NG-IT LTD

Automated Pen Testing (PTaaS)

NodeZero is an autonomous penetration testing service that continuously assesses your security posture by safely emulating real-world attacker tactics to identify exploitable weaknesses before an attacker can. Going beyond vulnerability scanning it finds and prioritises security gaps across: external/internal networks, cloud services, IDAM systems and IoT devices.

Features

• Autonomus penetration testing
• Designed to run in live systems
• Simple and easy to use dashboards
• Displays the complete attack path proof for every exploitation
• Fix actions for each exploit integrated with remediation workflow
• One click verify of proven exploit post-remedition
• Unlimited scope and number of tests
• Autonomus cyber deception TripWires mapped to proven attack paths
• Rapid response

Benefits

• Exectues 50x faster than a qualified human penetration tester
• This identifes exploits vulnerability scanning misses such as credential mis-use
• Low training burden and clear results, link exploits to impacts
• It finds and proves security problems that actually matter
• Quickly and effectively remedate proven exploits
• Have absolute confidence exploits are resolved
• Continual and proactively evaluate your security posture
• Delivers precise alerts and warnings in areas of proven exposure
• Uniquely curated penetration tests for Zero and N-day threats
• Proves the impacts of phished credentials not just likelihood

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at gcloud@ng-it.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

779912806954198

Contact

Operations Team
0330 223 3915
gcloud@ng-it.co.uk

About your service

• Service categories:

  Systems Infrastructure Software

  Security

  • Cloud native application protection platform
  • Security analytics
  • Governance, risk and compliance

  Data security

  • Information protection
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Security Operations Centre (SOC) vulnerability and threat services as tool to verify defence and alert effectivness. It serves as an extension to IT Service Management (ITSM) to identify the execution of policy, mis-configuration and system operation.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: No.
• System requirements: None.

User support

• Email or online ticketing support: Yes
• Support response times: NodeZero support hours are 09:00 AM-09:00 PM EST, Mon to Friday. Critical (severity 1) response within 1 business hour. Major (severity 2) response within 4 business hours. Minor (severity 3) response within 2 business days.
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: Horizon 3 AI has not completed any web chat testing with assistive technology users.
• Onsite support: No
• Support levels: NodeZero support hours are 09:00 AM-09:00 PM EST, Mon to Friday. Critical (severity 1) response within 1 business hour. Major (severity 2) response within 4 business hours. Minor (severity 3) response within 2 business days. Customer success which includes account management and support is included in standard licensing costs.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Horizon3.ai helps users start using NodeZero through a mix of structured documentation, guided onboarding, and live support. The Quickstart guide walks new users step by step: log in or register, check network prerequisites, set up a NodeZero host, and run the first internal pentest to get immediate findings. New users are guided through trial registration, email verification, MFA setup, and first login to the NodeZero portal. The docs site provides a central Documentation Home with Quickstart, portal guides, API/CLI references, release notes, and a knowledge base to troubleshoot and optimise use of the platform. Once a customer signs on, they are assigned a Customer Success Manager who runs onboarding calls, helps validate deployment plans (host placement, scope, deployment strategy), and ensures the account is correctly set up. Horizon3.ai also provides regular training / office hours style sessions so users can go deeper into features such as Insights, Tripwires and advanced use cases.In addition, an integrated web chat and extensive online documentation are available directly from the portal, so users can get contextual help while they configure their first tests and interpret results.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Customers can download the results of their penetration tests at any time. At contract termination, customer data will be deleted within 30 days at the customer's request.
• End-of-contract process: At the end of a NodeZero contract, customers retain control over their data and have several options. Throughout the contract and up to termination, customers can export pentest data directly from the NodeZero portal, typically in open formats such as CSV/ODF, with PDF available for reports and documentation. This allows them to take copies of all relevant results, evidence, and reports before any deletion occurs. By default, when a contract expires, the tenant will typically move into an inactive / read only state: users can no longer run new tests, but historic results may remain viewable unless the customer chooses a stronger offboarding option. Customers can instead ask Horizon3.ai to deactivate the tenant, which removes account specific data from the live portal but allows potential future restoration if they later renew. If a customer wants full removal, they can formally request GDPR style erasure. Horizon3.ai then runs a comprehensive process to scrub the company’s data from systems in line with the DPA and GDPR commitments. In our G Cloud statement, we commit that, upon the customer’s request at contract termination, customer data will be deleted within 30 days.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Web GUI
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Horizon3 AI has not completed any interface testing with assistive technology users.
• API: Yes
• What users can and can't do using the API: Users interact with NodeZero programmatically via a GraphQL API. To set up the service, they obtain a bearer token from the auth endpoint and call the GraphQL endpoint with Authorization and Content-Type headers. Using setup mutations, they define pentest configuration (scope, operation type, feature flags, credentials, runtime limits), create reusable operation templates and external asset groups, install NodeZero Runners on internal Docker hosts or Kubernetes clusters via returned install commands, and configure recurring tests through schedules and scheduled actions. They then use update and control mutations to make changes: patch templates and asset groups, adjust or delete scheduled actions, authorize or deauthorize domains and IPs for external testing, and create, rerun, rename, archive/delete, cancel, pause and resume operations entirely via API. Admin mutations allow management of customer accounts, users and API keys. Limitations: paginated queries are capped at 100 items per page; Runner installation still requires executing the provided commands in the customer environment; scheduled actions support hourly (not per minute) granularity and run in UTC; and most findings objects (pentests, weaknesses, attack paths, credentials, data stores, logs, Vulnerability Management Hub series) are read only—customers can query and export these but cannot modify the scan results via the API.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: NodeZero is customised primarily through configuration, not code changes. Customers can tailor what is tested, how tests run, and how often, using a combination of portal UI and APIs. Users configure pentests by choosing operation type (internal, external, cloud, AD Password Audit, Kubernetes, phishing, insider threat), defining network or web scope (min/max IP ranges, blacklists, Intelligent Scope, application URLs, OSINT domains), and selecting attack configuration options (“feature flags”) that control which techniques run, their disruption risk, and supporting parameters such as minimum runtime and password spray lists. They can also inject credentials, specify Git and cloud accounts, enable tripwires, and choose K8s namespaces or service accounts. Reusable OpTemplates encode standard configurations per environment or use case. Asset Groups define and maintain external attack surfaces (domains and IP ranges), including which assets are authorised for testing. Runners define where internal tests are launched from. Schedules automate recurring tests, including paired pause/resume/cancel actions for maintenance windows. Tenant level settings allow branding, client account structure, and user/role management. Customisation is done via the NodeZero portal or the documented GraphQL API. In practice, security and platform engineers with administrative or operator roles perform most customisation; read only users consume results but cannot change configuration.

