Horizon3.ai alternatives in 2026: Escape vs NodeZero and 4 more tools

Application security and network security are not the same buyers. That was true before this year's Black Hat, and it was still true walking the floor, where every conversation eventually arrived at AI agents testing AI-built software, and nobody could agree on what that meant in practice (yes, we've heard the question "What's your differentiation?" 1 min into the conversation so many times).

Horizon3 picked that moment to launch NodeZero WebApp Pentesting and close a $250M round.

Which raises the questions teams evaluating Horizon3 keep asking us. How well does it test web apps and APIs on top of the network? Does it handle authenticated, multi-user coverage? Will it catch the same vulnerability the second time it ships? And will developers act on the findings, or file them next to everything else they were sent this quarter?

Here is the shape of the problem. In July, Escape's research team found a flaw in Keycloak, now CVE-2026-17059. A restricted admin queries the main users endpoint and gets correctly filtered results. It queries the endpoint listing a role's members, where the same filter was never applied, and receives everyone's name and email. Every request well-formed, every response a 200. Nobody breaks in. Nothing moves laterally. The endpoint hands the same account everyone's email and name.

This article is for security teams who have already looked at Horizon3.ai and found it's missing the application layer they need to continuously pentest at scale, or are looking for solutions that cover both network and web apps. We'll walk through common Horizon3.ai alternatives, where each one shines, and where the differences start to matter at scale.

TL;DR

Escape is the strongest Horizon3.ai alternative in 2026 for engineering-first teams whose risk sits where an external attacker stands: the internet-facing perimeter or in the business logic of web applications, APIs, and LLM-backed endpoints.

NodeZero works inside-out, proving how far an attacker travels once they have a foothold. Escape works outside-in, mapping what you expose and proving what can be exploited without travelling at all: broken authorization across user roles, tenant isolation failures, business logic flaws.

Trusted by security teams at Applied, Visma, BetterHelp, Schibsted, DoubleVerify and Adyen, Escape is purpose-built to multiply the impact of small security teams protecting hundreds or thousands of applications.

Where each NodeZero alternative tool fits

• Horizon3.ai NodeZero — autonomous testing across network, identity and infrastructure, now extending into web applications as the entry point to those attack paths
• Escape — continuous AI pentesting across the exposed perimeter, web applications, SPAs, APIs, and LLM-backed apps
• Pentera — agentless automated security validation across network and identity
• XBOW — periodic autonomous exploitation of web targets, sold per pentest and on credits
• Cobalt — human-delivered PTaaS with certified pentester reports, sold on credits representing blended AI and human hours
• Terra — agent swarms with a human in the loop, delivered as a managed service across web, AI and network

What Is Horizon3.ai NodeZero?

Horizon3 is an AI-native proactive security company, and NodeZero is its autonomous pentesting platform. It starts unauthenticated, the way an attacker would, and chains what it finds: exposed services, weak credentials, misconfigurations, unpatched hosts. It shows the path end to end and tells you which single fix breaks the most chains.

More than 6,500 organizations run it, including the NSA, CISA and four of the Fortune 10. The claim Horizon3 leans on hardest is production safety: 310,000 production-safe tests across more than 7,200 customer environments without a disruption. In a category where "autonomous" and "production" usually appear in the same sentence as a change-control meeting, that record is the moat.

On 29 July 2026, Horizon3 launched NodeZero WebApp Pentesting and closed a $250M round. Credit where it is due. Snehal Antani's framing at launch was pointed and fair: the first generation of AI-driven web app pentesting did well in cyber ranges, CTF labs, and on bug bounty leaderboards, but was not built to run safely against real enterprise production systems. That is an accurate criticism of a real problem in this category.

NodeZero is a particular shape of product. It is built around the attack path, and it is very good at it. For teams whose risk lives in the application layer rather than in what the application connects to, the shape starts to matter.

Why Look for Horizon3.ai Alternatives

The reasons teams give us are consistent, and none of them are about whether NodeZero finds real vulnerabilities. It does.

Application as path, not application as asset. Horizon3's model is that a web app is rarely the final objective, it is the front door. That holds for a large class of attacks. It does not hold for CVE-2026-17059, or for the tenant isolation flaw that lets one customer query another customer's records. In those cases the application is the objective. Nothing pivots, no credentials are stolen, and the attack path graph has one node on it. A product built to trace chains into infrastructure has no reason to hunt the flaw that never leaves the app.

