What is external infrastructure penetration testing?
External infrastructure penetration testing looks at everything your organisation exposes to the internet and asks what an attacker with no access could do with it. Incursion tests internet-facing hosts, services and perimeter devices for UK organisations, delivered by named consultants who hold UK Cyber Security Council professional titles.
What we test
Discovery of your internet footprint: hosts, services, subdomains and cloud assets, including ones you may not know about.
Perimeter devices: firewalls, VPN gateways, remote access and remote desktop services.
Exposed services: mail, DNS, file transfer, management interfaces and anything else listening.
Known vulnerabilities, verified by hand rather than reported from a scanner, and weak or default credentials.
TLS configuration, certificate hygiene and information leakage.
Web servers and applications at the surface level; deep application testing is scoped separately as web application testing.
Why it matters
The external perimeter is what every opportunist attacker sees first, and it is where most ransomware incidents start: an exposed remote access service, an unpatched VPN appliance, a forgotten server. An external test is the most cost-effective test most organisations can buy, and it is the one Cyber Essentials Plus most closely resembles, although it goes considerably further.
How we run it
Scoping. Your account manager and an active penetration tester work with you to agree the scope of your test on a scoping call. The quote is fixed to it.
Testing. A named, suitably qualified consultant does the work, and you get a direct line to them before, during and after the engagement. Critical and high-risk issues are verified and reported immediately.
Reporting. Easily digestible summaries sum up the whole engagement and support detailed technical findings, written so your team can replicate and fix them. Delivered within 5 working days.
Free retesting. One day of free retesting for every five days of consultancy, taken within 90 days of report delivery, so you can be sure the fixes worked.
Scoping notes
Give us the IP ranges and domains you own. We also look for assets you have not listed, and tell you about them. External testing is done remotely; we agree testing windows and a contact for the duration.
What you get
A named consultant with a UK Cyber Security Council professional title, who scoped the work and delivers it.
A report within 5 working days: executive summary, technical summary, and observation, impact and remediation for every finding.
Immediate notification of critical and high-risk issues, once we have verified them.
Free retesting: one day for every five days of consultancy, within 90 days of the report.
A walkthrough call with the consultant for your team, on request, at no extra cost.
Frequently asked questions
How is this different from the Cyber Essentials Plus external scan?
Cyber Essentials Plus runs a vulnerability scan against your public IPs and checks the results against the scheme’s criteria. An external penetration test does that and then a person attempts to exploit what is found, chains findings together and looks for things scanners miss. See penetration testing alongside Cyber Essentials Plus.
How many IP addresses can you test in a day?
It depends on what is running on them. A /24 range with five active hosts and minimal exposed services is quick. A /24 with 150 hosts and multiple exposed services on each is not. This is why every external test is scoped in a session led by a penetration tester, not a sales estimate.
Will you find assets we do not know about?
Usually, yes. Forgotten subdomains, old cloud instances and staging systems are common, and they are often the weakest point.
Ready to scope a test?
Book a call. Our sales team will set it up and handle the proposal; an active penetration tester agrees the scope with you. No obligation.