Scaling

• Independence of resources: NodeZero ensures users aren’t affected by demand from other users through resource utilisation monitoring and load balancing. In practice, this means: Horizon3.ai continuously monitors service resource usage (e.g. compute, memory, network, database) across the multi tenant SaaS platform. Load is balanced across the underlying cloud infrastructure so that spikes from one tenant are spread and capacity can be adjusted, rather than degrading performance for others. This approach, combined with standard cloud scaling and operations practices, is what we formally state in G Cloud as the way we protect users from noisy neighbours.

Analytics

• Service usage metrics: Yes
• Metrics types: NodeZero exposes service usage metrics through the portal and the public GraphQL API so customers can track how they use the platform and how coverage evolves.; Typical metrics include: number and type of tests run (internal, external, cloud, AD Password Audit, etc.), test frequency and outcomes; coverage/utilisation such as unique assets/hosts assessed and license utilisation; operational metrics like run durations and scheduling success; and security outcomes such as counts and trends of validated weaknesses, retests/1 Click Verify activity, and time from discovery to verified fix (exposure window). These can be pulled into customer BI tools via API.
• Reporting types: API access
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Horizon3 AI

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: From within the product platform.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: Other
• Other protection within supplier network: Inside NodeZero's host environment, data is protected by multiple layers beyond TLS 1.2. Data at rest in AWS services is encrypted using AES 256 server side encryption. Internally, we apply resource hardening and strict role based access control (RBAC) so only authorised services and users can access sensitive data. Where additional in network protection is needed, we can also use IPsec/TLS VPN between internal components. For data lifecycle and deletion, we support cryptographic erasure/data erasure and secure wipe/physical destruction patterns to ensure customer data is fully sanitised when removed.

