Novee puts forgotten internet-facing assets through penetration testing

Novee's External Surface Testing is a new capability in its AI penetration testing platform that helps security teams discover internet-facing assets and validate exploitable vulnerabilities. It tests newly disclosed CVEs and findings imported from third-party external attack surface management (EASM) tools.

"Attackers don't limit themselves to the applications you're already testing. They look for anything exposed to the internet — forgotten subdomains, staging servers left online, and infrastructure your team may not even know exists. When a critical new CVE emerges, they look for ways to exploit it, often chaining multiple weaknesses into a larger attack," Amit Zeevi, Product Manager at Novee Security, explained.

Discovering external assets

An organization's internet-facing systems change as teams launch applications, create test environments, acquire domains, and retire infrastructure. Security inventories can miss assets during these changes, leaving systems outside the testing process.

Novee uses a company name or domain to identify web applications, APIs, mail servers, file transfer services, remote access tools, VPN gateways, management consoles, and other exposed infrastructure.

Teams review the discovered assets and confirm which belong to their organization before testing begins.

Testing for exploitable vulnerabilities

Teams can import EASM findings or select newly disclosed CVEs to test against approved assets. Novee examines those assets from outside the organization's network, without customer-provided credentials, agents, or software installation.

According to Novee, the platform validates exploitability, identifies additional vulnerabilities, and tests how weaknesses could be combined into attack paths. It provides prioritized findings with supporting evidence and remediation guidance.

"When a critical new CVE is disclosed, security teams need answers fast — which assets are affected, what's actually exploitable, and where to focus first," said Netta Rager Dan, VP of Product at Novee.

Testing can run on a schedule to track changes in the organization's internet-facing systems.

Moving into application pentesting

When a discovered host needs further investigation, teams can move it into an application penetration test on the same platform. These tests use credentials and application context to examine authenticated workflows, roles, permissions, and business logic.

Findings and discovery context carry over into the application test, and validated issues from both types of testing appear in one view.

Testing safeguards

Teams also approve the testing scope, including discovered domains and IP ranges.

Novee says it validates vulnerabilities without destructive payloads or actions. Test traffic stays within configured limits to reduce operational impact and unnecessary security alerts.

Book a demo to see External Surface Testing in action.