NIST Cybersecurity Framework v2.0

Enumerates every reachable host from the attacker perspective — often surfacing hardware assets the CMDB doesn't know about.

Infers the small set of crown-jewel assets that carry most of the business risk — executive and finance accounts, ERP systems, domain controllers — and prioritises the attack paths that reach them.

Identifies and validates the application-layer vulnerabilities infrastructure testing does not reach — OWASP Top 10 weaknesses, access-control failures and business-logic flaws in bespoke applications — each proven by real exploitation rather than inferred.

Correlates your validated attack paths with MITRE ATT&CK techniques and named threat-actor campaigns — concrete threat-intelligence evidence.

The Vulnerability Management Hub tracks each proven weakness through team-decided states (To Do, Fixed, Risk Accepted, False Positive) alongside system-observed Open, Mitigated and Regressed status, and Vulnerability Risk Intelligence re-ranks by real exploitability — evidence for the prioritised-and-tracked slice of ID.RA-06 across the technical-risk portfolio NodeZero has proven. Risk appetite and communication remain organisational.

Audits credentials on user, service, privileged, and break-glass accounts; first AI to solve GOAD in 14 minutes (Horizon3-reported) — it is not uncommon for NodeZero to crack more than 50% of the passwords it tests on a first audit.

Takes credentials captured by your phishing tool into a supporting internal pentest and proves what each stolen credential can actually reach — data, admin access, cloud pivot, domain compromise — showing where a phished credential was not contained by MFA or least privilege.

Visualises AD attack graphs to over-privileged accounts — makes the separation-of-duties and least-privilege failures visible.

Enumerates IPs, ports, services, and applications to validate that segmentation actually enforces the logical boundaries PR.IR-01 requires.

Reports per-host and per-vendor block/allow across 40+ EDR vendors with every permitted action mapped to MITRE ATT&CK — evidence that endpoint controls are actually enforcing.

Exploits unpatched and end-of-life software — proof of which maintenance gaps create actual attack paths.

Auto-classifies the exfiltratable data an attacker can reach against 12 business-risk categories (Sony, Equifax, SolarWinds, Verkada, CloudNordic analogs).

AWS credentials files, MySQL dumps, and Windows process monitors placed where NodeZero's already reached — silent until triggered, then routed to your SIEM.

Kerberoasting bait, AS-REP decoys, and domain-user scraping bait catch the exact techniques real attackers use against AD.

Every NodeZero action is timestamped with proofs and commands — correlate with your SIEM to find logging gaps and validate whether analysis of adverse events actually works.

Every validated attack chain is scored for business impact and mapped to the crown-jewel assets it reaches — concrete impact and scope estimates per chain.

Each validated attack path is correlated with MITRE ATT&CK techniques and named threat-actor campaigns, so analysis carries the threat context built in.

Post-incident, re-run the exact attack chain to get proof the containment mitigation actually holds.

Every ticket carries the attack-path context your response team needs, with Open → Mitigated → Regressed lifecycle tracking to confirm eradication.

Regression detection flags when a recovered system drifts back to a previously vulnerable state — early warning that the restoration produced the same weakness.