Horizon3 raises $250M: pentesting is continuous now

Horizon3 raised a $250 million Series E at a valuation above $2 billion, roughly triple the $650 million it carried at its Series D just over a year ago. The product is NodeZero, an autonomous penetration testing platform that doesn't hand you a vulnerability list — it tries to exploit what it finds and chains the results into working attack paths. The valuation isn't the story. The shift in cadence is.

What actually happened

Per Horizon3's announcement on August 3, the oversubscribed round was co-led by existing investors NightDragon and NEA, with new money from Acrew, Blue Cloud Ventures, EDBI, PSG, SAIC, and Sapphire, plus returning backers including Craft Ventures, Qualcomm Ventures, and SignalFire.

The traction number that matters: NodeZero has run 310,000 production security tests across thousands of organizations, per Help Net Security's report on the round. Not lab tests — production networks, cloud accounts, Kubernetes clusters.

CEO Snehal Antani's framing is deliberately blunt: the company spent six years earning the right to autonomously pentest sensitive networks "with no humans in the loop." The roadmap money goes toward autonomous blue-team agents that remediate what the attacker agents find, closing the loop on both ends.

Why continuous pentesting matters for your business

Most small businesses buy a penetration test the way they buy a fire inspection: once a year, because a customer or insurer asked for it. You get a PDF, you fix the reds, you file it.

That model made sense when running an attack took a skilled human a week. It doesn't now. Unit 42 documented an autonomous campaign against 460+ targets that ran with almost no human input. Your attack surface is being probed continuously whether or not you're testing continuously. A once-a-year snapshot describes a network that no longer exists — you've since added an n8n instance, three SaaS integrations, and an AI agent with an API key.

You probably aren't buying NodeZero. The lesson is the cadence, not the vendor:

1. Inventory what has a public IP. Automation servers, admin consoles, staging environments. That list changes monthly and nobody owns it.
2. Attach a check to deploys, not to the calendar. An external port scan and a dependency audit in CI catch more than an annual review.
3. Test attack paths, not findings. "Low severity" plus "low severity" plus a reused credential is how breaches actually happen.
4. Write down who fixes it. Continuous findings with no owner is just a louder backlog.

Sources: Businesswire, Help Net Security, TechCrunch.