{"slug": "from-proven-attack-paths-to-verified-fixes-horizon3-and-torq-close-the-loop", "title": "From Proven Attack Paths to Verified Fixes: Horizon3 and Torq Close the Remediation Loop", "summary": "Horizon3 and Torq have partnered to connect NodeZero's attack-path proof with Torq's security operations workflows, so that NodeZero findings drive remediation and NodeZero then re-tests to verify the fix held. Torq's Horizon3 integration provides steps for retrieving pentests, weaknesses, attack paths, hosts and credentials, plus a GraphQL query step, using a Horizon3 API key and regional gateway URL; a User role key can schedule NodeZero verification tests while a Read-only key can retrieve results but not start tests. The companies frame the value as closing the gap where a remediation ticket is marked complete while the exposure remains exploitable, with Torq's Socrates AI SOC Analyst handling prioritization and Torq Hyperautomation and Case Management coordinating and tracking the work.", "body_md": "A remediation ticket can be closed while the exposure remains exploitable. A password change may leave other compromised credentials unaddressed. A configuration update may correct one system while the same weakness persists elsewhere. The work is recorded as complete, but the attacker still has a way through.\n\nSecurity teams are buried in findings, and most of them never lead anywhere an attacker cares about. What they need is proof at both ends of remediation: what an attacker can exploit before the fix, and whether the attacker can still exploit it after.\n\nThe [Horizon3 and Torq partnership](https://horizon3.ai/wp-content/uploads/2026/08/202610_SolutionsBrief_Torq_FNL.pdf) connects those steps. NodeZero® proves which weaknesses an attacker can exploit and where they lead. Torq brings that proof into security operations and drives the fix through the tools and teams that own it. NodeZero then attacks again to prove the fix held.\n\nThe value is in carrying that proof through the entire workflow: it decides what gets fixed first, who owns it, and when the work is actually done.\n\n## **Vulnerable Does Not Equal Exploitable. Exploitable Does Not Equal Impact.**\n\nA vulnerability finding identifies a weakness. It does not establish whether an attacker can reach and exploit that weakness in your environment. Successful exploitation then raises another question: what does that access enable?\n\nThe distinction matters when deciding what to fix first. A weakness that exposes a privileged identity or sensitive data can demand a different response from one that provides limited access to an isolated system. Severity alone cannot explain those relationships.\n\n[NodeZero](https://horizon3.ai/downloads/factsheets/operationalize-ctem-with-nodezero/) tests them. [NodeZero](https://docs.horizon3.ai/portal/) safely tests the production environment from a defined starting position, such as an assumed-breach foothold inside the network or the external perimeter, chaining vulnerabilities, misconfigurations, and credential weaknesses to demonstrate attack paths and resulting impacts.\n\nThis reveals how individual findings connect. A compromised credential may provide access to a host, where another weakness enables privilege escalation or further movement. Each step contributes to the outcome, but treating the findings as unrelated tickets can obscure which changes would interrupt the chain.\n\nAttack-path evidence gives remediation teams that context: which identities and systems are exposed, what an attacker achieved, and which single fix breaks several paths at once.\n\n## **Connect Attack Evidence to Security Operations**\n\nTorq’s Horizon3 integration provides steps for retrieving pentests, weaknesses, attack paths, hosts, and credentials, plus a GraphQL query step that opens the rest of the Horizon3 API to workflow builders. The connection uses a Horizon3 API key and the gateway URL for the relevant region. Using a User role API key, workflows can also schedule NodeZero verification tests; a Read-only key can retrieve results but cannot start tests.\n\nTorq workflows can retrieve NodeZero findings on a schedule or on demand. Each finding arrives with the attack-path impact NodeZero demonstrated, and Torq adds asset ownership from the organization’s other systems, connecting the technical evidence to the operational context needed to act.\n\nOwnership answers who can make the change. Attack-path context explains what the change is intended to prevent.