Against Nessus Professional.
A black-box run: neither tool was given credentials.
See the full benchmark →| Black-box | Nessus Professional exposure inventory | AutoAttack autonomous adversary |
|---|---|---|
| Run time | 24m 04s | 2m 37s |
| First Domain Admin | not reached | 0:41 |
| Domains compromised | 0 of 3 | 3 of 3 |
| Credentials recovered | 0 | 124 |
| Confirmed compromise | none | 3 Domain Admin |
Black-box comparison: neither tool was given credentials. Same GOAD vanilla snapshot, same network position, 2026-06-24.
How it works.
Deploy in minutes
One command. The adversary phones home and starts.
It chains to your goal
An autonomous adversary turns one foothold into the next, working toward the objective you set.
Every step is proven
Each move is backed by evidence you can verify.
- Web app
- Host
- Network
- Domain Admin
What it reaches.
Against NodeZero.
On the hardened spec NodeZero published.
| Hardened | NodeZero automated pentest | AutoAttack autonomous adversary |
|---|---|---|
| Time to 3/3 Domain Admin | 14m 00s | 0:51 |
| Domains reached | 3 of 3 | 3 of 3 |
| Independent runs | 1 published | 10 |
Same hardened GOAD spec NodeZero published: Windows Defender enabled, LLMNR disabled, Windows patched through March 2026. AutoAttack: median of 10 independent runs, fresh rollback each time, range 0:28 to 1:01. NodeZero published its 14:00 result in August 2025. AutoAttack reaches the same objective about 16× faster.
Self-serve pricing.
Deploy and run a complete campaign at no cost. Findings stay redacted until you subscribe; your discovered host count sets the price.
See pricing →