Artificial intelligence penetration testing startup Novee Cyber Security Ltd. has introduced External Surface Testing to its platform, enabling AI-driven attacks to assess a customer’s entire internet-facing footprint.
The new External Surface Testing feature is designed to assist security teams in addressing critical vulnerabilities as they are disclosed. When such vulnerabilities arise, teams must quickly identify which exposed assets are affected and assess their exploitability. Novee emphasizes that attackers perceive targets as singular environments that can be accessed through multiple vectors, including neglected subdomains and publicly exposed staging servers.
Traditional external attack surface management tools generally focus on cataloging a company’s exposed assets and scoring their severity. Netta Rager Dan, Vice President of Product at Novee, stated that while these tools indicate what is exposed, they fail to provide a comprehensive view of actual risks. This often leaves security personnel to independently validate extensive lists of exposures.
Novee’s solution requires only a domain name to initiate the testing process. The platform functions similarly to an external attacker, systematically gathering information about each asset and service. Newly disclosed vulnerabilities are tested against a customer’s active systems to determine their potential for exploitation.
Additionally, findings from other vendors’ attack surface tools undergo the same verification process. Novee claims that their testing captures unreported flaws, including chained attack paths, ultimately providing the customer with a concise, prioritized list of validated issues corroborated by evidence.
Previously, Novee’s testing capabilities were limited to the application layer. The External Surface Testing feature operates on the same platform as Novee’s Application Pentesting product, allowing hosts discovered during external assessments to be seamlessly elevated to comprehensive gray-box or white-box penetration tests. Insights from the discovery phase persist through the testing process. Novee asserts that no other fully autonomous AI penetration testing platform effectively encompasses the external attack surface alongside web, mobile, and AI applications.
Built-in safety limits govern the testing processes. Customers must approve the testing scope prior to execution, and probes originate from outside the perimeter without requiring any agents or customer-supplied credentials. Exploit attempts employ non-destructive payloads, and traffic is maintained within configured limits to prevent excessive load spikes or overwhelming the security operations center with data noise.
Novee was founded in May 2025 by former national-level offensive security operators Ido Geffen, Gon Chalamish, and Omer Ninburg. The company launched in January 2026, raising $51.5 million in funding from YL Ventures LP, Canaan Partners, and Zeev Ventures LP.
The External Surface Testing feature is currently available as part of the Novee platform.