\n\nOn the Torq side, Socrates, Torq’s AI SOC Analyst, supports prioritization, Torq Hyperautomation coordinates actions across connected systems, and Case Management tracks the findings and remediation process.\n\nTogether, they let customers use AI to fight AI: NodeZero proves exposure at machine speed, and Torq acts on that proof at machine speed. The organization decides which actions run automatically and what counts as done.\n\n## **Coordinate Remediation Across the Systems Involved**\n\nAn attack path can cross identity, endpoint, and cloud systems. Addressing it may require several changes owned by different teams.\n\nTorq workflows can coordinate those changes through Torq’s integrations with those tools. Actions include:\n\n- **Identity:** Force password resets, rotate exposed credentials, and revoke sessions where the identity provider supports it through automation.\n- **Endpoint:** Isolate impacted hosts or verify endpoint agent coverage.\n- **Cloud:** Remediate misconfigurations or restrict access.\n- **Collaboration and ITSM:** Notify responsible owners and open remediation tickets.\n\nConsider a credential NodeZero used to gain access. Torq routes the finding to the responsible owner, resets or rotates the credential through the identity provider, and revokes existing sessions so the stolen access doesn’t outlive the fix.\n\nTorq can then schedule a NodeZero verification test to determine whether the credential exposure remains exploitable.\n\n## **Match Verification to the Remediation Claim**\n\nAfter remediation, Torq uses a User role API key to schedule follow-up testing through NodeZero and retrieve the results. The verification method must fit the weakness and the claim the team wants to make.\n\nNodeZero’s 1-Click Verify retests specific weaknesses, reusing the configuration of the pentest that originally found them. That answers whether a given weakness is fixed. A claim about an entire attack path calls for a full pentest with enough scope to exercise the whole chain.\n\n1-Click Verify returns a resolution status for each weakness, compared against the original pentest. A resolved status proves that weakness is no longer exploitable within that test’s scope. It does not prove that every other route to the same target is closed; that is what a full pentest is for.\n\nA Torq workflow can use the resolution status to close the corresponding finding or route a persistent exposure back for further action. If NodeZero cannot schedule a verification test, for example because no runner is available, it reports the failure, and the workflow should route that finding for review rather than treat it as fixed.\n\nVerification becomes part of closing the work, not a step after it. Every closed finding carries who fixed it, how long it took, and the re-attack that proved it, which gives security leaders an accountable record of remediation instead of a count of closed tickets.\n\n## **Repeat as the Environment Changes**\n\nAs credentials, permissions, software, and configurations change, new exposures can emerge and previous ones can recur. Pentests scheduled in NodeZero, combined with scheduled retrieval of their findings in Torq, allow the workflow to repeat.\n\nNodeZero assesses the risk and proves the fix. Torq drives remediation across the systems and teams involved. Together, they take organizations from proven exposure to proven remediation, with an accountable record at every step.\n\n**Hack. Fix. Verify. Repeat on demand.**", "url": "https://wpnews.pro/news/from-proven-attack-paths-to-verified-fixes-horizon3-and-torq-close-the-loop", "canonical_source": "https://horizon3.ai/intelligence/blogs/horizon3-torq-verified-security-remediation/", "published_at": "2026-10-15 16:16:41+00:00", "updated_at": "2026-10-21 08:09:59.655348+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety"], "entities": ["Horizon3", "Torq", "NodeZero", "Socrates", "Torq Hyperautomation", "Torq Case Management"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/from-proven-attack-paths-to-verified-fixes-horizon3-and-torq-close-the-loop", "markdown": "https://wpnews.pro/news/from-proven-attack-paths-to-verified-fixes-horizon3-and-torq-close-the-loop.md", "text": "https://wpnews.pro/news/from-proven-attack-paths-to-verified-fixes-horizon3-and-torq-close-the-loop.txt", "jsonld": "https://wpnews.pro/news/from-proven-attack-paths-to-verified-fixes-horizon3-and-torq-close-the-loop.jsonld"}}