Cybersecurity service
External Penetration Testing
Authorised testing of internet-facing assets from the viewpoint of an outside attacker.
External penetration testing assesses assets reachable from the internet, such as websites and servers, the way an outside attacker would approach them.
Depending on the authorised scope, we combine manual testing and verification with automated tools such as Burp Suite, Nmap, Nuclei, OWASP ZAP, Nessus and SQLmap, and other suitable tools. Not every tool is used in every engagement.
Who it is for
- Businesses with websites, servers or services exposed to the internet
What is in scope
- Domains, hosts and services listed in the written scope
- Enumeration of exposed services and identification of vulnerabilities
- Manual verification of selected issues within the permitted techniques
How we work
- Agree scope and authorisation. Targets, testing windows, permitted techniques, exclusions and contacts are documented in writing first.
- Assess and verify. We enumerate and test the in-scope assets and verify the findings.
- Report. We deliver verified findings, potential impact and remediation recommendations.
What you receive
- A written report with verified findings and supporting evidence
- Severity where justified and remediation recommendations
Limitations
- Only listed assets are tested; third-party systems are excluded unless separately authorised in writing.
- A security assessment reduces risk but cannot guarantee that every vulnerability will be found or that a system will remain secure.
- Retesting is optional and can be agreed separately; it is not automatically included.
What we need from you
- Written authorisation from the owner of every in-scope asset before testing starts
- Confirmed ownership of every in-scope domain and host
Frequently asked questions
Do you test third-party services we use?
Not unless the third party authorises it in a separate written scope.
Ready to talk about your project?
Tell us what you need and we will reply with next steps.