Horizon3 Took Five Years to Reach…

1. Key Themes

Theme: Channel-first distribution created capital-efficient hypergrowth

Horizon3 built a partner (MSSP) motion before a direct sales force, and the product was designed so partners could run it without specialist skills.

Distribution through partners carried most of the customer base

"By early 2025, managed security service providers fully serviced 80% of its 3,000 customers, and partner-sourced pipeline had grown 106% year over year."

"Roughly 70% of customers are now served through MSSPs... Partners use NodeZero both to deliver testing and to expand into higher-value work."

Product design and packaging made the channel scale

"NodeZero was agentless from the start, with the attack logic built in, so a provider running IT for a small defense supplier could launch a full internal pentest for that client and read the results the same day."

"The shift that scaled MSSP adoption was packaging that turned NodeZero into a high-margin services engine: unlimited or elastic testing, multi-tenant controls, Fix Actions, 1-Click Verify, and clear evidence that lets partners sell remediation, continuous validation, and advisory services on top."

Theme: Frequency-based subscription pricing turns a compliance product into an operating tool

Moving from annual to continuous testing drove retention, expansion, and data generation at once.

Testing cadence is the business model

"About 80% of customers moved from an annual test to a monthly one, while 40% went weekly. That single shift is the whole business model. A yearly pentest is a compliance line item. A weekly one is an operating tool, which is why expansion revenue grew 111% in 2024 and net dollar retention reached 125% by 2026."

Retention math underpins the investor appeal

"At 95% gross retention, a $100M base sheds about $5M a year to churn and downgrades. At 125% net retention, that same base grows to roughly $125M before a single new logo signs."

Theme: Proprietary data from the hardest product is the moat, and the Series E funds a research lab to monetize it

Choosing internal production pentesting gave Horizon3 behind-the-firewall attack data that competitors can't buy.

Hard wedge produces unbuyable data

"Horizon3 started with the hardest version of the job, internal pentesting of live production networks, and that choice handed it something rivals could not buy: data from behind the firewall."

Craft Ventures came away calling Horizon3 "a data company," because every pentest teaches the system how attackers chain harvested credentials, misconfigurations, product defaults and live vulnerabilities.

The data volume funds a frontier lab

"Horizon3 estimates it now collects 30 billion tokens of cleanly labeled attack-and-defense data a day."

"We've spent years collecting the attack-and-defense data required to research these systems... The next step is to use that verified attack-path evidence to improve how offensive and defensive agents work together in environments that actually matter."

The flywheel is explicit

"The channel brings customers. Frequent testing creates data. The lab turns that data into better agents, and better agents make the weekly test worth more, which pulls in the next customer."

Theme: Capital efficiency and staged fundraising, raising when proof matches the round

Most of the business was built on a small amount of capital, with large rounds raised after the engine was proven.

Late-heavy capital structure

"Horizon3 raised $350M of its $428.5M total in its last two rounds. ... so Horizon3 built most of the business on the first $78.5 million and raised the rest once the engine was proven."

Each round sold a different proof point

"Every round brought a different kind of backer, and each one paid for a different piece of evidence."

"Growth got Horizon3 the meeting. The efficiency metrics and the data asset carried the round, and that is the order to prepare in if you are heading into a growth raise."

Efficiency benchmarks

"With about 550 employees, Horizon3 runs near $182,000 of ARR per head."

"By the Series D in June 2025, the company was Rule of 40 positive while still growing ARR above 100%."

Theme: AI-vs-AI cyber and market tailwinds

The field is crowded but expanding, and AI-driven attack/defense is framing the category.

Competitive and market context

"Pentera passed $100M ARR in January 2026, and XBOW raised $120M at a valuation above $1B two months later. Gartner expects global security spending to reach $240 billion in 2026, so several of these companies can win at once."

"Horizon3 coined the concept of cyber warfare being AI vs. AI, and that future has arrived," DeWalt said in the funding release.

2. Contrarian Perspectives

Go channel-first, not direct-sales-first

View: Most founders build a direct enterprise sales team and add partners later; Horizon3 inverted this.
Evidence: "The usual move is to build a direct enterprise sales team and bolt on partners later. Horizon3 did it the other way." Result: MSSPs served 80% of the first 3,000 customers, sales cycles in late 2024 ran 34% shorter, and NPS was 88.

Reallocate spending toward sales during a downturn instead of cutting

View: When capital tightened, Horizon3 redirected cost rather than shrinking.
Evidence: "Horizon3 funneled its $3 million into the revenue engine when the reflex everywhere was to shrink." Antani: "We reinvested that money in sales and marketing, explicitly choosing to sell through the downturn. Revenue grew nearly fivefold year over year."

Raise late and big, building on little capital

View: Prove the engine on modest capital, then raise large rounds at high multiples.
Evidence: About 82% of total capital came in the last two rounds; valuation moved "from $650 million to more than $2 billion in about a year" (the article's own framing, with the round landing "near 20 times revenue"). The market "still pays up for companies holding above 100% growth."

3. Companies Identified

Horizon3 (Horizon3.ai)

Description: Maker of NodeZero, an autonomous AI pentesting platform.
Why mentioned: Subject of the article; reached $100M ARR in about five years.
Quote: "It passed $100 million in October 2026, with 95% gross dollar retention and 125% net dollar retention."

NodeZero

Description: Horizon3's agentless, self-service autonomous pentesting product.
Why mentioned: The core product and data-generation engine.
Quote: "It is an AI system that attacks a company's own production network the way a real intruder would, then proves which fixes actually closed the hole."

SignalFire

Description: VC firm.
Why mentioned: Led seed, Series A, and Series B.
Quote: "Seed, January 2020: $3.5M led by SignalFire, closed after Antani collected two term sheets."

