Novee Launches Continuous AI Pentesting for Mobile Applications

The expansion gives security teams unified, attacker-driven testing across mobile apps, web applications, APIs and AI/LLM-enabled applications

Novee today announced the expansion of its AI penetration testing platform to mobile applications. With this addition, Novee becomes the industry’s first complete AI pentesting platform across the modern application attack surface, providing continuous, autonomous coverage. The platform tests web apps and APIs, along with desktop, AI and LLM-enabled applications.

Novee transforms mobile pentesting from a periodic assessment into an ongoing security practice. Users upload a mobile application package and receive results within hours, alongside findings from their other application assets.

“Attackers do not respect the boundaries organizations draw between their application assets. They look for the weakest entry point, then move across the connected environment to reach sensitive data,” said Omer Ninburg, Co-founder and Chief Technical Officer at Novee. “A mobile app can expose functionality and backend APIs that are not visible through the web front end. Novee research into twenty Android Apps has already uncovered over a dozen repetitions of such a chained exploit in a customer’s environment. Security teams need to test those connections as a real attacker would, not evaluate the mobile client as an isolated piece of software.”

Also Read: Infrastructure as Code vs Configuration Management: What’s the Difference?

The platform combines static analysis with live runtime testing to understand how an application actually operates. Novee reverse-engineers the package to uncover entry points that traditional scans may miss, then runs the application in a fully instrumented environment to analyze its behavior, network traffic and locally stored data. This approach exposes functionality and backend connections that may otherwise remain hidden behind encrypted or pinned traffic.

Each assessment maps to the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Testing Guide (MASTG). Findings include exploit evidence and replication steps, along with remediation tailored to the application stack. Once a fix is made, Novee automatically retests it to confirm the risk is closed.

New Research Demonstrates Mobile Testing in Action

Novee’s continuous AI pentesting for mobile is backed by security research. After manually discovering seven Universal Cross-Site Scripting (UXSS) vulnerabilities in Android WebView, Novee researchers formalized the underlying attack patterns and directed the platform to test 20 additional Android applications. Novee uncovered additional UXSS vulnerabilities, along with a separate critical account takeover vulnerability.

Also Read: Top Infrastructure as Code, DevOps & Cloud Conferences to Attend in 2026

The research revealed security gaps that can emerge when native code sends information back to web content without confirming that the original page is still loaded. Novee now tests Android applications for these origin-validation gaps, navigation weaknesses and bridge authentication issues as part of every mobile assessment.

Continuous AI pentesting for mobile is available now as part of Novee’s existing platform.

Write to us [⁠wasim.a@demandmediaagency.com] to learn more about our exclusive editorial packages and programmes.