Novee Launches External Surface Testing Feature for AI-Driven Penetration Testing Platform
Novee Security has introduced External Surface Testing, a new capability within its AI penetration testing platform designed to help security teams discover forgotten or unknown internet-facing assets and validate which vulnerabilities on them are actually exploitable. The feature identifies web applications, APIs, mail servers, file transfer services, VPN gateways, and management consoles using only a company name or domain, without requiring credentials or agents. It supports testing against newly disclosed CVEs or findings imported from third-party external attack surface management (EASM) tools, and can run on a schedule to track changes over time. This is a product announcement rather than a report on an active threat or incident.
Detalhes técnicos
The platform performs discovery from outside the organization's network without customer-provided credentials, agents, or software installation. Teams review and approve discovered assets before testing begins. Novee validates exploitability, identifies additional vulnerabilities, and tests attack-path chaining across weaknesses, providing prioritized findings with evidence and remediation guidance. Discovered hosts can be escalated into authenticated application penetration tests on the same platform, with findings and context carried over into a unified view. The vendor states testing avoids destructive payloads and keeps traffic within configured limits to minimize operational impact and alert noise.
Remediação
Organizations evaluating external attack surface visibility may consider this as a tool to identify shadow IT, forgotten subdomains, and staging infrastructure, and to prioritize patching based on validated exploitability rather than theoretical CVE severity alone.
Linha do tempo
-
Novee Launches External Surface Testing Feature for AI-Driven Penetration Testing Platform
ler a análise desta fonte ocultar
Novee Security has introduced External Surface Testing, a new capability within its AI penetration testing platform designed to help security teams discover forgotten or unknown internet-facing assets and validate which vulnerabilities on them are actually exploitable. The feature identifies web applications, APIs, mail servers, file transfer services, VPN gateways, and management consoles using only a company name or domain, without requiring credentials or agents. It supports testing against newly disclosed CVEs or findings imported from third-party external attack surface management (EASM) tools, and can run on a schedule to track changes over time. This is a product announcement rather than a report on an active threat or incident.
Technical Details
The platform performs discovery from outside the organization's network without customer-provided credentials, agents, or software installation. Teams review and approve discovered assets before testing begins. Novee validates exploitability, identifies additional vulnerabilities, and tests attack-path chaining across weaknesses, providing prioritized findings with evidence and remediation guidance. Discovered hosts can be escalated into authenticated application penetration tests on the same platform, with findings and context carried over into a unified view. The vendor states testing avoids destructive payloads and keeps traffic within configured limits to minimize operational impact and alert noise.
Remediation
Organizations evaluating external attack surface visibility may consider this as a tool to identify shadow IT, forgotten subdomains, and staging infrastructure, and to prioritize patching based on validated exploitability rather than theoretical CVE severity alone.