Availability and resilience

• Guaranteed availability: Standard SLA commits to availability of 99.95% per calendar month. If the availability falls below 99.95% in a month, customers may apply for a Service Credit within thirty days following the calendar month. To apply, Customer will provide a detailed description of the incident in a customer support case. This is the only remedy for our failure to meet the Cloud Service availability standard; credits are not available for amounts that exceed 100% of Customer’s monthly Cloud Service fee. Once validated, Service Credit will be applied to Customer’s next payment period.
• Approach to resilience: Available on request. Fully remote company leveraging cloud services and native cloud functionality for high availability.
• Outage reporting: NodeZero reports outages to users primarily via a public status page. This is published at https://status.horizon3.ai. The status page is the authoritative source for: Current service status / ongoing incidents, scheduled maintenance, historical uptime/availability information. The status page also lets users subscribe to outage and incident updates via email.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Horizon3.ai restricts access to management interfaces and support channels through policy enforced RBAC integrated with identity providers and IAM solutions. Administrative and privileged identities are managed centrally using cloud IdPs (e.g. Cognito/Auth0/Okta) with RBAC, so only authorised personnel can administer customer environments or internal systems. Access to sensitive tools (admin portal, production consoles, support systems) requires corporate credentials, MFA, and assignment to appropriate roles or groups; end users cannot self elevate. Administrative and support actions are logged via AWS logging services and other monitoring tools, enabling review of activity and enforcement of least privilege and segregation of duties requirements.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: SSAE-18 (SOC2), FEDRamp
• Information security policies and processes: Horizon3.ai’s information security program is policy driven, standards aligned, and centrally governed. Policies & standards: We maintain documented information security policies (covering areas such as access control, operations, vulnerability management, and incident management) aligned to CSA CCM v4.0, ISO/IEC 27001, and SSAE 18 (SOC 2), with details published in the Trust Center (trust.horizon3.ai). Reporting structure: A named board level (or equivalent) security owner is responsible for the security of all services, with security governance and operations reporting into that function. How policies are enforced: Employees must sign and acknowledge security policies as part of employment, and day to day adherence is enforced through the documented operational security, vulnerability management, and incident management processes referenced in our G Cloud and Trust Center materials.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Horizon3.ai uses a standards-based configuration and change management process governed by its Operational Security Policy, available via the Trust Center (trust.horizon3.ai). The program aligns to recognised frameworks such as CSA CCM v4.0 and SSAE 18 / ISAE 3402. Service components are tracked through their lifecycle using structured change procedures, CI/CD and infrastructure as code practices; proposed changes go through impact and risk assessment, including security considerations, before deployment. Post deployment, monitoring and vulnerability management processes verify that changes behave as expected and do not degrade the security posture, with results feeding back into governance and audit evidence.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Horizon3.ai runs a risk based vulnerability management program governed by a formal Vulnerability Management Policy available via our Trust Center (trust.horizon3.ai). We assess potential threats using continuous monitoring of our stack plus industry sources and our own attack research, including NodeZero Rapid Response and Vulnerability Management Hub, which track emerging CVEs/KEVs and exploitability in real environments. Patches are delivered through immutable images and CI/CD: each new NodeZero operation runs on the latest, patched image, and its supporting infrastructure is destroyed after the test, ensuring outdated components are not reused. Critical issues are prioritised for rapid remediation under this program.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Horizon3.ai’s protective monitoring combines cloud native logging with automated alerting and defined response playbooks. Utilising AWS CloudWatch, CloudTrail, GuardDuty and Datadog to monitor infrastructure, application logs, and data store actions, generating automated alerts on suspicious activity and configuration changes.; Alerts are sent to dedicated Slack channels and email for the security team, and all alerts are investigated immediately. Where an event affects the live service, customer facing incident handling follows our support/SLA model, with critical (Severity 1) outages responded to within 1 business hour, and lower severity issues handled within defined timeframes while we contain, analyse, and remediate the issue.
• Incident management type: Supplier-defined controls
• Incident management approach: Horizon3.ai operates a formal Incident Management Policy aligned to recognised standards, published via our Trust Center (trust.horizon3.ai). ; We maintain pre defined runbooks for common events (for example service degradation, security alerts from monitoring, and availability incidents), which guide triage, escalation, containment, and recovery. Customers report incidents via 24/7 website or in product chat, or by emailing support@horizon3.ai; critical (Severity 1) issues receive a response within 1 business hour, with defined targets for lower severities. Incident reports (root cause, timeline, and corrective actions) are provided to affected customers via the support case and, where appropriate, formal post incident summaries.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: A NodeZero proof of value is a time limited engagement including internal pentests, external/cloud/AD assessments, exploit-path discovery, prioritized fix actions, 1 Click Verify retesting, and executive/technical reporting. It excludes ongoing managed services, broad multi tenant rollout and long term licensing; scope is limited to agreed environments and features for evaluation.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 10%
• Between £250,000 and £500,000: 22%
• Between £500,001 and £1,000,000: 30%
• Between £1,000,001 and £2,500,000: 30%
• Between £2,500,001 and £5,000,000: 30%
• Over £5,000,001: 30%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: CDL Group
• ISO 9001 accreditation date: Tuesday 1 July 2025
• What the ISO 9001 doesn’t cover: N/a
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: E29042f9-0029-4a93-840f-4178125bdd61
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 76366978-ee23-40f3-80dd-8b48234414fd
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Volunteering opportunities for staff
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Measures for making facilities used in the delivery of the contract available for community groups, education or training
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered
    • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at gcloud@ng-it.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.