From Proven Attack Paths to Verified Fixes: Horizon3 and Torq Close the Remediation Loop
Horizon3 and Torq connect NodeZero attack-path proof to automated remediation and retesting.
Horizon3 and Torq announced an integration that sends NodeZero attack-path findings into Torq workflows and then retests whether remediation holds. NodeZero chains vulnerabilities, misconfigurations, and credentials from an assumed-breach foothold or the external perimeter, while Torq adds asset ownership and can reset credentials, isolate hosts, restrict cloud access, and open tickets. 1-Click Verify retests specific weaknesses; a full pentest is required to claim an entire attack path is closed. The post is a vendor partnership announcement, not a vulnerability disclosure.
- NodeZero proves exploitable paths and Torq drives the fixes.
- Workflows can reset credentials, isolate hosts, and open tickets.
- Follow-up NodeZero tests check whether an exposure remains exploitable.
- 1-Click Verify covers one weakness, not every alternate path.
Full article1,004 words · extracted from horizon3.ai · click to collapse
A remediation ticket can be closed while the exposure remains exploitable. A password change may leave other compromised credentials unaddressed. A configuration update may correct one system while the same weakness persists elsewhere. The work is recorded as complete, but the attacker still has a way through.
Security teams are buried in findings, and most of them never lead anywhere an attacker cares about. What they need is proof at both ends of remediation: what an attacker can exploit before the fix, and whether the attacker can still exploit it after.
The Horizon3 and Torq partnership connects those steps. NodeZero® proves which weaknesses an attacker can exploit and where they lead. Torq brings that proof into security operations and drives the fix through the tools and teams that own it. NodeZero then attacks again to prove the fix held.
The value is in carrying that proof through the entire workflow: it decides what gets fixed first, who owns it, and when the work is actually done.
Vulnerable Does Not Equal Exploitable. Exploitable Does Not Equal Impact.
A vulnerability finding identifies a weakness. It does not establish whether an attacker can reach and exploit that weakness in your environment. Successful exploitation then raises another question: what does that access enable?
The distinction matters when deciding what to fix first. A weakness that exposes a privileged identity or sensitive data can demand a different response from one that provides limited access to an isolated system. Severity alone cannot explain those relationships.
NodeZero tests them. NodeZero safely tests the production environment from a defined starting position, such as an assumed-breach foothold inside the network or the external perimeter, chaining vulnerabilities, misconfigurations, and credential weaknesses to demonstrate attack paths and resulting impacts.
This reveals how individual findings connect. A compromised credential may provide access to a host, where another weakness enables privilege escalation or further movement. Each step contributes to the outcome, but treating the findings as unrelated tickets can obscure which changes would interrupt the chain.
Attack-path evidence gives remediation teams that context: which identities and systems are exposed, what an attacker achieved, and which single fix breaks several paths at once.
Connect Attack Evidence to Security Operations
Torq’s Horizon3 integration provides steps for retrieving pentests, weaknesses, attack paths, hosts, and credentials, plus a GraphQL query step that opens the rest of the Horizon3 API to workflow builders. The connection uses a Horizon3 API key and the gateway URL for the relevant region. Using a User role API key, workflows can also schedule NodeZero verification tests; a Read-only key can retrieve results but cannot start tests.
Torq workflows can retrieve NodeZero findings on a schedule or on demand. Each finding arrives with the attack-path impact NodeZero demonstrated, and Torq adds asset ownership from the organization’s other systems, connecting the technical evidence to the operational context needed to act.
Ownership answers who can make the change. Attack-path context explains what the change is intended to prevent.
On the Torq side, Socrates, Torq’s AI SOC Analyst, supports prioritization, Torq Hyperautomation coordinates actions across connected systems, and Case Management tracks the findings and remediation process.
Together, they let customers use AI to fight AI: NodeZero proves exposure at machine speed, and Torq acts on that proof at machine speed. The organization decides which actions run automatically and what counts as done.
Coordinate Remediation Across the Systems Involved
An attack path can cross identity, endpoint, and cloud systems. Addressing it may require several changes owned by different teams.
Torq workflows can coordinate those changes through Torq’s integrations with those tools. Actions include:
- Identity: Force password resets, rotate exposed credentials, and revoke sessions where the identity provider supports it through automation.
- Endpoint: Isolate impacted hosts or verify endpoint agent coverage.
- Cloud: Remediate misconfigurations or restrict access.
- Collaboration and ITSM: Notify responsible owners and open remediation tickets.
Consider a credential NodeZero used to gain access. Torq routes the finding to the responsible owner, resets or rotates the credential through the identity provider, and revokes existing sessions so the stolen access doesn’t outlive the fix.
Torq can then schedule a NodeZero verification test to determine whether the credential exposure remains exploitable.
Match Verification to the Remediation Claim
After remediation, Torq uses a User role API key to schedule follow-up testing through NodeZero and retrieve the results. The verification method must fit the weakness and the claim the team wants to make.
NodeZero’s 1-Click Verify retests specific weaknesses, reusing the configuration of the pentest that originally found them. That answers whether a given weakness is fixed. A claim about an entire attack path calls for a full pentest with enough scope to exercise the whole chain.
1-Click Verify returns a resolution status for each weakness, compared against the original pentest. A resolved status proves that weakness is no longer exploitable within that test’s scope. It does not prove that every other route to the same target is closed; that is what a full pentest is for.
A Torq workflow can use the resolution status to close the corresponding finding or route a persistent exposure back for further action. If NodeZero cannot schedule a verification test, for example because no runner is available, it reports the failure, and the workflow should route that finding for review rather than treat it as fixed.
Verification becomes part of closing the work, not a step after it. Every closed finding carries who fixed it, how long it took, and the re-attack that proved it, which gives security leaders an accountable record of remediation instead of a count of closed tickets.
Repeat as the Environment Changes
As credentials, permissions, software, and configurations change, new exposures can emerge and previous ones can recur. Pentests scheduled in NodeZero, combined with scheduled retrieval of their findings in Torq, allow the workflow to repeat.
NodeZero assesses the risk and proves the fix. Torq drives remediation across the systems and teams involved. Together, they take organizations from proven exposure to proven remediation, with an accountable record at every step.
Hack. Fix. Verify. Repeat on demand.