External surface testing gives security teams a way to find internet-facing assets that ordinary testing may miss. Novee has added the capability to its AI penetration testing platform, according to Help Net Security.
The service identifies exposed systems, checks approved assets against selected vulnerabilities and can move suspicious hosts into deeper application testing without starting over.
- Novee can discover web applications, APIs, mail servers, file transfer services and remote access tools.
- Teams approve discovered domains and IP ranges before testing begins.
- Tests run from outside the customer network without agents, software or customer credentials.
- Newly disclosed CVEs and imported EASM findings can be checked for practical exploitability.
What Novee added to its platform
Novee’s External Surface Testing is designed to locate internet-facing assets and determine whether their vulnerabilities can be exploited. According to Help Net Security, the new capability supports web applications, APIs, mail servers, file transfer services, VPN gateways, remote access tools, management consoles and other exposed infrastructure.
The search begins with a company name or domain. Security staff then review the results and confirm which systems belong to the organization. That approval step matters because automated discovery can return hosts that merely appear connected to the customer’s digital presence.
After scope approval, teams can import findings from third-party external attack surface management tools. They can also select newly disclosed CVEs for validation against the approved assets.
Novee says its platform confirms exploitability, identifies additional weaknesses and shows how separate issues could be chained into an attack path. Findings are prioritized with supporting evidence and remediation guidance.
The problem with an incomplete inventory
Internet-facing infrastructure rarely stays still. Teams launch applications, create staging environments, register domains and retire services. Each change can leave a system exposed without placing it inside the normal security testing process.
The result is an inventory gap. A penetration test may examine known applications while a forgotten subdomain, temporary server or remote administration service remains available for attackers to discover.
A newly disclosed CVE makes that gap more urgent. Publishing a vulnerability creates an immediate question for security teams: which exposed systems are affected, and can an attacker actually exploit the flaw?
External surface testing is intended to answer those questions at the external boundary. It does not replace authenticated application testing. Instead, it helps teams find the assets worth examining and verify whether an external weakness is more than a theoretical scanner alert.
Why it differs from credentialed testing
The external phase does not require customer-provided credentials, agents or software installation. Novee examines assets from outside the customer’s network within approved limits.
When a discovered host needs more detailed investigation, it can be moved into an application penetration test on the same platform. Those tests use credentials and application context to inspect authenticated workflows, roles, permissions and business logic.
Discovery details and findings carry into that second stage. Validated issues from external and application testing then appear together, giving the team a shared view rather than separate sets of disconnected reports.
Novee says validation avoids destructive payloads and stays within configured traffic limits. The goal is to reduce operational disruption and unnecessary security alerts while still establishing whether a weakness can be exploited.
What this means for defenders
The useful part of external surface testing is not the discovery technology alone. It is the workflow connecting discovery, approval, vulnerability validation and deeper testing.
Scanners often report what a configuration appears to expose. A validation process should establish whether the issue is reachable and exploitable. That distinction helps teams spend limited remediation time on problems that represent a practical path into the environment.
For example, an imported EASM alert may identify a management console. If the approved external test confirms that the console is exposed and vulnerable, the security team has a stronger basis for emergency remediation than it would have from a raw inventory entry.
There is still a boundary. The service can only test assets that are discovered, approved and reachable. A forgotten asset that never appears in the initial search remains outside the test. Asset discovery and inventory accuracy therefore remain essential.
A practical response for security teams
Say you have a new CVE affecting a popular web server and your application inventory covers only production. Rather than ask every team whether they happen to use the product, start by identifying internet-facing hosts. Include staging systems, forgotten subdomains and administrative interfaces in the review.
Once the team approves the relevant domains and IP ranges, test those assets against the CVE and examine the supporting evidence. If the vulnerability is exploitable, remediate it before spending time on lower-risk findings. If the host needs authenticated assessment, move it into application testing and preserve the discovery context.
Run the process regularly, not only after a major disclosure. A scheduled test can reveal new infrastructure before a CVE gives attackers a ready-made exploitation path.
What to watch next
External surface testing is most valuable when an organization treats it as an ongoing control rather than a one-time report. New hosts, acquired domains and temporary infrastructure should trigger another inventory and scope review.
The next measure of success is not how many findings the platform produces. It is how quickly a team can turn an exposed asset into a verified result and then a sensible remediation decision. That is the workflow worth watching.
Key takeaways
- Begin vulnerability validation with a complete view of internet-facing assets, including forgotten and temporary systems.
- Approve test scope carefully, then use exploitability evidence to prioritize remediation.
- Connect external discovery to authenticated testing so teams retain context as investigations deepen.
Frequently asked questions
What does external surface testing do?
It identifies internet-facing assets and tests approved systems for exploitable vulnerabilities. It can also evaluate newly disclosed CVEs and findings imported from EASM tools.
Does Novee’s external testing require customer software or credentials?
No. The company says the tests run from outside the customer network without agents, software installation or customer-provided credentials.
Can a discovered host receive deeper testing?
Yes. Teams can move a host into an application penetration test that examines authenticated workflows, roles, permissions and business logic.
Is external testing a replacement for application penetration testing?
No. It provides external discovery and vulnerability validation before selected hosts move into more detailed, credentialed testing.