Finding security weaknesses is only part of the job for MSPs. Customers also need to know which gaps attackers could actually exploit.
Horizon3 announced Oct. 16 that it is expanding its Pax8 partnership across Europe, making the NodeZero autonomous penetration testing platform available to more managed service providers through the distributor’s marketplace.
For MSPs, the opportunity extends beyond an initial assessment to paid remediation work and recurring verification. Building a profitable service, however, requires accounting for licensing, engineering time, and responsibility for resolving customer findings.
Autonomous testing traces attack paths and verifies fixes
According to Horizon3, NodeZero uses real attack techniques within defined scope and safety controls to test production environments. Its coverage spans internal and external infrastructure, cloud deployments, and identity systems.
Vulnerability management can identify potential weaknesses; Horizon3 says NodeZero also connects weaknesses to demonstrate exploitable attack paths. Findings document how attackers could gain unauthorized access, escalate privileges or expose sensitive information, with supporting evidence and prioritized remediation guidance.
Horizon3 says NodeZero WebApp supports authenticated testing of custom web applications, including checks for broken access controls and business logic flaws. Its documentation notes that coverage depends on application reachability, authentication, and the routes and functions discovered during testing.
After teams address identified problems, follow-up testing can establish whether previously demonstrated attacks remain possible.
Pax8 expands partner access to recurring security services
A July 2025 agreement already cited NodeZero’s availability in North America and Europe through the Pax8 Marketplace. The latest announcement focuses on extending the partnership’s reach to more European MSPs.
Multi-tenant management allows providers to administer assessments across customer accounts, while MSP-oriented licensing supports delivery under their own service models. Eligible licenses also permit customized PDF reports displaying a partner’s branding and company information.
MSPs can develop services covering initial penetration tests, remediation engagements and subsequent verification of completed fixes. Threat-focused assessments offer another option, allowing partners to examine customer exposure to supported vulnerabilities in CISA’s Known Exploited Vulnerabilities Catalog.
Recurring programs can include security checks following infrastructure changes, application releases, or updates to protective controls. Partners across Europe can obtain offering details from their Pax8 representatives.
European MSPs should assess service costs and customer responsibilities
Before adding NodeZero to their portfolios, MSPs should evaluate the work involved in delivering a complete customer engagement. Several considerations can help determine whether the service is commercially viable.
- Calculate delivery costs. Licensing is only one expense. Engineers must define the scope, interpret findings and coordinate corrective work. Comparing staff hours with expected recurring fees can help providers establish realistic margins.
- Establish customer authorization. Contracts should identify permitted assets and approved testing windows, along with escalation procedures and responsibility for service disruptions. MSPs working with third-party infrastructure must also confirm testing permissions and agree on how sensitive findings will be handled.
- Track remediation outcomes. Providers already offering managed vulnerability remediation should assign confirmed weaknesses to named owners with deadlines, separating work within their control from changes requiring customer approval. Documenting completed actions alongside unresolved risks gives clients a concrete measure of progress and a basis for evaluating ongoing security spending.
Before quoting customers, MSPs should confirm licensing costs, including testing capabilities, and reporting entitlements with Pax8. A repeatable service should also define who fixes each finding, whether remediation is included or billed separately, and when verification occurs. These details help partners price the work and show customers what each engagement accomplished.
More EMEA news: Nvidia’s five-year UK initiative could create new opportunities for cloud providers supporting research into AI agent security and emerging threats.