MSPs in Europe Can Now Access Autonomous Security Testing via Pax8

Horizon3 and Pax8 have expanded their partnership to make the NodeZero Proactive Security Platform available to managed service providers across Europe through the Pax8 Marketplace. This move allows partners to offer autonomous security testing services to small and midsize businesses, helping them identify exploitable weaknesses and verify that fixes work. The announcement was made on 16 October 2026 from Horizon3’s EMEA headquarters in Amsterdam, extending a relationship that previously launched in North America.

In plain English

Many businesses rely on managed service providers to keep their digital environments secure. Traditional security checks often produce long lists of vulnerabilities that are difficult to prioritize. This new arrangement gives those providers a tool that simulates real attacks to show which weaknesses actually matter. Instead of guessing which issues pose the greatest risk, partners can demonstrate specific paths an attacker might take to compromise a system.

The background

Horizon3 describes NodeZero as an AI-native proactive security platform that tests production environments using real attack techniques. It operates within defined scopes and safety controls to ensure stability. The system examines internal and external infrastructure, cloud services, and web applications. By chaining individual weaknesses together, it shows how they combine to allow unauthorized access or data exposure. This approach moves beyond isolated findings to provide evidence of successful exploitation and clear remediation guidance.

What changes now

European managed service providers can now access NodeZero through the Pax8 Marketplace. This enables them to build recurring security services that include initial assessments, remediation support, and ongoing validation. Partners can use the platform to test custom web applications for logic flaws and broken access controls that standard scanners might miss. The service includes white-labeled reporting and multi-tenant support, allowing providers to manage testing across multiple customers and incorporate results into their own service offerings.

Keith Poyser, General Manager and SVP EMEA at Horizon3, noted that vulnerability lists do not tell partners what is actually exploitable. He stated that NodeZero provides that specific information along with a way to fix and verify remediation. The expansion helps partners build services around measurable reductions in customer exposure. This includes evaluating exposure to vulnerabilities listed in CISA’s Known Exploited Vulnerabilities Catalog and repeating tests after infrastructure changes or application releases.

Key terms explained

Managed service providers often act as the primary security team for smaller organizations that lack internal expertise. Autonomous testing uses software to simulate attacker behavior without manual intervention for every step. This allows for frequent, repeatable checks rather than one-time annual audits. Teams usually focus on attack paths, which are sequences of weaknesses that lead to a breach. Verification is critical because it confirms that a fix actually blocks the demonstrated attack. Prioritization helps organizations address the most dangerous issues first, saving time and resources.

Background: Broken access control

Broken access control stems from trusting client-side inputs, relying on obscurity, and failing to verify permissions on every request. Fix these issues by implementing strict server-side checks, enforcing least privilege, and validating object-level access rights for every transaction.

Read the full guide: Broken Access Control Mistakes That Leave Systems Open

What to do and how to stay safe: Horizon3

• Check if your managed service provider now offers autonomous penetration testing services through platforms like Pax8.
• Ask your provider how they verify that remediation efforts have actually closed the demonstrated attack paths.
• Request reports that prioritize weaknesses based on their contribution to exploitable attack chains rather than just severity scores.
• Ensure your service agreements include ongoing validation after infrastructure changes or new application releases.

General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is NodeZero and who can use it?

NodeZero is a proactive security platform by Horizon3 that is now available to European managed service providers through the Pax8 Marketplace.

How does this differ from standard vulnerability scanning?

NodeZero chains weaknesses to demonstrate attainable attacker impacts and provides evidence of successful exploitation, rather than just listing isolated vulnerabilities.

Does this partnership cover web applications?

Yes, NodeZero WebApp supports authenticated testing for custom web applications to uncover exploitable weaknesses like broken access controls and business logic flaws.