SIERRA NEVADA CORPORATION MISSION SYSTEMS UK, LTD

NodeZero

NodeZero is an autonomous penetration testing service that continuously assesses your security posture by safely emulating real-world attacker tactics to identify exploitable weaknesses before an attacker can. Going beyond vulnerability scanning, it finds and prioritises security gaps across: external/internal networks, cloud services, IDAM systems and IoT devices.

Features

• Autonomous penetration testing
• Designed to run in live systems
• Simple and easy to use dashboards
• Displays the complete attack path proof for every exploitation
• Fix actions for each exploit integrated with remediation workflow
• One click verify of proven exploit post-remedition
• Unlimited scope and number of tests
• Autonomus cyber deception
• TripWires mapped to proven attack paths
• Phishing Test extension

Benefits

• Exectues 50x faster than a qualified human penetration tester
• Identifes exploits vulnerability scanning misses such as credential mis-use
• Low training burden and clear results, link exploits to impacts
• Finds and proves security problems that actually matter
• Quickly and effectively remediates proven exploits
• Gives absolute confidence exploits are resolved
• Continually and proactively evaluates your security posture
• Delivers precise alerts and warnings in areas of proven exposure
• Delivers uniquely curated penetration tests for Zero and N-day threats
• Proves the impacts of phished credentials not just likelihood

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Dan.Ridley@snc-ms.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

295081827318637

Contact

SNC Mission Systems UK
02921921237
Dan.Ridley@snc-ms.uk

About the service

• Service categories:
  • Applications
    • Production and operations
      • Other operations
        • Other operations
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Security Operations Centre (SOC) vulnerability and threat services, as tool to verify defence and alert effectivness. It serves as an extension to IT Service Management (ITSM) to identify the execution of policy, mis-configuration and system operation.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: Any constraints which may have a tangible effect on users will be discussed during configuration and optimisation planning.
• System requirements: A stable internet connection

User support

• Email or online ticketing support: Yes
• Support response times: Within 24 hours
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: No
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• AI chatbot: Yes
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: None
• Onsite support: No
• Support levels: Support levels provides are First, Second and Third line support. ; Support is included in the cost.; A Technical Account Manager will be provided.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Horizon3.ai helps users start using NodeZero through structured documentation, guided onboarding, and live support. The Quickstart Guide walks new users through setup step by step. New users are guided through trial registration, email verification, MFA setup and first login to the NodeZero portal. The documentation site includes Quickstart, portal guides, API/CLI references, release notes and a knowledge base for troubleshooting and optimisation of the platform. Customers are assigned a Customer Success Manager who runs onboarding calls, helps validate deployment plans and ensures correct account set up. Horizon3.ai provides regular training/sessions so users understand features such as Insights, Tripwires and advanced use cases.
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: At the end of a contract, customers retain control over their data with several options. By default, when a contract expires, tenants move into an inactive state, no longer able to run tests, but historic results remain viewable unless the customer chooses additional options. Customers can ask to deactivate the tenant, removing specific data, but allowing potential future restoration if they later renew. ; Horizon3.ai runs a comprehensive process to scrub the customer's data from systems in line with the DPA and GDPR commitments on request. Upon request, data will be deleted within 30 days.
• End-of-contract process: Each contract will be unique to the customer. ; We will agree end of contract requirements prior to the start of the contract.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• Description of service interface: Users have a simple to use web graphical user interface.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: None
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Users interact with NodeZero programmatically via a GraphQL API. Users obtain a bearer token from the auth endpoint and call the GraphQL endpoint with Authorization and Content-Type headers. They define pentest configuration, create reusable operation templates and external asset groups, install NodeZero Runners on internal Docker hosts or Kubernetes clusters via returned install commands and configure recurring tests through schedules and scheduled actions. They can make changes, authorise or deauthorise domains and IPs for external testing and manage operations entirely via API. Admin changes allow management of customer accounts, users and API keys.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: NodeZero is customised through configuration changes. Customers can tailor what is tested, how tests run, and how often, using a combination of portal UI and APIs. Users configure pentests, define network or web scope and select attack configuration options controlling which techniques run, their disruption risk and supporting parameters. Reusable OpTemplates encode standard configurations per environment or use case. Asset Groups define and maintain external attack surfaces, including which assets are authorised for testing. Runners define where tests are launched from and Schedules automate recurring tests. Customisation is done via the NodeZero portal or GraphQL API.

Scaling

• Independence of resources: We work with the user to understand demand and capacity requirements and provide resource utilisation monitoring and load balancing to ensure the service meets performance requirements.

Analytics

• Service usage metrics: Yes
• Metrics types: NodeZero exposes service usage metrics through the portal and the public GraphQL API so customers can track how they use the platform and how coverage evolves. Typical metrics include: number and type of tests run (internal, external, cloud, AD Password Audit, etc.), test frequency and outcomes, coverage/utilisation such as unique assets/hosts assessed and license utilisation, operational metrics like run durations and scheduling success and security outcomes such as counts and trends of validated weaknesses, retests/1‑Click Verify activity and time from discovery to verified fix (exposure window). These can be pulled into customer BI tools via API.
• Reporting types: API access
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Reseller (no extras)
• Organisation whose services are being resold: Horizon3.ai

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type: Data Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Export methods and options depends on the service tier selected and products purchased.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats:
  • CSV
  • Other

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Inside NodeZero's host environment, data is protected by multiple layers beyond TLS 1.2. Data at rest in AWS services is encrypted using AES 256 server side encryption. Internally, we apply resource hardening and strict role based access control (RBAC) so only authorised services and users can access sensitive data. Where additional in network protection is needed, we can also use IPsec/TLS VPN between internal components. For data lifecycle and deletion, we support cryptographic erasure/data erasure and secure wipe/physical destruction patterns to ensure customer data is fully sanitised when removed.