API depth is not part of the story. The WebApp launch is framed around web applications, attack paths and production safety. It does not claim API-native testing, automated specification generation or native GraphQL security testing. If your surface is two hundred APIs behind a handful of front ends, that absence is the whole evaluation.

Pentest cadence, not build cadence. NodeZero runs autonomous pentests. Far better than an annual engagement, far less than every deployment. If engineering ships fifty times a week, ask what covers the forty-nine deploys nobody scoped.

Findings go to security, not to the developer. Prioritizing fix actions by attack path impact is exactly right for infrastructure remediation. It is a different thing from a framework-specific patch sitting in a Jira ticket assigned to the team that owns the service. This is where the two-buyers problem becomes an operational problem: a network finding routes to an infrastructure team that owns the fix, while an application finding routes to a developer who did not ask for it and cannot act on a CVSS score.

The WebApp product is three weeks old. Not a criticism, an evaluation risk. NodeZero's network product has years of hardening and a very large reference base behind it. The WebApp product left Early Access last month. If you are betting an application security program on it, ask for references from the beta cohort specifically, not from the network install base.

Operational friction that predates the launch. Docker-based deployment is a real setup cost in large segmented networks. Custom templates and custom actions remain a recurring request from users who want to encode their own attack logic. Pricing is quote-based with nothing published.

These are not reasons to avoid NodeZero. They are reasons it does not fit every team, and specifically reasons it may not fit the application security half of your org.

What Security Teams Are Actually Saying About Horizon3.ai

Usually, users are quite positive about Horizon3.ai network capabilities. Here is some feedback from Reddit users:

From security teams who evaluated Horizon3.ai or are running it in production that we talked with:

"We've done a pretty deep POC, and it's a nice-looking product. I don't feel like I have tremendous coverage in the application part of it at the moment. So I'm looking for ways to bolster that." - Information Security Officer at a global provider of commercial and consumer insurance

"NodeZero was definitely the one we liked the most, although it was limited to internal testing. Would really like something that would have external and maybe even a web app component to it." - Information Security Director at a large US sports corporation

The pattern is consistent: NodeZero is a strong infrastructure product that application security teams keep asking to become an application product.

Horizon3 clearly heard it. NodeZero WebApp Pentesting launched on 29 July 2026 with an Early Access program. What it doesn't say is whether the new module truly covers the missing application layer and how well this coverage is represented. That is what a POC is for, and it is why you should ask Horizon3 for references from the Web App beta cohort rather than from the network install base.

Top 5 Horizon3.ai Alternatives 

Escape

Escape is particularly suited for security and IT teams whose exposure is driven by web applications, APIs, and a perimeter that changes faster than anyone can inventory it, and that want to maintain high accuracy even for complex business logic findings and remediation.

Strengths

✅  Agentic architecture (multi-agent harness with an orchestrator at the center) keeps a memory of what's relevant to you across engagements, tests as multiple users at once, and actively monitors coverage gaps

✅ True positives with evidence: Each issue includes AI-powered proof of exploit and remediation guidelines, so engineers can follow the exploit path directly and validate it with confidence.

✅ Bug bounty to regression tests in less than 1 hour: You can feed findings from previous AI pentesting findings, bug bounty programs or manual pentest reports. Escape converts them into automated regression tests that run on every build. The same vulnerability never ships twice, and your security posture compounds instead of resetting.

✅ CI/CD-ready reproduced complex exploits: Teams can reproduce complex exploits that evolve with their applications and run them automatically without manual upkeep.

✅ Developer-ready remediation: Escape generates stack-specific code fixes. Whether for Node.js APIs or GraphQL services, developers receive context and patches tailored to their framework, reducing backlog and friction between security and engineering.

✅ Under an hour to map an entire external attack surface: Vulnerabilities are linked to assets discovered across code repositories and cloud integrations, tied to their owners, and weighted by business criticality.

Org Fit

Mid-to-large enterprises: built for lean security teams deploying updates weekly or daily, and especially well-suited for organizations with complex environments—such as domains and subdomains scattered across multiple teams, applications hosted in various locations and repositories (including monorepos)—where blind spots are hard to detect without context.

