Security teams close attack paths faster by linking Horizon3 evidence to Torq workflows

Security operations often close remediation tickets while underlying exposures remain exploitable, leaving organisations vulnerable to further intrusion. Horizon3.ai reports that standard vulnerability findings fail to distinguish between theoretical weaknesses and those an attacker can actually chain together to reach critical assets. This gap means teams may prioritise low-impact fixes while ignoring high-value attack paths that traverse multiple systems.

How it unfolded

• Horizon3.ai published research detailing a new partnership with Torq designed to close the loop between attack path discovery and verified remediation.
• The integration connects NodeZero’s exploit testing capabilities directly into Torq’s security operations workflows, enabling automated coordination of fixes.
• NodeZero performs subsequent tests to provide proof that the applied changes have effectively neutralised the previously demonstrated attack paths.

Who is affected

Organisations relying on traditional vulnerability management tools face challenges in proving that remediation efforts have actually mitigated risk. According to Horizon3.ai, security teams are often overwhelmed by findings that do not reflect real-world exploitability. The new integration targets teams that need to connect technical exploit evidence with operational ownership, ensuring that the right teams address the most critical exposures across identity, endpoint, and cloud infrastructure.

The fix

The partnership leverages NodeZero to safely test production environments from defined starting positions, such as assumed-breach footholds. These tests chain vulnerabilities, misconfigurations, and credential weaknesses to demonstrate concrete attack paths. Torq then retrieves these findings, adds asset ownership context, and drives the remediation process through connected systems. Once fixes are applied, NodeZero re-tests the environment to confirm the attack path is broken, providing verifiable proof of remediation.

What analysts watch for

Analysts typically examine whether remediation efforts address the root cause of an attack path or merely patch a single component. They look for evidence that fixes have been applied across all systems involved in the chain, including identity and configuration settings. Teams usually verify that automated workflows have correctly routed tasks to the appropriate owners and that subsequent testing confirms the path is no longer exploitable.

What to do and how to stay safe: Horizon3

• Review current remediation workflows to ensure they include verification steps that prove an attack path is broken after fixes are applied.
• Identify which vulnerabilities in your environment can be chained together to reach critical assets, rather than treating them as isolated findings.
• Ensure that security operations platforms can ingest exploit evidence and coordinate actions across identity, endpoint, and cloud systems.
• Monitor for re-testing capabilities that allow you to confirm fixes hold against simulated attacks before closing remediation tickets.

Step-by-step guide: Incident Response Plans: Real Benefits and Hidden Costs

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does the Horizon3 and Torq integration work?

NodeZero tests environments to find exploitable attack paths, and Torq uses that evidence to automate remediation workflows across connected systems.

What does NodeZero do in this partnership?

NodeZero safely tests production environments to demonstrate how vulnerabilities, misconfigurations, and credential weaknesses chain together to form attack paths.

How do teams verify that a fix has worked?

NodeZero performs subsequent tests after remediation to provide proof that the previously demonstrated attack paths have been successfully blocked.