Availability and resilience

• Guaranteed availability: Standard SLA commits to availability of 99.95% per calendar month. If the availability falls below 99.95% in a month, customers may apply for a Service Credit within 30 days following the calendar month. To apply, customers need to provide a detailed description of the incident in a customer support case. Credits are not available for amounts that exceed 100% of Customer’s monthly Cloud Service fee. Once validated, Service Credit will be applied to the customer’s next payment period.
• Approach to resilience: This information is available on request. We are a fully remote company leveraging cloud services and native cloud functionality for high availability.
• Outage reporting: NodeZero reports outages to users primarily via a public status page. This is published at https://status.horizon3.ai. The status page is the authoritative source for: Current service status / ongoing incidents, scheduled maintenance, historical uptime/availability information. The status page also lets users subscribe to outage and incident updates via email.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Horizon3.ai restricts access to management interfaces and support channels through policy enforced RBAC integrated with identity providers and IAM solutions. Administrative and privileged identities are managed centrally using cloud IdPs (e.g. Cognito/Auth0/Okta) with role based access, so only authorised personnel can administer customer environments or internal systems. Access to sensitive tools (admin portal, production consoles, support systems) requires corporate credentials, MFA, and assignment to appropriate roles or groups. End users cannot self elevate. Administrative and support actions are logged via AWS logging services and other monitoring tools, enabling review of activity, enforcement of least privilege and segregation of duties requirements.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: SSAE-18 (SOC2) and FEDRamp
• Information security policies and processes: Policies are available at trust.horizon3.ai. ; Employees must sign and acknowledge policies as part of employment.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Horizon3.ai uses a standards-based configuration and change management process governed by its Operational Security Policy, available via the Trust Center. The program aligns to recognised frameworks such as CSA CCM v4.0 and SSAE 18 / ISAE 3402. Service components are tracked through their lifecycle using structured change procedures, CI/CD and infrastructure as code practices. Proposed changes go through impact and risk assessment, including security considerations, before deployment. Post deployment, monitoring and vulnerability management processes verify that changes behave as expected and do not degrade the security posture, with results feeding back into governance and audit evidence.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Horizon3.ai runs a risk based vulnerability management program governed by a formal Vulnerability Management Policy available via our Trust Center (trust.horizon3.ai). We assess potential threats using continuous monitoring of our stack plus industry sources and our own attack research, including NodeZero Rapid Response and Vulnerability Management Hub, which track emerging CVEs/KEVs and exploitability in real environments. Patches are delivered through immutable images and CI/CD. Each new NodeZero operation runs on the latest, patched image, and its supporting infrastructure is destroyed after the test, ensuring outdated components are not reused. Critical issues are prioritised for rapid remediation under this program.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Horizon3.ai’s protective monitoring combines cloud native logging with automated alerting and defined response playbooks. We use AWS CloudWatch, CloudTrail, GuardDuty and Datadog to monitor infrastructure, application logs, and data store actions, generating automated alerts on suspicious activity and configuration changes. Alerts are sent to dedicated Slack channels and email for the security team. All alerts are investigated immediately. Where an event affects the live service, customer facing incident handling follows our support/SLA model, with critical (Severity 1) outages responded to within 1 business hour, and lower severity issues handled within defined timeframes while we contain, analyse, and remediate the issue.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Horizon3.ai operates a formal Incident Management Policy aligned to recognised standards, published via our Trust Center (trust.horizon3.ai). We maintain pre defined runbooks for common events (for example service degradation, security alerts from monitoring, and availability incidents), which guide triage, escalation, containment, and recovery. Customers report incidents via 24/7 website or in product chat, or by emailing support@horizon3.ai. Critical (Severity 1) issues receive a response within 1 business hour, with defined targets for lower severities. Incident reports (root cause, timeline, and corrective actions) are provided to affected customers via the support case and, where appropriate, formal post incident summaries.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Demonstration licences provide a demonstration/test of capability.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 1%
• Between £2,500,001 and £5,000,000: 2%
• Over £5,000,001: 2.5%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: BSI
• ISO/IEC 27001 accreditation date: Tuesday 30 June 2026
• What the ISO/IEC 27001 doesn’t cover: Please note the declaration above will be accurate at the time of Framework Award. We are scheduled to have our ISO/IEC certification accredited by BSI in June 2026 and can provide a letter of confirmation of the same from BSI.; The scope of the certified ISMS covers all business processes, information assets, technologies, and personnel involved in delivering, supporting, and managing the SNC MS UK's services and digital products, including software development, data modelling and analytics, network and infrastructure management, and IT Service Management. It applies to all organisational sites, cloud environments, and authorised remote working locations, ensuring the confidentiality, integrity, and availability of information throughout its lifecycle. This scope covers all digital services and products offered through G-Cloud 15.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: BSI
• ISO 9001 accreditation date: Saturday 14 December 2024
• What the ISO 9001 doesn’t cover: The ISO 9001 scope excludes corporate finance functions, which are governed through separate financial audit and assurance frameworks; all service delivery and operational activities are included within scope.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: Dc002eca-9683-4af2-9cd8-4a95d16e19af
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: B24fa866-231d-4ab3-a44a-57ea24e73479
• Other security certifications: Yes
• Any other security certifications: We have an MOD accredited Facility Security Clearance (FSC) site

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Ensuring new workers are informed of their right to join a trade union
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Activities to cascade good practice on fair working conditions throughout the supply chain
  • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Volunteering opportunities for staff
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Dan.Ridley@snc-ms.uk. Tell them what format you need. It will help if you say what assistive technology you use.