Testing Approach

Escape's AI pentesting is a multi-agent harness with an orchestrator at the center. It creates the specialists a target actually needs, on demand, they load modular skills: focused playbooks, scoped to the task in front of them, so each agent's context stays small and relevant. During the exploitation phase, coverage gaps are actively monitored and closed in real time. Findings flow into Escape continuously, so what Cascade proves once becomes an unlimited regression test. It re-runs on every release, inside your CI/CD. 

Limitations

❌ Advanced features may require security expertise or training for optimal use.

❌ Integration coverage for some operational tools is still being expanded

Reviews

“We’ve reduced time spent on pentests from 4–5 days to under half a day.” - Head of Offensive Security, large logistics company

"We saw Escape being a lot smarter, understanding what’s happening, where it is located. For example, it’s finding a billing API, it’s found what it thinks is a billing ID, like 001, and it tries a few other IDs to see if it has access to get some other people’s billing info. It’s a lot more understanding of what’s happening where it’s at. I think this is where tooling and security tooling overall is going.” - Nick Semyonov, PandaDoc

Terra Security

Terra Security positions itself as an "agentic AI pentesting" platform that blends AI-driven automation with human oversight. It started in web application pentesting and expanded into network infrastructure in May 2026. Its model deploys a swarm of AI agents that adapt to business logic and system behavior, but keeps a human in the loop to validate and guide outcomes. Terra emphasizes context: vulnerabilities are scored not just by technical severity, but by business impact, probability, and exploitability. Its output is tailored for enterprise needs, with compliance-ready reporting for SOC 2 and ISO. The platform appeals most to organizations seeking a balance of automation and auditor-friendly assurance.

Strengths

✅ Agent swarms trained on customer business context across web, AI and network.

✅ In-depth prioritization capabilities: Prioritizes vulnerabilities based on impact to the organization, including comparable breaches and exploitability.

Limitations

❌ Manual reliance: Human oversight slows testing and prevents full autonomy.

❌ Developer handoff gap: Reports are compliance-oriented, not developer-ready for remediation.

❌ Compliance limitations: quite a new solution on the market, coverage only for SOC2 and ISO at the moment; lack of support for more specialized frameworks like PCI-DSS or HIPAA

❌ Workflow integration: Limited evidence of seamless CI/CD fit compared to engineering-first tools.

❌ ASM context missing: Findings aren’t tied to asset ownership or business context, reducing operational prioritization.

Testing Approach

Agentic swarm exploration guided by business logic, supplemented each time by human validation (requires human-in-the-loop). Strong for compliance-driven assessments; weaker for continuous, fully automated workflows at developer speed.

Org Size Fit

• Best for large, regulated enterprises (finance, healthcare, SaaS at SOC 2/ISO scale) that prioritize compliance and business-context risk scoring. 
• Less suited for lean engineering teams that need continuous automation, asset context, and developer-ready fixes.

Reviews

“We’ve been really impressed with Terra Security. Their AI-based penetration testing actually feels like a real security researcher is reviewing our app continuously. ”

Cobalt.io

Cobalt positions itself as a human-led, AI-powered pentesting platform, explicitly rejecting fully autonomous agentic AI approaches. Their model uses AI to accelerate pentesting workflows - from intelligent tester matching to streamlined reporting - while experienced human pentesters focus on finding sophisticated vulnerabilities. The platform combines access to a community of vetted pentesters with AI tools that handle repetitive tasks like report writing and data enrichment. Cobalt's AI models are trained on over a decade of real pentesting data, rather than synthetic datasets.

Strengths

✅ Human-led approach with AI augmentation - pentesters leveraging AI tools deliver actionable insights faster than traditional methods

✅ Start pentests in as little as 24 hours with on-demand access to expert talent

✅ Real-time collaboration - direct communication with pentesters via Slack and in-platform messaging

✅ Unlimited free retesting for fixed vulnerabilities

Limitations

❌Not fully automated - requires human pentesters, so can't achieve the same continuous testing speed as pure AI solutions

❌ Cobalt credits can be costly, making it difficult for organizations with large application portfolios

❌ Scheduling can sometimes take longer than expected, especially for retesting or specialized scopes

❌ Less suited for organizations seeking fully automated, CI/CD-native security testing without human dependency

Testing Approach

Human-led, AI-powered methodology where AI handles repetitive tasks while expert pentesters focus on complex vulnerabilities. Combines Pentest as a Service (PTaaS) with optional DAST scanning. AI/LLM testing follows OWASP methodologies, focusing on prompt injection, business logic, and application security. Platform emphasizes collaboration with direct pentester communication throughout the engagement.

