Novee's November launch — External Surface Testing — closes a gap the industry pretended wasn't there: discovery tools score your exposures, then leave you to figure out which ones attackers can actually use. A CVSS 9.8 on an unreachable asset is a false alarm; a forgotten staging box with a live admin panel is a war story waiting to be written.
Traditional EASM gives you a long list of rumors. The new model — which we run on every engagement — treats each rumor as a hypothesis to be tested on the live asset.
The scramble, formalized
When a critical CVE drops, every security team does the same panic dance: which of our assets are affected, and can anyone actually exploit them? The first question is inventory; the second is exploitability — and the second is where most tooling shrugs. Our swarm's version:
- Continuous recon maintains the asset ledger — every host, fingerprint, and owner-mapping as it stands today.
- On disclosure, affected candidates get probed for the specific precondition, not just a version banner.
- Reachable paths get chained into a demonstration — or ruled out with evidence. Either way, the answer isn't a score.
Three rumor classes produce most of the real paths: review apps that never died (ephemeral environments with production credentials, alive months after merge), acquired domains pointing at infrastructure nobody's logged into, and vendor panels on customer subdomains running versions from years ago. None of these show up in a risk register. All of them show up in an attacker's first hour.
Broad then deep is the right order — map everything, prove what matters, promote the interesting hosts into a full authenticated pentest. Surface findings that can't be demonstrated aren't findings; they're inventory.