Horizon3 and Torq Partner to Automate Attack Path Remediation and Verification
New integration links Horizon3’s NodeZero attack path evidence with Torq workflows to prioritize, fix, and verify security exposures in production environments.
Key points
- Horizon3 and Torq have launched a partnership connecting NodeZero attack-path evidence to Torq’s security operations workflows.
- The integration allows teams to automate remediation tasks and use NodeZero to verify that fixes actually block attacker paths.
- Torq’s AI analyst Socrates and Hyperautomation features help coordinate cross-team responses to complex, multi-system vulnerabilities.
Horizon3 and Torq announced a new partnership that connects real-world attack-path evidence from NodeZero to automated remediation workflows in Torq. This integration aims to close the loop between identifying exploitable exposures and verifying that security fixes effectively block those specific attack paths.
The collaboration addresses a common failure in security operations where tickets are closed while underlying exposures remain active. According to Horizon3, a password change might leave other compromised credentials unaddressed, or a configuration update might fix one system while the same weakness persists elsewhere. The partnership ensures proof exists at both ends of the remediation process: confirming exploitability before the fix and verifying the block after.
Context and Technical Background
A vulnerability finding identifies a weakness but does not prove an attacker can reach or exploit it in a specific environment. Horizon3 states that severity scores alone cannot explain the relationships between weaknesses, privileged identities, and sensitive data. NodeZero tests these relationships by safely probing production environments from defined starting positions, such as an assumed-breach foothold or the external perimeter.
NodeZero chains vulnerabilities, misconfigurations, and credential weaknesses to demonstrate actual attack paths and resulting impacts. This reveals how individual findings connect, such as a compromised credential providing access to a host where another weakness enables privilege escalation. Treating these findings as unrelated tickets can obscure which single change would interrupt the entire chain.
Who Is Affected and How It Works
The Torq integration retrieves pentests, weaknesses, attack paths, hosts, and credentials using a Horizon3 API key and gateway URL. Workflows can run on a schedule or on demand, bringing NodeZero findings into Torq with their associated attack-path impact. Torq adds asset ownership data from the organization’s other systems, connecting technical evidence to the operational context needed for action.
Ownership determines who can make the change, while attack-path context explains what the change prevents. On the Torq side, Socrates, the AI SOC Analyst, supports prioritization, while Torq Hyperautomation coordinates actions across connected systems. Case Management tracks the findings and remediation process. This allows customers to use AI to respond to machine-speed exposure proofs with machine-speed actions.
What should you do?
Security teams often struggle with findings that never lead to actionable attacker paths. This integration attempts to solve that by proving which weaknesses are exploitable and where they lead. Torq workflows can then drive the fix through the tools and teams that own the affected assets. Finally, NodeZero attacks again to prove the fix held, ensuring the exposure is truly closed.
What to do and how to stay safe: Horizon3
- Review current remediation workflows to identify tickets that are closed without verification that the underlying attack path is broken.
- Assess whether your security tools can distinguish between a vulnerability that exists and a vulnerability that is actually exploitable in your environment.
- Ensure that remediation efforts consider the entire attack chain, including credential weaknesses and misconfigurations, rather than treating findings as isolated issues.
- Verify that your organization has clear asset ownership data connected to your security operations platform to accelerate coordinated fixes.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does NodeZero determine if a vulnerability is exploitable?
NodeZero safely tests the production environment from a defined starting position, chaining vulnerabilities, misconfigurations, and credential weaknesses to demonstrate attack paths and resulting impacts.
Can Torq automate the remediation process?
Yes, Torq workflows can coordinate changes through integrations with various tools, using Torq Hyperautomation to coordinate actions across connected systems and Case Management to track the process.
Does the integration support verification of fixes?
Yes, after remediation workflows are executed, NodeZero can attack again to prove that the fix held and the exposure is no longer exploitable.