Org Size Fit

Mid-to-large enterprises and regulated organizations that value human expertise and need compliance-ready pentesting (SOC 2, ISO, PCI-DSS).

Less ideal for startups or engineering-led teams needing continuous, fully automated testing integrated into CI/CD pipelines.

Reviews

"Cobalt provides an excellent balance of flexibility and expertise in penetration testing. I like how their platform makes it easy to track findings, communicate directly with testers, and manage retesting. The talent and professionalism of their pentesters stand out—they deliver actionable results, not just reports. The continuous visibility into progress and remediation guidance is a huge value add."

XBOW

XBOW is an autonomous offensive security platform that validates findings through real exploitation rather than theoretical scoring. Its positioning is strongest in red-team style scenarios: testing breadth, chaining potential, and rapid validation of impactful exploits. It reached the top of the global HackerOne leaderboard and launched Pentest On-Demand, a self-serve pentest delivered in about five business days.

It is sold per pentest and on credit packs. Teams running it tell us the credit model means choosing which assets get tested, and that quarterly scanning is what the budget actually supports. Antani's cyber-range criticism at the WebApp launch was aimed in this direction, and it is worth weighing on its merits. We covered XBOW limitations in the XBOW alternatives article.

Strengths

✅ Adversarial realism: Specialized agents run in parallel, chaining attacks, iterating on exploitation paths, and trying to validate them.

✅ Quick launch: Updates can be tested within hours, bypassing the scheduling delays of manual engagements.

✅ Validated exploits: Proof-of-concept evidence is included for vulnerabilities, supporting credibility in findings.

Limitations

❌ Business logic blind spot: Less systematic detection of Business Logic Vulnerabilities (BOLA, IDOR, access control) compared to purpose-built engines.

❌ Context missing: Findings are raw; results aren’t tied into ASM context like asset ownership or prioritization.

❌ Pricing: Priced per action, which makes costs rise quite high for organizations that need to test often. This is one of the main reasons security leaders are looking for XBOW alternatives.

❌ Developer handoff gap: While exploits are validated, reports don’t provide developer-ready fixes

❌ Engineering adoption: Offensive-first framing resonates with pentesters, but less so with product and developer teams seeking integration into workflows.

Testing Approach

Multi-agent, adversarial exploration with coordinated exploit chaining. Strong for simulating attacker breadth; weaker for systematic, evidence-driven detection.

Org Size Fit

Organizations with dedicated security or red teams that want adversarial testing without testing too often. Less optimized for engineering-led orgs where remediation and developer workflow integration are critical.

Reviews

Pentera

Pentera runs agentless automated security validation across network and identity, testing credentials, lateral movement and exposure continuously rather than annually. It is the closest like-for-like alternative to NodeZero's original scope, and if you are shortlisting one you are almost certainly shortlisting the other.

The application-layer question applies to Pentera in the same shape it applies to NodeZero, with one difference worth noting: Horizon3 has now shipped web application pentesting with a messaging focus on business logic vulnerabilities, and Pentera has not. We covered that comparison in depth in Pentera Alternatives.

Strengths

✅ Continuous validation at daily, weekly or monthly intervals rather than annual assessments, giving a much tighter feedback loop

✅ Auto-exploits what it flags before surfacing it, so findings are reproducible by definition and false positives stay low

✅ Built-in remediation prioritization, so teams fix in the right order rather than by raw severity

✅ Fast deployment with light configuration, and attack simulations that reviewers describe as closely mimicking real attacker behaviour

✅ Runs without disrupting production environments

Limitations

❌  No application-layer business logic testing. Authorization flaws across user roles, tenant isolation and API abuse sit outside the model

❌  Reviewers cite enterprise pricing as a significant investment, slower navigation, and dashboards that could be more specific to the vulnerabilities being surfaced

❌  Requests for more granular control, particularly the ability to exclude sensitive systems, and for cloud coverage to mature further

❌  One reviewer notes it cannot yet attack from the external network, with that capability expected later in the year

Testing Approach

Algorithmic security testing that emulates real, safe attacks across internal controls, the external surface and cloud, running continuously in the infrastructure. When a change appears through a firmware upgrade, OS update or software change, validation picks it up rather than waiting for the next scheduled window. The unit of work is the attack path across network and identity, not the application logic running on top of it.

