Novee 推出 External Surface Testing，用 AI 渗透测试验证暴露资产能否被真正利用
Novee’s External Surface Testing checks which exposed assets attackers can actually exploit - SiliconANGLE
Novee Cyber Security 为平台新增 External Surface Testing，让 AI 驱动的攻击测试覆盖客户全部互联网暴露面，并输出经证据验证的短优先级问题清单。该功能与 Application Pentesting 同平台，发现的主机可直接升级为灰盒或白盒渗透测试，测试范围需客户预先批准、不使用破坏性载荷。Novee 于 2025 年 5 月成立，1 月以 5150 万美元融资启动，新功能现已可用。
正文
Artificial intelligence penetration testing startup Novee Cyber Security Ltd. today added External Surface Testing to its platform so its AI-driven attacks can reach a customer’s entire internet-facing footprint.
External Surface Testing is aimed at the scramble after a critical vulnerability is disclosed, when security teams have to work out which exposed assets are affected and whether any can actually be exploited. Novee argues that attackers see a target as a single environment with many ways in, including forgotten subdomains and staging servers someone left exposed.
Conventional external attack surface management products catalog a company’s exposed assets and score them by severity. Netta Rager Dan, vice president of product at Novee, said those products “show you what’s exposed, but don’t give you the full picture of real risk.” In the company’s telling, security staff are left to validate long lists of exposures on their own.
Findings exported from other vendors’ attack surface tools go through the same check. Novee says the testing also catches flaws nobody had logged, chained attack paths among them, and the customer ends up with a short, prioritized list of validated issues backed by evidence.
Until now Novee’s testing has stopped at the application layer. External Surface Testing runs on the same platform as the company’s Application Pentesting product, so a host found during external discovery can be promoted straight into a full gray-box or white-box pentest. Whatever the discovery phase learned carries over. Novee claims no other fully autonomous AI pentesting platform covers the external attack surface as well as web, mobile and AI applications.
Limits are built in to keep the testing safe. Customers approve the scope before anything runs, and the probes come from outside the perimeter without agents or customer-supplied credentials. Exploit attempts don’t use destructive payloads. Traffic is held under configured caps so testing doesn’t cause load spikes or bury the security operations center in noise.
Former national-level offensive security operators Ido Geffen, Gon Chalamish and Omer Ninburg founded Novee in May 2025. YL Ventures LP, Canaan Partners and Zeev Ventures LP backed the company when it launched in January with $51.5 million in funding.
External Surface Testing is available now as part of the Novee platform.
Image: Novee