerability Management Hub, Threat Actor Intelligence, Vulnerability Risk Intelligence, Rapid Response, Endpoint Security Effectiveness, Identity Security Validation, Data Security Effectiveness, Tripwires / AD Tripwires, Phishing Impact Testing, High-Value Targeting, Advanced Data Pilfering, 1-Click Verify, NodeZero Insights, NodeZero Runner, NodeZero Federal, MCP Server, and compliance packages for PCI and NIS 2. Adjacent professional services include the TX-RAMP Champ enablement program. The platform supports MSSP/MSP delivery (about 70% of customers are MSSP-serviced), is sold via AWS Marketplace and the FedHIVE FedRAMP High environment, and is the engine behind the NSA Continuous Autonomous Penetration Testing (CAPT) program for the Defense Industrial Base.

Differentiator

Problem solved

Functional benefit

Brands

• NodeZero: AI-Native Proactive Security Platform / autonomous penetration testing and offensive security platform marketed as the 'World's Most Experienced AI Hacker,' including capabilities such as NodeZero Federal, NodeZero Cloud Pentesting, Kubernetes Pentesting, Internal Pentesting, External Pentesting, Active Directory, Tripwires, Threat Actor Intelligence, Threat Informed Perspectives, Rapid Response, and Vulnerability Management.

Products and services

• NodeZero Platform
• NodeZero Cloud Pentesting
• NodeZero Threat Actor Intelligence
• NodeZero Threat Informed Perspectives
• NodeZero MCP Server
• TX-RAMP Champ
• NodeZero Federal
• NodeZero Rapid Response
• NodeZero for PCI Compliance
• NodeZero for NIS 2 Compliance

Named customers26 records

Segments10 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration9 records

AI capability4 records

Feature8 records

Partnerships

27 partnerships are on record, tiered flagship integration partner, integration partner, flagship partner (portfolio company), flagship strategic partner, major channel partner, channel partner, flagship regional partner (mena), major integration partner, embedded capability, flagship federal partner, major mssp / consulting partner, mssp partner, strategic integration, flagship cloud partner and industry recognition - leadership.

