Home / Services / External network penetration testing
External network penetration testing
An external network penetration test is a controlled attack on everything your business exposes to the internet. Our certified testers try to break in the way a real attacker would, then show you what they reached and how to fix it.
What do we test?
Any system you approve that can be reached from the internet, including:
- Firewalls, VPNs and remote access gateways
- Mail servers and Microsoft 365 or Google Workspace sign-in
- Websites, web servers and exposed APIs
- Remote desktop, SSH and file transfer services
- DNS, including subdomains you may have forgotten
- Cloud services with public endpoints
What do you get?
- An executive summary written for your board and leadership
- Each finding with evidence, risk rating and the steps to fix it
- The attack paths a tester used, beyond a list of issues
- Findings in the portal as soon as they’re confirmed
- Retests of your fixes, with the result added to the report
- A report signed by a certified tester for your auditor or insurer
How does the test work?
Scope and approval
We agree which IP ranges and domains to test, and you approve them in writing. We prove ownership before any active testing.
Discovery
We map what’s exposed, including systems that aren’t on your asset list.
Testing
A tester attempts to exploit what we find, safely and within the agreed scope.
Review and report
A second tester reviews the work. A Team Lead sets severity and signs the report.
Retest
When you’ve fixed an issue, we test it again and update the report.
Which compliance requirements does it support?
- PCI DSS v4.0.1 Requirement 11.4.3, external penetration testing
- SOC 2 Type II evidence for your auditor
- Cyber insurance applications and renewal questions
- NIS2 and DORA testing for EU organizations
One-off test or year-round?
You can buy an external test on its own. In a year-round plan it’s part of your baseline, and any new internet-facing system is tested when it appears at no extra cost.
External penetration testing questions.
What is the difference between an external and an internal penetration test?
An external test attacks you from the internet, the way an outsider would. An internal test starts inside your network, the way an attacker would after a phishing click or a stolen laptop.
Will testing disrupt our systems?
We test within the agreed scope and avoid techniques that could take systems offline unless you’ve approved them. We agree testing windows and an emergency contact before we start.
How often should we run an external penetration test?
At least once a year and after significant changes to internet-facing systems. That’s the PCI DSS requirement and a common insurer expectation.
Can our MSP buy this for us?
Yes. Many clients buy through their MSP, who may sell it under their own brand.
Find out what an outsider can reach.
A year-round retainer, or a one-off external test scoped to your estate.