Compare · network platforms · checked 2026-11-08

NodeZero vs Pentera

In brief

Both attack internal and external networks, Active Directory, cloud and web apps on their own. Horizon3 publishes NodeZero’s prices: $15 per asset per test, or $50 to $85 per asset a year for unlimited tests. Pentera publishes none on its site; its own AWS listing shows $120,000 for 12 months. 19 other platforms here also test networks or Active Directory.

Side by side

Horizon3 NodeZero and Pentera compared
	Horizon3.ai NodeZero	Pentera
Tests	Networks, Active Directory, Cloud, Web apps, APIs	Networks, Active Directory, Cloud, Web apps, APIs
Runs as	SaaS; internal tests run from a Docker host or OVA you set up in your network, external tests from Horizon3's cloud	Not stated on its own pages
Published price	Per asset, 12-month term: Flex $15 per asset per test; Core $50, Pro $65, Elite $85 per asset (unlimited tests); WebApp Flex $10,000 per app per test	No price on its own site; its own AWS Marketplace listing shows a 12-month contract at $120,000, with private offers on request
How findings are checked	Not stated	Not stated
Founded	2019	2015
Headquarters	San Francisco, USA	Burlington, MA, USA / Tel Aviv, Israel

Platform

NodeZero

Horizon3.ai · horizon3.ai

Autonomous pentesting platform that attacks internal and external networks, Active Directory, cloud, Kubernetes and web apps in production, chains weaknesses into attack paths, and re-tests fixes.

Tests: Networks, Active Directory, Cloud, Web apps, APIs
Runs as: SaaS; internal tests run from a Docker host or OVA you set up in your network, external tests from Horizon3's cloud
Price: Per asset, 12-month term: Flex $15 per asset per test; Core $50, Pro $65, Elite $85 per asset (unlimited tests); WebApp Flex $10,000 per app per test

Checked 2026-11-088 sources: horizon3.ai, horizon3.ai, horizon3.ai

Platform

Pentera

Pentera (formerly Pcysys) · pentera.io

Automated security validation platform that runs real attack chains in production across internal and external networks, Active Directory, cloud and web apps, with modules Pentera Core, Surface and Cloud.

Tests: Networks, Active Directory, Cloud, Web apps, APIs
Price: No price on its own site; its own AWS Marketplace listing shows a 12-month contract at $120,000, with private offers on request

Checked 2026-11-086 sources: pentera.io, pentera.io, pentera.io

NodeZero pricing, in full

As published on Horizon3's pricing page. All plans are on a 12-month term.

NodeZero published prices
Plan	As published	What it covers, per Horizon3
NodeZero WebApp Flex	$10,000 per asset, per test. Apps count each time they are tested. 12-month term.	Autonomous web application pentesting; add-on to any package or standalone
NodeZero WebApp Continuous	Custom pricing. Priced per app. Volume pricing ... Unlimited Testing of Each Licensed App	Continuous autonomous web app pentesting
NodeZero Flex	$15 per asset, per test. 12-month term. No add-ons.	Episodic internal/external/cloud/K8s/AD autonomous pentest
NodeZero Core	$50 per asset, unlimited. Each asset counts once per 12 months.	Unlimited autonomous infra pentests + scheduling
NodeZero Pro	$65 per asset, unlimited	Core + Tripwires + Rapid Response
NodeZero Elite	$85 per asset, unlimited	Pro + risk-based exposure mgmt, vuln prioritization

What that comes to

NodeZero list price for example asset counts
Assets	Core, a year	Elite, a year	Flex, 4 tests a year
100	$5,000	$8,500	$6,000
500	$25,000	$42,500	$30,000
2,000	$100,000	$170,000	$120,000

Multiplication of Horizon3’s list prices, before any discount, support plan or web-app testing. Horizon3 lists optional support at 10% or 20% of the annual subscription (minimums $7,500 and $25,000). Horizon3 pricing, checked November 8, 2026.

Pentera pricing

Pentera’s site has no pricing page and sells through demos. The one figure Pentera itself publishes is on its AWS Marketplace listing (“Sold by: Pentera”): a 12-month contract at $120,000, with an invitation to ask for a private offer (listing, checked November 8, 2026). Estimates published by other companies, including competitors, are left out here.

What Pentera’s own pages say about the product:

Says it is used by over 1,000 CISOs worldwide.
Includes ransomware emulation against named families (LockBit, BlackCat, Play, Cl0p, REvil, Conti, Maze) and offline cracking of Active Directory password hashes.

Alternatives for networks and Active Directory

Other commercial platforms whose own pages say they test networks or Active Directory, ordered by how much they publish.

