Novee Introduces AI‑Powered External Surface Testing to Identify Forgotten Internet‑Facing Assets
What Happened — Novee Security launched “External Surface Testing,” an AI‑driven penetration‑testing capability that automatically discovers an organization’s internet‑facing assets—including forgotten subdomains, staging servers, VPN gateways, and management consoles—and validates whether newly disclosed CVEs or third‑party EASM findings are exploitable. The service runs from outside the customer network, requires no credentials or agents, and can be scheduled to continuously monitor changes in the external attack surface. Discovered findings are prioritized with evidence and remediation guidance, and can be handed off to deeper, credentialed application tests on the same platform.
Why It Matters for Trust & Control Assurance — It highlights the control‑objective gap of maintaining an up‑to‑date external asset inventory and evidencing its testing, a core element of continuous monitoring under the Identify function of NIST CSF 2.0.
Who Is Affected — Enterprises that host web applications, APIs, cloud workloads, or remote‑access infrastructure—spanning technology SaaS, cloud‑infra, financial services, and retail sectors.
Recommended Actions
- Integrate an external attack surface management (EASM) feed or conduct regular DNS/IP sweeps to surface all internet‑facing assets.
- Map discovered assets to your asset‑management control and schedule automated exploit‑validation tests for any new CVEs.
- Capture test results as audit evidence and feed them into your continuous‑monitoring program.
Technical Notes — The platform probes assets from the internet without installing software, using AI to emulate exploit chains across CVEs, misconfigurations, and exposed services. It validates exploitability with non‑destructive payloads and respects traffic‑rate limits to avoid operational impact. Source: Help Net Security