Org Size Fit

Enterprise. Pentera is strongest in large, regulated environments, particularly finance, healthcare and government, where the internal estate is big enough to justify continuous validation. Named customers include City National Bank, BrewDog, Casey's General Stores and Schmitz Cargobull. Pricing starts around $35,000 per year and typically runs $50,000 to $100,000 or more depending on asset count, modules and validation frequency, so it is not a fit for smaller teams or for organizations whose primary surface is applications.

Reviews

I like Pentera for its easy-to-understand UI which makes it easy to pass tasks to other teams. The ingenuity of the software helps in vulnerability management and penetration testing by automating tasks, which means less staff is required. The initial setup was quite easy. I wish there were more automation options, like Jira, that aren't included. - Review hosted on G2.com.

For the head-to-head with Escape, see Escape vs Pentera.

Comparing Horizon3 Alternatives

How to Choose Your Horizon3.ai Alternative: a Quick Decision Framework

Run your team through these four questions:

1. What are you actually testing? Network and infrastructure points to NodeZero or Pentera. Web applications, APIs and business logic points to Escape. If the answer is both, plan on two tools.

2. Continuous or periodic? An annual or quarterly engagement is a different product from something wired into CI/CD that runs on every deployment. Ask how the vendor handles a finding reappearing three releases later.

3. Who fixes the findings? If findings land with a security team that then has to translate them for engineers, you have added work. Ask what the developer receives: a CVSS score, or a code fix in their framework attached to their service.

4. Can you prove the fix held? Retesting after a patch is table stakes. Regression testing against your historical findings, at scale, continuously, is not. Ask specifically.

Head-to-Head Comparison by Key Scenarios

Scenario 1: "Our network is covered. Our applications are not."

The most common situation we hear, and the one that brings people to this page.

The shape is always the same: a deep POC, good reporting, real respect for the product, and then the sentence that follows. In the words of one Information Security Officer at a global insurer, "I don't feel like I have tremendous coverage in the application part of it at the moment."

That is Escape's job. Business logic and authorization across authenticated sessions, APIs tested natively, findings that reach the developer who owns the service. Running an infrastructure tool alongside it is a reasonable architecture, not a redundancy.

Scenario 2: "Can someone get from a foothold to domain admin?"

NodeZero would be a better choice here for now. This is the job it was built for, it has years of production evidence behind it, and the attack path visualization.

Worth noticing who is asking, though. That question belongs to the infrastructure team. If you are reading a comparison about application testing, you are probably the other buyer, and the two of you are not making the same purchase.

Scenario 3: "We have 200 APIs, heavy GraphQL, and a team of four."

The WebApp launch does not claim API-native coverage, automated specification generation or native GraphQL testing. With four people and two hundred APIs, the gap between testing the applications you scope and finding the APIs nobody documented is the entire job. Escape crawls the APIs behind your web applications from the running system, generates the spec automatically, and tests authenticated business logic across them.

Scenario 4: "We need to prove tenant isolation holds across customer accounts."

Testing isolation means holding concurrent authenticated sessions across roles and checking whether one can reach the other's data. It produces a finding with no attack path attached, because the attack does not go anywhere. CVE-2026-17059 is exactly this shape: a well-formed request, a 200 response, and a user directory that should never have been returned. Escape is the best fit for this scenario.

Scenario 5: "We do not even know what we have exposed."

Both, differently, and this is where outside-in matters most.

NodeZero will tell you what those assets give an attacker access to across your infrastructure. Escape will tell you what is on them.

Escape's discovery maps what you actually expose at the perimeter and the application layer: hosts, ports, APIs, SPAs, including the internal service that got exposed during an infrastructure change and the app nobody wrote down. That last category is growing fast. Escape's research team scanned 5,600 publicly available vibe-coded applications and found more than 2,000 high-impact vulnerabilities, 400+ exposed secrets, and 175 instances of exposed PII including medical records, IBANs, phone numbers and emails. All live. All in production.

Scenario 6: "We ran the WebApp module and it found things."

Good. That is the product working, and Horizon3's beta results seem to back it up.