Alternatives to NodeZero and Pentera
Platform	Tests	Runs as	Price
Aikido AI Pentestaikido.dev	Web apps, APIs, Networks, Mobile, LLM apps, AI agents, Code	SaaSSelf-hosted	Typical pentest $4,000 / €3,500 / £3,000 per assessment
Ethiackethiack.com	Web apps, APIs, Networks, Cloud, Mobile	SaaS	Pentest from €3,000 per test
Neoprojectdiscovery.io	Web apps, APIs, Code, Networks, Cloud, Mobile	SaaSSelf-hosted	Free $0
Penligentpenligent.ai	Web apps, APIs, Networks	Self-hostedDesktop	Free $0
Pentipenti.ai	Web apps, APIs, Networks, Active Directory, Cloud, Mobile, LLM apps	SaaSSelf-hosted	Starter $20/mo
TurboPentestturbopentest.com	Web apps, APIs, Networks, Code, Cloud, LLM apps	SaaS	$99 per pentest (Audit-Ready: 1 target, 4 agents)
XHack AIxhack.io	Web apps, APIs, Networks, Active Directory, Cloud, Mobile, Code, LLM apps	SaaSDesktop	Individual AI plans $20 / $49 / $150 per month
Escape AI Pentestingescape.tech	Web apps, APIs, Networks, LLM apps, AI agents, Code	SaaSSelf-hosted	On-Demand AI-Powered Pentest $3,000 (12-month contract) on Escape's own AWS Marketplace listing
FireCompassfirecompass.com	Web apps, APIs, Mobile, Networks, Active Directory, LLM apps	SaaSSelf-hosted	Not published
Helix Cyberhelix.ml	Web apps, APIs, Networks, Code, Cloud, LLM apps	SaaS	Black box $3,000
Ostorlab Agentic Deep Scan (Agentic Pentest)ostorlab.co	Mobile, Web apps, APIs, Code, Networks	SaaSSelf-hosted	Agentic Pentest one-time: Core $500, Advanced $2,000, Elite $4,000 (30-day retest window)
Sablevulnetic.ai	Web apps, APIs, Networks, Active Directory, Cloud, Mobile	SaaSSelf-hostedDocker	Practitioner $300/mo (web app, API, network and AD assessments, report, retests)
Sara Pentestsynack.com	Web apps, Networks	SaaS	From $5,085 for 1 Standard Sara Pentest (one-time or recurring monthly)
StealthNet AIstealthnet.ai	Web apps, APIs, Networks, LLM apps	SaaS	StealthStrike (AI-only) $1,500 for a single small scope
Breach360breachlock.com	Web apps, APIs, Networks	Self-hostedCLIDocker	Not published
RidgeBotridgesecurity.ai	Networks, Web apps, APIs, Active Directory	SaaSSelf-hosted	Not published
RidgeGenridgesecurity.ai	Web apps, APIs, Networks, Active Directory	Self-hosted	Not published
Terra Platformterra.security	Web apps, APIs, Networks, Cloud, Mobile, LLM apps, AI agents	SaaSSelf-hosted	Not published
Prancer (SwarmHack)prancer.io	Web apps, APIs, Networks, Active Directory, Cloud, Code, LLM apps, AI agents	SaaSSelf-hosted	Not published

Open-source agents that test networks

Open coreO·01

PentAGI

VXControl · github.com

A self-hosted multi-agent system: you describe a target and goal in plain language, and a team of AI agents plans the test, runs security tools inside an isolated Docker sandbox, keeps a memory of what worked, and writes a report.

GitHub: 34k stars · v2.2.0, 2026-10-05
Licence: MIT
Tests: Web apps, Networks
Runs as: Docker Compose (self-hosted web UI with REST and GraphQL APIs)

Checked 2026-11-083 sources: github.com, pentagi.com, vxcontrol.com

Open sourceO·02

PentestGPT

Gelei Deng (GreyDGL) and co-authors · github.com

An agent that drives Claude Code or Codex through staged reconnaissance, exploitation and reporting against a CTF box or pentest target; the original research version, which guides a human tester step by step, is kept as an interactive mode.

GitHub: 16k stars · v1.0.0, 2025-12-24
Licence: MIT
Tests: CTFs, Web apps, Networks
Runs as: CLI / Docker

Checked 2026-11-088 sources: github.com, pentestgpt.com, usenix.org

Open sourceO·03

HexStrike AI

0x4m4 / OTT Cybersecurity LLC · github.com

An MCP server that lets an AI client such as Claude Desktop, Cursor or VS Code Copilot run a large catalogue of locally installed security tools against a target, with a decision engine that picks tools and parameters.

