Novee is an AI penetration testing company for security and engineering teams that need their applications tested continuously rather than once a year. Its offensive AI agents attack applications the way a skilled tester would, prove which weaknesses are really exploitable and hand developers a verified fix.
The aim is deep, continuous testing that finds, validates and remediates real risk at scale, without the delay and cost of booking a manual test for every release.
At A Glance
| Vendor | Novee |
|---|---|
| Category | AI penetration testing and AI red teaming |
| Identities covered | Application authorisation and AI agent permissions, as test targets |
| Deployment | SaaS, Bastion Node or on premises |
| Agentic AI | Offensive AI agents; AI red teaming of agents and MCP servers; Agentic Fix |
| Customers | UiPath, Cresta, Telit Cinterion, Stack Overflow, Kaleris |
| Market classification | Agentic AI Identity |
What Novee Does
Scanners and periodic pentests leave a gap: flaws that need context, such as broken business logic or a chain of small weaknesses, often go unnoticed until an attacker finds them. Novee closes that gap with a four-step loop. It detects weaknesses, validates each one so only proven issues reach the security team, guides the fix for the specific environment, and then repeats the test as code and infrastructure change. The result is a short list of proven issues, each with evidence, instead of a long scanner report to triage.
Products
Web Apps
Web Apps is aimed at the flaws automated scanners struggle with. It tests business logic and looks for authorisation gaps such as BOLA, IDOR and BFLA, where one user can read or change another user’s data.
Mobile Apps
Mobile Apps extends the same continuous and autonomous testing to mobile applications and the backend APIs behind them, so mobile teams no longer wait for a scheduled assessment.
AI Red Teaming
AI Red Teaming is for organisations shipping chatbots, copilots, agents and AI workflows. It covers every category in the OWASP AI Testing Guide, mapped to the application under test, including agent permission misuse and tool abuse. Testing starts with discovery of the application’s prompts, tools, permissions and data flows, and it works against MCP servers as well as conversational front ends.
External Surface Testing
External Surface Testing looks at what an organisation exposes to the internet, finding external exposures and validating them as an attacker would. Like the other products, it can start from a domain alone.
How It Works
Testing needs no source code or long onboarding project, and runs on Novee’s patent-pending proprietary agents. Customer data is never used to train its models.
| Component | What it does |
|---|---|
| Deployment | Novee runs as SaaS, through a Bastion Node or fully on premises. |
| Evidence | Each confirmed issue is delivered with a working Python proof of concept that developers can run to reproduce it. |
| Remediation and retest | Findings are sent to Jira, ServiceNow or GitHub, or routed directly to an AI coding agent, and the asset is tested again afterwards. |
Identities And Systems Covered
| Application authorisation | Authorisation gaps between users and roles, such as BOLA, IDOR and BFLA |
|---|---|
| Tenant isolation | Separation of data between customers in multi-tenant SaaS products |
| AI systems | Chatbots, copilots, agents, workflows and MCP servers |
| Applications and surfaces | Web applications, mobile applications and their backend APIs, and external attack surfaces |
Agentic AI Capabilities
Validation By Independent Agents
In AI red teaming, a finding is not reported on a model’s say-so: independent agents confirm exploitability with deterministic checks rather than inference.
Agentic Fix
Agentic Fix pushes validated exploit findings into the coding agents developers already use: Claude, Codex, Copilot, Cursor and Devin. It opens a GitHub issue with remediation guidance tied to the exact exploit path, and once the fix is merged Novee reassesses the asset to confirm the vulnerability is gone, closing the loop without a separate retest request.
Company Background
| Founded | May 2025 |
|---|---|
| Founders | Ido Geffen, co-founder and CEO; Gon Chalamish, co-founder and CPO; Omer Ninburg, co-founder and CTO |
| Funding | $51.5 million in total funding from YL Ventures, Canaan Partners and Oren Zeev |
| Research | Zero-day findings in Gemini, Cursor and Microsoft |
| Security | SOC 2 |
Note: This overview is compiled from Novee’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.