Craft Ventures

Description: VC firm.
Why mentioned: Led the $40M Series C in 2023; validated the product via a hands-on test.
Quote: "Before writing the check, Craft asked operating partner Bil Hamer, a five-time CISO, to run NodeZero on his own network. He had a pentest going within minutes."

NEA

Description: VC firm.
Why mentioned: Led the $100M Series D and co-led the Series E.
Quote: "NEA led the $100M Series D in June 2025 and took a board seat through Lila Tretikov."

NightDragon

Description: Cybersecurity-focused investment firm.
Why mentioned: Co-led the $250M Series E.
Quote: "For the Series E, NightDragon co-led alongside NEA, and founder Dave DeWalt... joined the board."

Sapphire Ventures, PSG, Acrew Capital

Description: Returning investors.
Why mentioned: Participated in the oversubscribed Series E.
Quote: "The round was oversubscribed, with seven new investors and five returning backers, among them Sapphire Ventures, PSG and Acrew Capital."

SAIC and EDBI

Description: Strategic investors (SAIC; Singapore's EDBI).
Why mentioned: Strategic money aligned with international expansion.
Quote: "Strategic money from SAIC and Singapore's EDBI that lines up with a planned push into Singapore and Australia."

NSA (Continuous Autonomous Penetration Testing program)

Description: US agency using NodeZero for defense contractors.
Why mentioned: Validation and distribution case study.
Quote: "That program reached 200 companies in year one and surfaced 50,000 vulnerabilities."

Pentera

Description: Competitor in automated pentesting/validation.
Why mentioned: Evidence the field is filling in.
Quote: "Pentera passed $100M ARR in January 2026."

XBOW

Description: AI security startup.
Why mentioned: Competitor/peer raising at unicorn valuation.
Quote: "XBOW raised $120M at a valuation above $1B two months later."

Deloitte (Technology Fast 500)

Description: Ranking publisher.
Why mentioned: Third-party validation of growth.
Quote: "Deloitte ranked it the third fastest-growing company in North America on its 2025 Technology Fast 500, with 19,939% revenue growth from 2021 to 2024."

Silicon Valley Bank

Description: Failed bank.
Why mentioned: Crisis case study in treasury risk.
Quote: "When Silicon Valley Bank collapsed, every dollar Horizon3 held sat inside it."

Splunk, GE Capital, IBM

Description: Antani's prior employers.
Why mentioned: Source of operating skills.
Quote: "IBM taught me product discipline, GE Capital taught me organizational and CIO-level prioritization, and Splunk taught me how to scale through hypergrowth."

4. People Identified

Snehal Antani

Description: Co-founder and CEO of Horizon3; former Splunk CTO and first CTO of JSOC.
Why mentioned: Subject and primary source.
Quote: "My role as JSOC's first CTO shaped the company most... 'Don't tell me we're secure. Show me.'"

Anthony Pillitiere

Description: Co-founder; Air Force veteran and former deputy CTO within US Special Operations Command.
Why mentioned: Co-founder met at JSOC.
Quote: "At JSOC he met Pillitiere... who became his co-founder."

Dr. Z. Berkay Celik

Description: Purdue associate professor and co-director of the Purdue Security Laboratory.
Why mentioned: Leads the Adversarial Intelligence Frontier Lab.
Quote: "Horizon3 is launching the Adversarial Intelligence Frontier Lab under Dr. Z. Berkay Celik."

Dave DeWalt

Description: NightDragon founder; former CEO of FireEye and McAfee.
Why mentioned: Joined the board; framed the AI-vs-AI thesis.
Quote: "Horizon3 coined the concept of cyber warfare being AI vs. AI, and that future has arrived."

Bil Hamer

Description: Craft Ventures operating partner and five-time CISO.
Why mentioned: Ran NodeZero as diligence before Craft invested.
Quote: "He had a pentest going within minutes."

Lila Tretikov

Description: NEA head of AI strategy; former deputy CTO of Microsoft.
Why mentioned: Took the board seat at NEA's Series D.
Quote: "Took a board seat through Lila Tretikov, its head of AI strategy and a former deputy CTO of Microsoft."

Morgan Kyauk

Description: NightDragon investor.
Why mentioned: Assessed go-to-market quality.
Quote: "Called the go-to-market motion 'incredibly efficient, highly scalable.'"

5. Operating Insights

Build the product so the partner can run it, and price it so the partner earns a margin

Design for the service provider who already owns the customer relationship.

"If your buyer already hands the work to a service provider, build the product so the provider can run it, price it so the provider earns a margin and treat that partner as your first sales team."

Bank in at least two places and reallocate before cutting

SVB nearly ended the company; the downturn playbook was cost redirection.

"Bank in at least two places and keep a payroll buffer outside your primary bank... Then reallocate before you cut."

"A missed payroll could have triggered about $750,000 a day in California penalties, enough to end the company inside a week."

Prepare for a growth raise in order: growth, efficiency, then the data/platform story

Diligence moved from ARR growth to operational excellence to platform defensibility.

"The focus then shifted to operational excellence: sales efficiency, burn multiple, net dollar retention, gross dollar retention, pipeline coverage, channel contribution, and sales rep attainment. We were in the top 10% or top 25% for each metric."

6. Overlooked Insights

Antani learned fundraising late and had to rebuild the pitch repeatedly

The first-time founder gap was storytelling, closed by iterating after every meeting.

"'The first time, you kind of suck,' he said. 'You have to invest in being a good storyteller.' He rebuilt the deck and the model after every meeting until the seed came together."

Module attach rate and training-data growth were cited as public-company evidence

Platform expansion metrics, not just ARR, underpinned the long-term story.

"Our module attach rates, such as the percentage of customers using our deception module, together with the growth in training data, made clear that we had the potential to become a public company serving a large total addressable market."