GitHub: 13k stars
Licence: MIT
Tests: Web apps, Networks, Cloud, CTFs
Runs as: MCP server (self-hosted Python)

Caution Check Point (2 Sep 2025) reported threat actors on dark-web forums claiming to use HexStrike AI to exploit three Citrix NetScaler flaws (CVE-2025-7775, CVE-2025-7776, CVE-2025-8424) within days of disclosure, cutting exploitation time 'from days to under 10 minutes'; The Hacker News reported the same on 3 Sep 2025. The README itself warns that it gives AI agents powerful system access and should run in isolated VMs. Source.

Checked 2026-11-084 sources: github.com, blog.checkpoint.com, thehackernews.com

Open coreO·04

CAI (Cybersecurity AI)

Alias Robotics · github.com

A Python framework for building AI agents that carry out offensive and defensive security work such as CTFs and bug-bounty testing; archived in 2026 as a research artifact.

GitHub: 9.9k stars
Licence: Mixed: MIT for code derived from openai-agents-python; Alias Robotics research-use licence (non-commercial research and academic use only) for its own additions
Tests: Web apps, APIs, Networks, CTFs
Runs as: CLI / Python library (pip install cai-framework)

Caution The maker itself warns that the archived framework is unmaintained attack tooling: dependencies will age and the prompt-injection weaknesses it documented will not be fixed, so it should run only in isolated environments against authorised targets and never as part of a production security programme (its README). Source.

Checked 2026-11-088 sources: github.com, github.com, aliasrobotics.com

Open coreO·05

Decepticon

Bitter Security · github.com

An autonomous red-team agent that starts from an operator-approved scope and rules of engagement and runs multi-stage attack chains (recon, exploitation, privilege escalation, lateral movement, C2) from a Kali sandbox.

GitHub: 6.6k stars · v2.2.2, 2026-10-28
Licence: Apache-2.0
Tests: Web apps, Networks, Active Directory, Cloud
Runs as: Docker (CLI and web dashboard, self-hosted); SaaS (app.decepticon.red); Python SDK; MCP server

Checked 2026-11-085 sources: github.com, decepticon.red, decepticon.red

Open sourceO·06

Cairn

oritera (起零衍迹) · github.com

A general problem-solving engine in which worker agents share a graph of confirmed facts and planned next steps to search for a path from a starting point to a goal; penetration testing and CTFs are the first domain it was tested on.

GitHub: 4.9k stars · v0.2.1, 2026-05-10
Licence: AGPL-3.0
Tests: Networks, CTFs
Runs as: Docker Compose (server, dispatcher and worker containers); local mode without Docker

Checked 2026-11-081 source: github.com

Questions

How much does NodeZero cost?

Horizon3 publishes per-asset prices on a 12-month term: NodeZero Flex at $15 per asset per test, or unlimited testing at $50 (Core), $65 (Pro) or $85 (Elite) per asset a year. An asset is a server, workstation, network device or cloud resource. Web app testing (WebApp Flex) is $10,000 per app per test.

How much does Pentera cost?

Pentera publishes no price on its own site. Its own AWS Marketplace listing shows a 12-month contract at $120,000 and invites buyers to ask for a private offer.

Which is cheaper, NodeZero or Pentera?

It depends on how many assets you test, and Pentera’s quote is private. At NodeZero Core’s list price, 500 assets cost $25,000 a year and 2,000 assets $100,000; Pentera’s only public figure is the $120,000 AWS contract. Ask both for a quote on the same asset count.

What is the difference between NodeZero and Pentera?

Both run real attack chains against internal and external networks, Active Directory, cloud and web apps. Horizon3 sells NodeZero mainly as SaaS, with an agent inside your network for internal tests, and publishes its prices; Pentera publishes neither its deployment model nor a price on its own pages. Horizon3 says NodeZero Federal holds FedRAMP High authorisation.

What are the alternatives to Horizon3 and Pentera?

19 other platforms here say they test networks or Active Directory, and open-source agents such as PentAGI, PentestGPT, HexStrike AI can be pointed at internal networks you are authorised to test.

06 · sources

Sources for this page

Horizon3.ai: NodeZero pricing — Every NodeZero price and the support percentages.
Pentera on AWS Marketplace — The $120,000 12-month contract, sold by Pentera.
Horizon3.ai: product, company and news pages — What NodeZero tests, FedRAMP High, deployment.
Pentera: product and company pages — What Pentera tests, its modules, founding and headquarters.

Each tool’s own sources are linked from its entry. How tools are chosen and ordered, and how to correct an entry: methodology.

Cite this page

AI Pentesting Tools. “Horizon3 NodeZero vs Pentera: pricing and alternatives.” Updated November 8, 2026. https://aipentestingtools.com/nodezero-vs-pentera/