External penetration testing
Everything you expose to the internet, tested by hand the way a real attacker would approach it, with clear fixes for what we find.
When you need it
- Your annual security test is due
- A customer or insurer asks for evidence
- You have changed firewalls, hosting or remote access
- ISO 27001 or Cyber Essentials Plus preparation
What we test
We start with what anyone on the internet can see: your IP ranges, domains and the services behind them. Then we try to turn what we find into real access, the way an attacker would.
Forgotten hosts, open ports, exposed admin panels and services that should not be public.
VPNs, remote desktop gateways and single sign-on portals: authentication weaknesses and known vulnerabilities.
Outdated software, weak TLS, default credentials and misconfigured cloud-facing services.
SPF, DKIM and DMARC, subdomain takeover risks and information leaks in DNS.
How the test runs
- Scoping. You give us the IP addresses and domains in scope; we confirm ownership and any hosting provider rules.
- Testing. Usually two to three days, from fixed source IPs we share with you, in or outside office hours.
- Critical findings. Reported to you immediately, not saved for the report.
- Report and debrief. Prioritised findings with fixes, a walkthrough call, and one retest within 90 days.
Supports
- ISO 27001
- Cyber Essentials Plus prep
- PCI DSS
- Cyber insurance
Questions
Do you need anything installed on our network?
No. External testing runs entirely from the internet, from IP addresses we give you in advance.
Is this the same as a vulnerability scan?
No. We use scanners to cover ground, then manually verify and exploit what they find and look for issues they miss, so you get real risks rather than a long list of maybes.
Will our hosting provider mind?
Most major providers allow testing of your own resources without asking first, but some have rules. We check during scoping.
Know exactly what your test will cost by tomorrow
Tell us what you need tested. You'll get questions or a fixed quote within three working days.