Campaigns and Perspectives

Overview

NodeZero Campaigns help your organization track how your security posture changes over time, from the attacker’s viewpoint. A Perspective is automatically created every time you create and save a pentesting template. Campaigns allow you to organize perspectives into groups that align with your organization’s security initiatives, compliance goals, and team structures. With these two capabilities together, you can easily see how your results are changing over time, and get recommendations for additional pentest coverage.

Example scenarios:

• Define campaigns for different network segments or security zones to track the security posture of different segments over time.
• Use a campaign corresponding to different blue teams to keep track of fixer progress.
• Use campaigns to keep an eye on compliance-related test coverage to keep your compliance up-to-date.

Campaign View

The main view for a campaign looks like this:

This page contains the following elements:

• Campaign name and description. The campaign name also serves as a menu, allowing you to select a different campaign.
• Controls for searching, filtering and sorting the campaigns.
• A button to switch between compact and full mode.
• A button for adding a perspective to this campaign. This can be an existing perspective, or a new perspective from Horizon3’s recommendations based on best practices.

Switching Campaigns

Clicking on the name of the campaign opens a dropdown menu where you can select a different campaign or create a new one.

All Perspectives – the default campaign

Your organization automatically includes a campaign called All Perspectives that includes every perspective that has been defined. This is an easy way to get an overview of all your pentest activity at once. This default campaign cannot be deleted. These perspectives cannot be removed from the default campaign.

You can create new campaigns in addition to the default one. In these custom campaigns, you must specifically add the perspectives that belong to that campaign, and can remove them later.

Adding a new campaign

Use the campaign dropdown menu and select + Create New Campaign. This opens a modal allowing you to create a new campaign. In this modal, specify the name and description for your new campaign, then select all perspectives that should belong to this campaign. You can select all, some, or none of your existing perspectives. You can always change this later.

Note: the maximum length for the campaign name is 128 characters. The maximum length for the description is 256 characters.

Action Bar

At the top of the campaign page are controls that filter or sort the perspective list. You can search for perspectives by name, filter them by pentest type, exposure level, or other fields, and change the sort order of the perspective list.

Compact view

Clicking the compact view button will condense the perspective graphs, allowing you to fit more perspectives on your screen.

Add Perspective

Clicking + Perspective allows you to add a perspective to this campaign. You can either add an existing perspective to this campaign, or see a list of recommended perspectives based on best practices suggested by Horizon3.ai.

If you want to add existing perspectives, select the first option, and you will be able to select one or more perspectives to include in this campaign, similar to when you created the campaign:

Note: if you are currently looking at the All Perspectives default campaign, there’s no option to add an existing perspective, because this campaign always contains all existing perspectives.

Recommended Perspectives

You can add a perspective to your campaign by following suggestions based on Horizon3.ai’s best practices. This menu shows a priority list of the types of tests we recommend you add for more coverage. Once you have the basics covered, we’ll suggest more specific tests to cover cloud deployments, phishing tests, and more. By default, only the top 3 are shown. You can see all recommendations by clicking View All.

If you want to ignore a recommendation, you can click X to dismiss it. Selecting a recommendation will take you to the template form to create a new pentest configuration for this perspective.

Perspective List

The main element on the campaign page is the perspective list. Here you’ll find a list of each perspective in this campaign, showing the current exposure level, weakness count over time, and other details about each perspective. Each perspective has an option to view the details for that perspective, as well as an options menu for renaming or removing this perspective. Note: if this is the default campaign, perspectives cannot be removed.

Clicking on the Perspective Detail button navigates to a detailed view for this perspective, described below.

Perspective View

The perspective view gives you detailed information about the pentests, weaknesses, impacts, and threats associated with the pentests in this series. It tracks results longitudinally so you can see what’s getting better or worse.

Perspective Details

The perspective details card shows you basic information like name, pentest count, and schedule cadence. Click on these values to get more information about each one. Click on the Total Pentests count to see a modal with details about all pentest runs for this perspective.

Exposure Score

This is the overall exposure score for this perspective based on its most recent data (the last time the pentest ran). Click the link to learn more about how this is calculated.

Threat Diagram

This diagram represents potential attack vectors based on real-world threat actor intelligence. It shows flow from threat actor group, to exploited vulnerability, to impact, to business risk. Click on the different nodes in the diagram to learn more. This is based on the most recent pentest run in this perspective.

Weakness Charts

Next are four charts showing breakdowns of the weakness associated with this perspective, as of most recent data:

• First, a breakdown of weakness by status such as Open or Regressed.
• Then a breakdown of user-supplied annotation status
• Third is a breakdown by weakness criticality.
• Last, we have a breakdown of weakness by impact type, allowing you to see which impact categories are most common in this perspective.

Trends over time

At the bottom of the page are graphs showing activity in this perspective over time. There are graphs for weaknesses, impacts, and mean time to remediation. You can use dropdown menus to filter to specific categories and severity levels.