NEW YORK, Nov. 03, 2026 (GLOBE NEWSWIRE) -- Novee, the leader in AI penetration testing, today announced External Surface Testing, a new capability that extends its platform beyond the applications teams already know to their entire internet-facing environment. Security teams can now discover unknown assets, test their external exposure to newly disclosed CVEs, and validate what's actually exploitable. They can go broad across everything an attacker can reach, then deep into the apps that matter – one platform, one issue list, no second tool.
As cyber threats escalate, organizations can no longer afford blind spots in their external attack surface. Attackers don't see a company as a list of separate assets or testing categories. They see one environment with multiple ways in, from forgotten subdomains and exposed staging servers to public IP addresses and leaked credentials. When a critical new CVE is disclosed, security teams need to quickly determine which external assets are affected and whether attackers can actually exploit them. Defending against these threats requires more than knowing what's exposed. Security teams need to understand what attackers can actually exploit.
Traditional external attack surface management (EASM) tools help teams discover and monitor internet-facing assets, then score them by CVSS. That leaves security teams with long lists of exposures to investigate, prioritize and validate on their own, with no clear view of real risk. Powered by Novee’s proprietary offensive AI, External Surface Testing goes further. It explores and understands the external environment like an attacker, builds context across assets and services as it goes, and tests newly disclosed CVEs and findings imported from third-party EASM tools against live assets to confirm exploitability. It also uncovers new vulnerabilities and chained attack paths that individual scans miss.
Starting with nothing but a domain, External Surface Testing gives security teams and their stakeholders a short, prioritized list of validated issues backed by evidence.
“When a critical new CVE is disclosed, security teams need answers fast – which assets are affected, what's actually exploitable, and where to focus first,” said Netta Rager Dan, VP of Product at Novee. “Traditional EASM tools show you what's exposed, but don't give you the full picture of real risk. Novee brings external discovery and offensive testing together, so teams can validate emerging threats, uncover vulnerabilities attackers could exploit, and go deeper into applications – all in one platform.”
Because External Surface Testing and Application Pentesting run on the same platform, teams can move from broad external discovery to deep, authenticated testing without switching tools. When a discovered host warrants deeper investigation, teams promote it into a full grey-box or white-box application pentest. Discovery context and findings carry over. External and application issues live in one unified view.
External Surface Testing is built for safe, controlled testing. Teams approve scope before testing begins. Testing runs from outside the perimeter, with no agents, installation or customer-provided credentials. Exploits are validated without destructive payloads, and traffic stays within configured limits to avoid load spikes and unnecessary SOC noise.
External Surface Testing is available now as part of the Novee platform. To see it in action, visit: https://novee.security/
About Novee
Novee is an AI penetration testing platform training the world’s best offensive security AI. It combines the best AI Hacker to continuously uncover vulnerabilities that lead to real breaches – including business logic flaws, authorization issues, and chained attack paths – with the best AI Defender to prove findings and guide remediation with stack-specific guidance and retesting. Founded by national-level offensive security leaders Ido Geffen, Gon Chalamish, and Omer Ninburg, Novee has raised $51.5 million within four months of its inception from leading investors including YL Ventures, Canaan Partners, and Zeev Ventures. Learn more at novee.security.
Media Contact:
Sherlyn Rijos-Altman
Montner Tech PR
srijos@montner.com
