Horizon3 links NodeZero findings with Cortex XSOAR

Horizon3 has launched a NodeZero integration with Palo Alto Networks Cortex XSOAR on the Cortex Marketplace, linking NodeZero findings with incident workflows in Cortex XSOAR.

The integration sends high- and critical-severity open findings from NodeZero into Cortex XSOAR as incidents. Each incident includes affected asset data, exploitation evidence and remediation guidance, allowing security and IT teams to use existing playbooks to route, track and address issues.

NodeZero is designed to test customer environments autonomously, identify vulnerabilities and other weaknesses, and map attack paths. Under the new integration, organisations can return to NodeZero after remediation work to retest eligible findings through its 1-Click Verify function and check whether a weakness remains exploitable.

The companies are positioning the move as a response to a common cyber security operations problem: teams often have large volumes of vulnerability data and a growing set of automation tools, but limited evidence showing which weaknesses attackers can actually exploit. The integration is intended to bring that evidence into remediation workflows already running in Cortex XSOAR.

Workflow link

According to Horizon3, the process starts with NodeZero identifying vulnerabilities, weaknesses and attack paths. High- and critical-severity findings are then ingested into Cortex XSOAR, where incidents can be enriched with asset context and sent to the relevant teams for action.

Once a fix has been made, teams can retest through NodeZero to determine whether the issue remains an exploitable weakness. Remediated weaknesses would stop appearing as open incidents, while those that remain exploitable would continue to surface for follow-up work.

The arrangement creates a continuous cycle of testing, remediation and verification. It also ties a pentesting tool more closely into day-to-day security orchestration, an area where many large organisations are trying to reduce manual work and improve prioritisation.

The integration has been certified by Palo Alto Networks and is now available through the Cortex Marketplace.

Snehal Antani, Chief Executive Officer and Co-Founder of Horizon3, said the aim is to help customers measure whether cyber security spending is changing outcomes. "Organisations have invested heavily in security tools and automation. The opportunity now is to prove those investments are producing better security outcomes," Antani said. "By bringing NodeZero's exploitability evidence into Cortex XSOAR, teams can prioritize what to fix based on what testing revealed, automate remediation, and verify that the outcome changed. It gives leaders evidence that their defences are working and their security investments are delivering measurable value."

The announcement also highlights how security vendors are trying to respond to a faster threat environment as artificial intelligence tools lower the barriers for attackers to discover and exploit weaknesses. In that environment, security teams are under pressure not only to identify problems quickly but also to show that fixes have removed practical risk rather than simply closed tickets.

Palo Alto Networks described the integration as a way to improve the quality of information entering orchestration workflows. "Effective security orchestration starts with high-quality inputs," said Daniele Di Mattia, VP, GTM Strategy & Operations at Palo Alto Networks. "NodeZero adds attacker-validated exploitability context to Cortex XSOAR, helping security teams focus automation and remediation on the weaknesses that matter most. Together, we're helping customers turn better security context into faster, more informed action through the workflows they already use."

The launch is another example of security suppliers trying to connect testing tools with incident and response systems, rather than treating them as separate parts of the security stack. For Cortex XSOAR users, the practical effect is that NodeZero findings can move into established remediation processes without requiring teams to work from a separate queue.

Horizon3 said more than 7,000 organisations use its products, including defence agencies, large companies, banks and healthcare providers.