Organisations validate security patches by linking Horizon3 attack data with Torq remediation workflows

Organisations managing complex security operations face a critical gap between identifying vulnerabilities and proving they are fixed. A remediation ticket may be marked complete while the underlying exposure remains exploitable to attackers. This partnership between Horizon3 and Torq addresses that risk by connecting real-world attack-path evidence directly into security operations workflows.

Why does vulnerability data often fail to guide remediation?

Vulnerability findings simply identify weaknesses without establishing whether an attacker can reach or exploit them in a specific environment. Severity scores alone cannot explain the relationships between findings or the actual impact of successful exploitation. A weakness exposing privileged identities demands a different response than one providing limited access to isolated systems. Treating these findings as unrelated tickets obscures which changes would effectively interrupt attack chains.

How does the integration prove fixes are effective?

NodeZero safely tests production environments from defined starting positions, such as an assumed-breach foothold or external perimeter. It chains vulnerabilities, misconfigurations and credential weaknesses to demonstrate specific attack paths and resulting impacts. After remediation teams apply fixes, NodeZero attacks again to prove whether the fix held. This provides proof at both ends of the remediation process, ensuring work is not recorded as complete while attackers still have a way through.

Which teams and systems are involved in the workflow?

Attack paths often cross identity, endpoint and cloud systems, requiring changes owned by different teams. Torq workflows coordinate these changes through integrations with relevant tools. The system uses asset ownership from other organisational systems to connect technical evidence to operational context. This answers who can make the change and explains what the change is intended to prevent, helping teams prioritise exploitable exposures over generic vulnerability lists.

What technical capabilities enable this automated verification?

The integration uses a Horizon3 API key and gateway URL to retrieve pentests, weaknesses and attack paths. Torq workflows can schedule NodeZero verification tests using a User role API key, while Read-only keys retrieve results without starting tests. Torq’s AI SOC Analyst, Socrates, supports prioritisation, and Torq Hyperautomation coordinates actions across connected systems. This allows customers to use AI to fight AI by proving exposure and acting on that proof at machine speed.

What affected people can do

Security teams should review their current remediation processes to ensure tickets are not closed based solely on configuration changes without verification. Check whether your organisation has mechanisms to re-test environments after fixes are applied to confirm attack paths are broken. Look for tools that connect vulnerability data with asset ownership to clarify responsibility. Be aware that unverified fixes may leave exploitable exposures open, and ensure your workflows include steps to validate that security controls actually block the demonstrated threats.

What to do and how to stay safe: Horizon3

• Verify that remediation workflows include a verification step to re-test attack paths after fixes are applied.
• Ensure vulnerability data is linked to asset ownership so the correct teams are assigned to address specific exposures.
• Use attack-path evidence to prioritise fixes that break multiple attack chains rather than addressing isolated findings.
• Monitor for any residual exploitable exposures by scheduling regular verification tests in your security operations platform.

Step-by-step guide: Spot Business Email Compromise: Hidden Signs and Immediate Response

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does NodeZero determine which vulnerabilities are exploitable?

NodeZero safely tests the production environment from a defined starting position, chaining vulnerabilities and misconfigurations to demonstrate actual attack paths.

Can Torq workflows start verification tests automatically?

Yes, workflows can schedule NodeZero verification tests if they use a User role API key, though Read-only keys can only retrieve results.

What types of systems can be coordinated through this integration?

The integration can coordinate remediation across identity, endpoint and cloud systems through Torq’s connections with those relevant tools.