Penetration Testing Startup Novee Exits Stealth With $51.5M

An Israeli startup led by Orca Security’s former vice president of product emerged from stealth with $51.5 million to scale an artificial intelligence-first offensive security platform.

See Also: Proof of Concept: Bot or Buyer? Identity Crisis in Retail

The Series A funding will help Tel Aviv-based Novee recruit elite AI and cybersecurity talent and train proprietary AI models, said co-founder and CEO Ido Geffen. He said Novee’s architecture is designed to simulate how expert penetration testers are trained – using a blend of tools, techniques and real-world examples – enabling their AI agents to autonomously discover and remediate vulnerabilities.

“We were able to attract, even being under stealth, a few dozen customers,” Geffen told Information Security Media Group. “We are feeling very confident about the technology that we’ve built, but to really be able to scale this, you need to be out there and be able to attract much more customers at a much faster rate than we did so far.”

Novee, founded in April 2025, raised seed and Series A funding from YL Ventures, Canaan Partners and Oren Zeev of Zeev Ventures. The company has been led since its inception by Geffen, who spent three years overseeing product at Orca Security, 15 months overseeing product and customer success at Oasis Security, and four years leading product and customer success at CyberMDX (see: Universal Health Services Network Outage: Lessons to Learn).

How Novee’s AI Agents Mimic Human Penetration Testers

Creating a purpose-built AI model tailored for cybersecurity requires significant resources, and recruiting PhDs and engineers experienced in AI model development is expensive, Geffen said. Training custom models and maintaining the necessary infrastructure to do so at scale adds more cost, and Geffen said the company needs to outpace competitors while it holds a technological edge.

“We are training our own model,” Geffen said. “So, we are not just another wrapper on top of ChatGPT. We are training our own purpose-built AI model that is specialized in cyber. So attracting PhDs and people that are really expert in building models in AI is not cheap.”

The company’s AI-based platform for detecting novel software vulnerabilities has reached a maturity level where it could be confidently scaled, and Geffen said Novee has developed a robust foundation with proven customer satisfaction, a scalable product engine and a differentiated offering. He saw urgency among enterprises to detect vulnerabilities created by AI-augmented development workflows.

“Customers are generating much more code, more applications, with AI tools for developers,” Geffen said. “And attackers are really starting to leverage AI in order to do much faster and more sophisticated attacks, 24/7. And we’re really feeling this pain from customers; they don’t have any other way to protect themselves, except by finding the issues before the bad guys can find them.”

One of Novee’s core innovations is its AI architecture that mimics how human penetration testers are trained and operate, Geffen said. On top of it, Novee layers curated tools, human-derived workflows and a vast knowledge base of real-world exploitation examples to give the model practical capability, like skilled human testers who knows how to use their intelligence effectively, Geffen said.

“Once we are detecting an issue, we are also collecting a lot of context about the environment,” Geffen said. “We will know which web application firewall they have, which EDR solution and then the mitigation or remediation steps that we will provide will be very personalized to their specific technological stack.”

What Novee Still Needs Human Practitioners For

While Novee’s AI agents autonomously map applications and identify vulnerabilities, Geffen said they still rely on human practitioners for context and prioritization. Only a human can determine which parts of an application hold sensitive data or business-critical functions, and practitioners help guide agents toward these high-priority targets and provide feedback on which issues need urgent remediation.

“There is a tremendous synergy that is being built here between those AI penetration testing agents and the practitioners,” Geffen said. “The agent is mapping all of the application and providing very big coverage. Now, this is where the practitioner can come in, to say to the agent, ‘I know what the crown jewels are, what is meaningful for the business.'”

Rather than issuing hard-coded instructions, Geffen said Novee’s researchers craft descriptive prompts that communicate tactics, workflows and logic used by expert penetration testers. If a human finds a vulnerability that the AI agent misses, researchers create simulated scenarios to expose the AI to that situation repeatedly, refining its prompts, techniques or tools until it matches human performance.

“We let the agent run, and we also give it to our own researchers to investigate the same application,” Geffen said. “And if you’re coming into a situation that a human finds something that the agent didn’t find, then we are trying to understand, ‘Okay, what was missing in the chain of thought of the agent?’ Then we’re articulating more prompts until the agent is capable of solving the same problem.”

Traditional vulnerability scanners rely on pattern matching, CVE databases and known exploits, lack intuition, and are incapable of identifying zero-days or novel attack patterns, Geffen said. Novee is capable of replacing not only manual pen tests but also multiple categories of scanning tools including dynamic application security testing, external exposure tools and others.

“What happened until now is that the incumbent or traditional security scanners couldn’t have real intuition, so you got very shallow insights on things that are already known,” Geffen said. “The interest of organizations today is to protect themselves against a much more sophisticated type of attack, and this can be done today only with tools that are inherently working with AI.”