External Infrastructure Testing
External infrastructure penetration testing from the perspective of an unauthorised attacker on the internet. We find everything you expose, including the things nobody remembers putting there, then work out what can be turned into access.
What the Test Covers
An external infrastructure test looks at everything your organisation presents to the internet: web and mail servers, firewalls, VPN gateways, remote access portals, cloud hosted services and any management interface with a public address. It is carried out remotely with no internal access, from the same starting point an attacker has. The question it answers is what someone outside your network can reach and what they could do with it.
The Part That Finds the Most
Discovery. Most organisations do not have an accurate picture of their own external footprint. A server stood up for a project and never taken down. A subdomain a department commissioned without telling IT. A firewall rule opened for a migration and never closed. An appliance management page reachable from anywhere because that is how it shipped. We build the list from public DNS, certificate transparency logs and your address ranges, then compare it with the one you gave us. The serious findings are more often on the assets nobody listed than on the ones that were.
Exposure Plus a Password
Exposure on its own is a nuisance. Exposure with a working password is an incident. Billions of leaked credentials are freely available and some of your staff will have reused a password somewhere. Remote access portals, webmail and admin pages reachable from the internet are tested for missing multi factor authentication and username enumeration. A remote access portal with no second factor is often the shortest route from the internet into your internal network.
What You Get From the Test
An Accurate Inventory
A list of what you expose to the internet, built from the outside in, including the hosts and services your own records missed.
Findings That Are Real
Each finding is confirmed by hand and rated on what it means for your business. Unverified scanner output does not make it into the report.
A Smaller Perimeter
Clear advice on what to patch, what to restrict and what to switch off. Very little of what we find still needs to be reachable.
How the Test Runs
We agree the scope in writing first: your address ranges, domains and anything to be left alone. The tester maps your external footprint from public sources and compares it with your records. Anything we find that looks like yours but is not on the list is raised with you before it is tested. Every live host is scanned for open ports and running services. Each service is checked for known vulnerabilities, weak configuration, default credentials and missing multi factor authentication. Anything that looks exploitable is tested in a controlled way to confirm whether access can be gained, because a version number on its own proves nothing. Testing is remote and designed not to disrupt live services. Anything critical is reported the moment it is confirmed.
At a Glance
Asset Discovery
Your external footprint mapped from DNS, certificate logs and your address ranges.
Port & Service Enumeration
Every live host scanned for open ports and the services behind them.
Vulnerability Assessment
Each service checked for known CVEs, weak configuration, default credentials and missing multi factor authentication.
Exploitation Attempts
Controlled attempts to confirm whether access can be gained.
Report & Retest
A detailed report covering every finding, risk rating and remediation recommendation. Free retest included.
Findings appear in your client portal as we find them. Our day rate is published on the pricing page.
You May Also Be Interested In
Frequently Asked Questions
What is external infrastructure penetration testing?
External infrastructure penetration testing is a simulated attack against the systems your organisation exposes to the public internet. This includes web servers, mail servers, VPN gateways, firewalls and any other internet facing devices. The goal is to identify vulnerabilities that an attacker could exploit without any internal access to your network.
Is external infrastructure testing required for Cyber Essentials Plus?
No. Cyber Essentials Plus is an audit carried out by the certification body, which runs its own external vulnerability scan. A penetration test is not part of it. Testing beforehand helps, because it finds what that scan will find while there is still time to fix it. Many cyber insurers ask for evidence of external testing in its own right.
How is the test performed?
Remotely, from outside your network, with no internal access needed. We map your internet facing addresses and domains, scan them for open ports and services, check each service for known vulnerabilities, weak configuration and missing multi factor authentication, then confirm whether anything can be turned into access. It all runs within a scope agreed in writing and is designed not to disrupt live services.
How often should external infrastructure be tested?
At least once a year, timed so the report is current when your insurer or auditor asks for it. Test again after any significant change, such as a new service going live, a move to the cloud, a merger or a change to your firewall. The previous report describes an environment that no longer exists.