• World Wide Technology (WWT)flagship integration partnerStrategic or Co-development Partner · 16 June 2026WWT launched 'Defending at the Speed of AI' global cybersecurity initiative with Horizon3.ai, Empirical Security, Infoblox, and Cognition; integrated program combines continuous autonomous testing, risk prioritization, upstream threat prevention, and AI-accelerated remediation capabilities available through WWT's Advanced Technology Center and Cyber Range.
• Empirical Securityintegration partnerStrategic or Co-development Partner · 16 June 2026Co-partner with Horizon3.ai in WWT's 'Defending at the Speed of AI' initiative; contributes AI-accelerated patch generation capability.
• Infobloxintegration partnerStrategic or Co-development Partner · 16 June 2026Co-partner with Horizon3.ai in WWT's 'Defending at the Speed of AI' initiative; contributes DNS prevention (upstream threat prevention) capability.
• Cognitionintegration partnerStrategic or Co-development Partner · 16 June 2026Co-partner with Horizon3.ai in WWT's 'Defending at the Speed of AI' initiative; contributes AI-accelerated remediation capability.
• NightDragonflagship partner (portfolio company)Strategic or Co-development Partner · 13 May 2026Horizon3.ai is a NightDragon portfolio company; GDIT has secured over $120M in contracts through NightDragon portfolio companies including Horizon3.ai for securing critical infrastructure at military bases. NightDragon's investment firm supports cybersecurity and defense portfolio companies aligned with U.S. government programs.
• GDIT (General Dynamics Information Technology)flagship strategic partnerChannel Partner/ Reseller/ Distributor · 13 May 2026GDIT and NightDragon strategic collaboration to accelerate U.S. government adoption of emerging security technologies; Horizon3.ai cited as an example of successful collaboration with over $120M in contracts across national security, civilian, and health missions.
• NCC Groupmajor channel partnerChannel Partner/ Reseller/ Distributor · 16 April 2026NCC Group integrated NodeZero platform into its network penetration testing capabilities, leveraging AI-powered automation for offensive security services; participated in Global Partner Conference: Americas.
• Optivmajor channel partnerChannel Partner/ Reseller/ Distributor · 16 April 2026Channel partner participating in Global Partner Conference: Americas with 100+ attendees; supports MSSP-led delivery of NodeZero to enterprise customers.
• Thrivechannel partnerChannel Partner/ Reseller/ Distributor · 16 April 2026MSSP / channel partner participating in Global Partner Conference: Americas.
• CDWchannel partnerChannel Partner/ Reseller/ Distributor · 16 April 2026Major IT distribution partner participating in Global Partner Conference: Americas.
• Sentinel Technologieschannel partnerChannel Partner/ Reseller/ Distributor · 16 April 2026Channel partner participating in Global Partner Conference: Americas.
• CyberKnightflagship regional partner (mena)Channel Partner/ Reseller/ Distributor · 3 December 2025CyberKnight partnered with Horizon3.ai to deliver advanced offensive security solutions in the MENA region, focusing on continuous threat exposure management for banking, government, and energy customers.
• ServiceNowmajor integration partnerTechnology or Integration · 28 October 2025NodeZero integration with ServiceNow Vulnerability Response enables automatic routing of exploitable vulnerabilities into ServiceNow workflows with affected assets and exploit evidence; available immediately to all NodeZero customers at no additional cost.
• Tech Datachannel partnerChannel Partner/ Reseller/ Distributor · 24 October 2025Tech Data partnered with Horizon3.ai to bolster regional cybersecurity offering; distribution partner supporting channel sales.
• Threat Actor Intelligence Platform Partners (Iranian Threat Intelligence)embedded capabilityTechnology or Integration · 9 September 2025Launched Threat Actor Intelligence platform that contextualizes exploitable vulnerabilities with adversary tradecraft including Iranian Threat Actor Intelligence enabled for all NodeZero customers during heightened geopolitical threats.
• FedHIVEflagship federal partnerChannel Partner/ Reseller/ Distributor · 13 August 2024FedHIVE integrated NodeZero into its FedRAMP High-compliant cloud service offering for federal agencies and government contractors; FedHIVE holds Joint Authorization Board Authorization to Operate at FedRAMP High level.
• Liberman Networksmajor mssp / consulting partnerImplementation/ SI/ Consulting PartnerLiberman Networks (managed security and IT services company) validated Horizon3.ai NodeZero capabilities for a major U.S. healthcare system; discovered ZeroLogon vulnerability on 10 AD domain controllers and led 'Patch Tuesday / Pentest Wednesday' practice rollout.
• JTI Cybersecuritymssp partnerImplementation/ SI/ Consulting PartnerJTI Cybersecurity uses NodeZero to scale penetration testing services and strengthen client security efficiently; principal consultant Jon Isaacson quoted as user.
• Airiammssp partnerImplementation/ SI/ Consulting PartnerMSSP using NodeZero to deliver cyber resilience as a service differentiator; first NodeZero demo described as 'game-changing.'
• F12.netmssp partnerImplementation/ SI/ Consulting PartnerMSSP that turned NodeZero into a high-demand service offering; journey documented as case study on Horizon3.ai.
• Intuitusmssp partnerImplementation/ SI/ Consulting PartnerIntuitus is a full-service cybersecurity and consulting solution with 24/7 SOC specializing in 911/NG911 PSAP security; uses NodeZero as a force multiplier for pentesting services.
• NSA Cybersecurity Collaboration Centerflagship strategic partnerStrategic or Co-development PartnerOperates the Continuous Autonomous Penetration Testing (CAPT) program powered by Horizon3.ai's NodeZero; enrolled 713 Defense Industrial Base suppliers running 22,751 pentests with 23,454 critical/high weaknesses mitigated.
• Model Context Protocol (MCP) Ecosystemstrategic integrationTechnology or IntegrationNodeZero MCP Server enables agentic AI integration for Risk-Based Vulnerability Management (RBVM); available as Horizon3.ai-hosted and locally-hosted variants for IDE deployment.
• Splunk Cloudintegration partnerTechnology or IntegrationNodeZero Tripwires integrates with Splunk Cloud via webhook for threat detection and response workflows; Splunk App available for download.
• Microsoft Sentinelintegration partnerTechnology or IntegrationNodeZero Tripwires integrates with Microsoft Sentinel via webhook for threat detection and response workflows.
• Amazon Web Services (AWS)flagship cloud partnerStrategic or Co-development PartnerNodeZero available on AWS Marketplace for purchase; supports AWS Enterprise Discount Program (EDP) funds and Consulting Partner Private Offers (CCPO); designed to assess AWS cloud environments comprehensively.
• CRN Channel Chiefs 2026 (Marc Inderhees)industry recognition - leadershipGTM or Marketing PartnerMarc Inderhees (who leads MSP and MSSP strategy at Horizon3.ai) was selected for CRN's 2026 Channel Chiefs list; reflects industry recognition of channel leadership.

Scale indicators10 records

Recent moves6 records

Expansion highlights7 records

Direct peers

• Pentera: Pentera is the closest direct competitor to NodeZero, offering an automated security validation platform that emulates real-world attacks against enterprise networks. Both companies target the same autonomous pentesting / AEV category with comparable customers (Fortune 500 enterprises and MSSPs) and similar land-and-expand subscription economics.
• SafeBreach: SafeBreach provides a breach-and-attack-simulation (BAS) platform that continuously executes attack scenarios to validate security controls. It competes directly with NodeZero's autonomous pentesting and security control validation capabilities (e.g., Endpoint Security Effectiveness, Data Security Effectiveness) for enterprise security buyers.
• AttackIQ: AttackIQ delivers a BAS platform that operationalizes the MITRE ATT&CK framework for continuous security validation. It is comparable to NodeZero in target market (enterprise security teams), product category (continuous attack emulation), and GTM (channel partners and MSSPs).
• Cymulate: Cymulate offers an exposure validation and BAS platform spanning email, web, endpoint, network, and cloud attack simulations. Like Horizon3.ai, it sells to enterprise and MSSP customers and is positioned within the emerging AEV/CTEM category where Gartner Peer Insights places both vendors.
• NetSPI: NetSPI is a penetration testing-as-a-service provider with a tech-enabled platform (Resolve) and deep MSSP-style service delivery. It is comparable to Horizon3.ai in target customers, MSSP-led delivery model, and ambition to modernize the traditional pentesting market.

Emerging players

• NCC Group: NCC Group is both a Horizon3.ai channel partner (integrated NodeZero into its network pentesting services) and a competitor in offensive security services. Its dual role makes it a critical distribution asset and a competing provider of traditional manual pentesting that NodeZero aims to replace with continuous autonomous validation.

Broad incumbents

• Rapid7: Rapid7 is an established security platform vendor offering vulnerability management (InsightVM), detection and response (InsightIDR), and Metasploit-based offensive security. Its broad portfolio overlaps with Horizon3.ai's RBVM and internal/external pentesting capabilities, particularly as it expands exposure validation features.
• Tenable: Tenable is a leading vulnerability management incumbent (Nessus, Tenable One) that is extending into exposure management and security validation. Its Tenable One platform competes with NodeZero's Vulnerability Management Hub and RBVM offerings for the same enterprise CISO buyer.
• Qualys: Qualys provides a cloud-based security and compliance platform (VMDR, Qualys TruRisk, TotalCloud) that addresses vulnerability management and cloud security posture. Its TruRisk platform increasingly overlaps with Horizon3.ai's risk-based vulnerability management and cloud pentesting capabilities.
• CrowdStrike: CrowdStrike Falcon is a dominant endpoint/cloud security platform that has expanded into exposure management and identity protection. As it bundles more security validation capabilities into its broad platform, it represents a long-tail competitive risk to standalone AEV vendors like Horizon3.ai.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks5 records

Key highlights8 records

Customer concentration

• Xx.com/Horizon3ai
• Facebookfacebook.com/Horizon3ai
• LinkedInlinkedin.com/company/horizon3ai

Compliance5 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles11 records

Funding overview

Funding rounds7 records

Investors15 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Horizon3.ai