ASD Information Security Manual

Returns proof-of-exploit evidence on which unneeded services and functionality actually create attack paths — not a theoretical configuration review.

NodeZero attempts execution of known-bad payloads on workstations during attack chains; per-host block/allow telemetry across 40+ EDR vendors surfaces workstations where successful execution proves neither EDR nor application-control policy stopped them.

Enumerates IPs, ports, services, and applications across zones to validate that the ISM-1181 segregation design actually holds.

Proves end-to-end attack paths that cross network boundaries — direct evidence of where ISM-1182 traffic restrictions break down.

First AI to solve GOAD in 14 minutes (Horizon3-reported); it is not uncommon for NodeZero to crack more than 50% of the passwords it tests on a first audit — attack-side evidence of which passwords are weak or crackable in practice, supporting rather than certifying the ISM-0421 length requirement.

Feeds credentials captured by your phishing tool into a supporting internal pentest and proves what each one reaches — where a single captured credential reaches privileged systems, that is attack-impact evidence MFA was not enforced or was bypassable on those accounts.

Built-in AD attack-graph visualisation — makes the over-privileged service accounts that ISM-1249 requires to be minimised visible and fixable.

Proves end-to-end paths from initial access through privilege escalation — surfaces where ISM-1380 separation between privileged and unprivileged environments has broken down.

Starts from a real user's perspective and proves what the account can actually reach — empirical evidence of where over-provisioning lets users exceed the minimum privileges ISM-1833 requires.

Validates filtering and inspection effectiveness at the gateways ISM-0628 requires — proves whether cross-domain exploit chains are actually contained.

Probes the gateway from each connected network and enumerates which protocols, ports and destinations are actually reachable — surfaces unexpected flows that the ISM-0631 explicit-allow rule should have blocked.

Attempts protocol-misuse attacks (HTTP smuggling, DNS tunnelling, encoded payloads) against the gateway — successful traversal is direct evidence the ISM-1192 transport-and-above inspection isn't catching the attack class.

Every NodeZero pentest begins with automated discovery — enumerating every reachable host, service, and application from the attacker perspective.

NodeZero's exploit catalogue is continuously updated by Horizon3.ai's attack team — its own testing delivers current attack-side evidence of what is actually exploitable, and it can ingest CVE scanner output to enrich the picture.

Rapid Response runs the real exploit for a newly-disclosed critical CVE, often within hours of disclosure and in some cases ahead of the public patch — telling you whether an online service is exploitable inside the ISM-1876 window. It evidences exposure, not that the patch was applied on time.

Continuous OWASP Top 10 coverage in pre-prod and production web applications — complements the SAST/DAST/SCA regime ISM-0402 requires.

Probes public-facing services for unencrypted channels, deprecated TLS, weak ciphers, and downgradeable protocols — the exact failures ISM-0469 requires to be eliminated.

Probes SSH services on reachable hosts for password-based authentication acceptance and weak credentials — surfaces services that still accept passwords against ISM-0485's public-key-only requirement.

External recon enumerates an organisation's domains and probes their DNS for SPF records — surfaces domains and subdomains that fall short of the authoritative-sender enumeration ISM-0574 requires.

Honeytoken decoys (AWS credential files, MySQL dumps, Windows process monitors) on high-risk assets alert the moment an attacker interacts — adds an active indicator-of-compromise source of the kind ISM-0120 expects cyber security personnel to have available.

Every NodeZero action against critical servers is timestamped with proof-of-exploit detail — comparing the NodeZero attack timeline to SIEM detection telemetry surfaces gaps where the timely-analysis requirement isn't being met for that asset class.

Internal pentests probe whether database services and web services share a host or trust boundary — surfaces functional collocations that ISM-1269 requires to be split.

Chains attack paths from user workstations to database hosts — direct evidence of whether the ISM-1270 network-segment separation actually contains lateral movement.

Starts from a real database user's perspective and proves the account's blast radius across the host and adjacent systems — empirical evidence whether work-duty restrictions hold at the application layer. Schema-aware row/view-level access auditing is complementary work.