WHAT WE TEST
Comprehensive Perimeter Coverage
Firewall Configurations: Testing for bypass methods and weak rules.
Open Ports & Services: Identifying unnecessary exposure to the public web.
Encryption Weaknesses: Finding outdated SSL/TLS protocols.
Authentication Portals: Testing specific login pages for brute-force risks.
DNS & Email Servers: Checking for spoofing risks and misconfigurations.
Note: This assessment covers your public-facing infrastructure (IPs/Domains). For deep internal cloud configuration (IAM, S3 policies), check out our Cloud Security Assessment.
What We Frequently Discover
Forgotten Dev Environments:
Staging servers left open to the public.
Weak VPN Gateways:
Outdated SSL VPNs vulnerable to brute force.
Exposed Databases:
MongoDB or Elasticsearch instances with no auth.
Compliance-Ready Reports
Lock Your Digital Doors Before Someone Checks the Handle
Hackers are scanning your perimeter every day. Beat them to the punch with a comprehensive external assessment that identifies open ports and exposed services in days, not weeks.
Includes free retesting for validated remediation.
Will this take down my website or interrupt our services?
No. Our primary goal is to identify vulnerabilities, not to disrupt your business. We do not perform Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks unless specifically requested as a stress test. We tune our scanning tools to be respectful of your bandwidth, and our manual pentesters exercise extreme caution when validating exploits to ensure your uptime is maintained.
How often should we run an External Network Pentest?
For compliance (SOC 2, ISO 27001), an annual pentest is the standard requirement. However, your external perimeter changes constantly—every time a developer spins up a new server or changes a firewall rule. Because of this, we recommend our Continuous Penetration Testing model, which monitors your external assets year-round, alerting you to new risks the moment they appear.
Do you check for leaked credentials on the Dark Web?
Yes. As part of the OSINT (Open Source Intelligence) phase of our external test, we scour public breaches, paste sites, and dark web repositories for compromised employee credentials. Attackers often use these leaked passwords to bypass your perimeter defenses (like VPNs or portals), so finding them before they do is a critical part of our methodology.
Do I need to provide you with IP addresses, or do you find them?
We can do both! In a Blackbox test, we start with just your company name and domain to see what we can find via OSINT. However, for the most comprehensive coverage, we recommend a Greybox approach where you provide a list of known IP ranges to ensure we don't miss assets you think are private but might be exposed.