Three questions decide whether it covers your application layer or supplements it.

Did it find the flaws that require two authenticated sessions? Broken object level authorization, tenant isolation, privilege escalation between roles. These need the tester to hold concurrent sessions and reason about state, not to chain a foothold forward.

Will it catch the same bug when it ships again? Regression testing against your historical findings, from bug bounty reports and past manual pentests, run continuously rather than rediscovered by chance.

Who received the finding? A security engineer with an attack path, or a developer with a framework-specific patch attached to the service they own. This is where the two-buyers problem becomes an operational one.

Conclusion: Choose What Best Fits Your Organization

There is no single best answer here, and any comparison that tells you otherwise is selling something. There is a best answer for the risk you actually carry.

If your worst realistic incident ends in domain compromise, buy an infrastructure product. NodeZero is very good at that job and Pentera is the closest alternative to it. If your deliverable is an audit-ready report with a certified human's name on it, Cobalt sells exactly that and automation does not.

But if your worst realistic incident ends in a data protection notification, the picture changes. That is the gap Escape was built to close. Continuous pentesting that maps your exposed perimeter, then proves what is genuinely exploitable in the external and internal web apps and APIs behind it. REST and GraphQL tested natively. Authentication handled without brittle scripts. Every finding carrying proof of exploit and a framework-specific fix, routed to the developer who owns the service rather than a CVSS score dropped on a security engineer.

Application security and network security are not the same buyers. They should not have to be the same purchase.

Want to see what a continuous pentest finds on your hardest target, an authenticated multi-role application or a GraphQL API? Book a walkthrough with an Escape product expert.

Frequently Asked Questions

What is the best Horizon3.ai alternative in 2026?

Escape, for most teams arriving at this question. If you are looking past NodeZero it is usually because your risk sits in your applications and APIs rather than in the network they run on, and that is exactly what Escape is built for: perimeter discovery, then continuous pentesting of the external and internal web apps and APIs behind it, with proof of exploitability and a code fix for the developer who owns the service. Pentera is the closest like-for-like if you actually want another network validation tool. Cobalt is the answer if what you need is a human-signed compliance report.

Can NodeZero find BOLA, IDOR and broken access control?

Horizon3 reported a broken access control finding during the WebApp beta, so the capability exists. The question for your evaluation is depth. Authorization flaws like BOLA and tenant isolation require holding two authenticated sessions as different users and reasoning about what each should be allowed to see. That is a purpose-built capability rather than a step in an attack path. Escape's business logic engine was built specifically for it, which is how Escape's research team found CVE-2026-17059 in Keycloak.

Does NodeZero test APIs and GraphQL?

The WebApp launch is framed around web applications and attack paths rather than API-native testing, automated specification generation or native GraphQL. If APIs are the bulk of your surface, ask Horizon3 directly and request a demo against your own GraphQL endpoint. Escape crawls the APIs behind your applications from the running system, generates the spec automatically, and tests REST and GraphQL natively.

Does Horizon3.ai NodeZero test web applications?

Yes, as of 29 July 2026, following an Early Access program with 95 customers. It is framed around production-safe autonomous testing that chains application abuse into credential theft, lateral movement, cloud pivots and data exposure. Comparisons written before mid-2026 saying web app testing is on the roadmap are out of date. The module is new, so ask for references from the WebApp beta cohort rather than the network install base.

How often does each tool test?

NodeZero runs autonomous pentests on demand and on a schedule. That is far better than an annual engagement and far less than every deployment. Escape runs continuous pentesting tied to your build cadence, so a change that ships on Tuesday gets tested on Tuesday rather than at the next scheduled window.

What happens to a finding after it is found?

This is where the two buyers diverge. NodeZero prioritizes fix actions by attack path impact, which is right for infrastructure remediation owned by a security or infrastructure team. Escape routes findings to the developer who owns the asset, with AI proof of exploit and a framework-specific code fix, through bi-directional Jira sync, CI/CD or the IDE via MCP.

Can one tool cover both network and application pentesting?

Vendors increasingly claim both, from both directions: Horizon3 moving into web applications, Escape and Terra moving into network. The practical test is depth. Ask each vendor to prove a BOLA across two user roles and, separately, a path from external foothold to domain admin. Most products are visibly better at one of those, and buying one tool for both usually means doing neither well.