Novee Cyber Security Ltd. has added External Surface Testing to its AI-driven penetration testing platform, extending the reach of its automated attacks to a customer's full internet-facing footprint. The capability targets the period after a critical vulnerability is disclosed, when security teams must determine which exposed assets are affected and which can actually be exploited. Novee argues that attackers treat a target as one environment with many entry points, including forgotten subdomains and staging servers left exposed.
Conventional external attack surface management tools catalog exposed assets and rank them by severity. Netta Rager Dan, Novee's vice president of product, said those products show what is exposed but do not give the full picture of real risk. According to the company, security staff are left to validate long lists of exposures themselves.
Novee's tool requires only a domain name to begin. The software then works outward the way an outside attacker would, tracking what it learns about each asset and service along the way. Newly disclosed vulnerabilities are run against a customer's live systems to see whether anyone could actually exploit them.
Findings exported from other vendors' attack surface tools go through the same check. Novee says the testing also catches flaws nobody had logged, including chained attack paths, and leaves the customer with a short, prioritized list of validated issues backed by evidence. Until now, Novee's testing stopped at the application layer. External Surface Testing runs on the same platform as the company's Application Pentesting product, so a host found during external discovery can be moved directly into a full gray-box or white-box pentest, with what the discovery phase learned carrying over. Novee claims no other fully autonomous AI pentesting platform covers the external attack surface as well as web, mobile and AI applications.
Safeguards are built in. Customers approve the scope before anything runs, and probes come from outside the perimeter without agents or customer-supplied credentials. Exploit attempts avoid destructive payloads, and traffic is held under configured caps so testing does not cause load spikes or overwhelm the security operations center.
Novee was founded in May 2025 by Ido Geffen, Gon Chalamish and Omer Ninburg, former national-level offensive security operators. YL Ventures LP, Canaan Partners and Zeev Ventures LP backed the company when it launched in January with $51.5 million in funding. External Surface Testing is available now as part of the Novee platform.
More cybersecurity news from TechManNews.
