AutoAttack
vs NodeZero.
NodeZero is an automated pentest platform; AutoAttack is an autonomous adversary. On the hardened GOAD spec NodeZero published, both reach Domain Admin across all three domains, and AutoAttack reaches it far faster.
DeployHardened stage Ten independent runs
Ten runs on hardened GOAD: 51-second median.
Time to all three Domain Admins on the hardened spec NodeZero published: two forests, three domains, five Windows hosts.
NodeZero automated pentest
AutoAttack autonomous adversary
| Metric | NodeZero | AutoAttack |
|---|---|---|
| Time to 3/3 Domain Admin | 14m 00s | 0:51 About 16× faster |
| Domains reached | 3 of 3 | 3 of 3 |
| Independent runs | 1 published | 10 |
Same hardened GOAD spec NodeZero published: Windows Defender enabled, LLMNR disabled, Windows patched through March 2026. AutoAttack: median of 10 independent runs, fresh rollback each time, range 0:28 to 1:01. NodeZero published its 14:00 result in August 2025. AutoAttack reaches the same objective about 16× faster.
the ground
env Hardened GOAD: Windows Defender on, LLMNR disabled, patched through March 2026.
start Network position only. No credentials, no agent on any host — one container, nothing installed on any host.
goal Domain Admin on all three domains.
scoring Third-party: the GOAD range and an independent verifier both confirm each Domain Admin. See the run logs
what differs
fast AutoAttack's 0:51 median is about 16× faster than NodeZero's published 14m 00s (the same objective, on the same ground).
ten-run median AutoAttack's figure is the median of ten independent runs with a fresh rollback each time (range 0:28 to 1:01), not a single best result.
proof every step Every step of the chain to Domain Admin is captured as it runs, so the path is auditable rather than asserted.
the objective is yours The benchmark objective was Domain Admin; on your network you name what needs protecting in plain English and the adversary hunts the route itself: exploiting what it finds, chaining each foothold into the next, adapting when a route closes. The objective need not be a domain at all: on this site's own /use-cases/data-exfiltration the named objective is data, not Domain Admin.
what you get back One report: the path start to finish with the evidence attached; never a separate ranked findings list.
where NodeZero fits Buy NodeZero if the vendor relationship is what you need: a mature commercial platform, a support contract, a procurement path and a track record to reference. That is a real reason, and this page will not argue you out of it. AutoAttack is the newer entrant and deliberately narrower: one container, one objective you name in plain English — a login page to Domain Admin, a SaaS token to your data store — chained across your estate in one run, with nothing to adopt or procure before it starts.