Penetration Testing
External Network Penetration Test
We test your internet-facing systems from an external attacker's perspective. We show whether these systems provide access to your internal network.
What it is
An external network penetration test examines your internet-facing services as an attacker would. First, exposed assets are identified from your domains and IP ranges. Then, VPN, remote access, mail and web services are tested for vulnerabilities and misconfigurations. The goal is to determine if a path exists from the internet into the internal network.
Scope
- Asset discovery across domains, subdomains and IP ranges
- VPN, remote desktop and other remote access points
- Mail infrastructure and domain authentication records (SPF, DKIM, DMARC)
- Perimeter devices such as firewalls and load balancers
- Management interfaces and test environments exposed to the internet
The need
When organizations need it
- When the external penetration test required by PCI DSS at least every 12 months and after significant changes is due.
- When a new VPN, remote access solution or cloud environment is made accessible from the internet.
- When acquiring a company, before its internet-facing systems are connected to your network.
Method
How we work
-
Asset confirmation
We identify your IP addresses and domains and compare the results with your list.
-
Service analysis
We identify the exposed services, their versions and authentication methods.
-
Manual testing
We verify in a controlled manner which vulnerabilities are exploitable and look for a path to the internal network.
-
Report and retest
We rank findings by impact and retest after remediation.
Outcome
What you have at the end
You receive a list of your internet-facing attack surface and any paths into the internal network. Forgotten systems missing from your inventory are also identified.
Frequently asked questions
Are our cloud and SaaS services in scope?
IP addresses and domains belonging to you are in scope. Cloud providers' testing rules are followed and the provider's own infrastructure is not tested.
Is the test limited to our own IP list?
Your list is the starting point. Before testing additional assets found during discovery, we confirm ownership with you.
Is denial-of-service (DoS) testing included?
No, it is not in scope. Actions that could slow your service are performed only with your approval and within an agreed time window.
Penetration Testing
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting