Novee announced the expansion of its AI penetration testing platform to mobile applications. With this addition, Novee becomes the industry’s first complete AI pentesting platform across the modern application attack surface, providing continuous, autonomous coverage. The platform tests web apps and APIs, along with desktop, AI and LLM-enabled applications.
Novee transforms mobile pentesting from a periodic assessment into an ongoing security practice. Users upload a mobile application package and receive results within hours, alongside findings from their other application assets.
“Attackers do not respect the boundaries organizations draw between their application assets. They look for the weakest entry point, then move across the connected environment to reach sensitive data,” said Omer Ninburg, Co-founder and CTO at Novee. “A mobile app can expose functionality and backend APIs that are not visible through the web front end. Novee research into twenty Android Apps has already uncovered over a dozen repetitions of such a chained exploit in a customer’s environment. Security teams need to test those connections as a real attacker would, not evaluate the mobile client as an isolated piece of software.”
The platform combines static analysis with live runtime testing to understand how an application actually operates. Novee reverse-engineers the package to uncover entry points that traditional scans may miss, then runs the application in a fully instrumented environment to analyze its behavior, network traffic and locally stored data. This approach exposes functionality and backend connections that may otherwise remain hidden behind encrypted or pinned traffic.
Each assessment maps to the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Testing Guide (MASTG). Findings include exploit evidence and replication steps, along with remediation tailored to the application stack. Once a fix is made, Novee automatically retests it to confirm the risk is closed.
New research demonstrates mobile testing in action
Novee’s continuous AI pentesting for mobile is backed by security research. After manually discovering seven Universal Cross-Site Scripting (UXSS) vulnerabilities in Android WebView, Novee researchers formalized the underlying attack patterns and directed the platform to test 20 additional Android applications. Novee uncovered additional UXSS vulnerabilities, along with a separate critical account takeover vulnerability.
The research revealed security gaps that can emerge when native code sends information back to web content without confirming that the original page is still loaded. Novee now tests Android applications for these origin-validation gaps, navigation weaknesses and bridge authentication issues as part of every mobile assessment.
Continuous AI pentesting for mobile is available now as part of Novee’s existing platform.
Meet the Team at Black Hat USA
Interested in learning more about Novee’s award-winning offensive security solution? Novee’s researchers will be leading two Briefings Sessions at Black Hat USA 2026. Attendees are also invited to stop by booth #5323 to meet the team. Schedule a more in-depth discussion with the co-founders here.
Not attending Black Hat? See a live demo of Novee’s AI penetration testing platform.