Overview
Your external perimeter is the first thing an attacker sees, and often the first thing a cyber insurer or auditor asks about. We enumerate what is exposed, test remote access gateways and published services by hand, and confirm which issues are reachable in practice. Traffic comes from fixed source addresses you approve, inside a window agreed around your US business hours or maintenance schedule.
An external test starts with honest discovery, because organizations rarely have a complete picture of what they expose. We enumerate the hosts, services, domains and forgotten assets reachable from the internet, then compare that against what you believe is in scope. Shadow infrastructure, a staging box left public or an exposed admin panel is often where the real risk sits, and finding it is half the engagement.
With the perimeter mapped we test each exposed service for the weaknesses that matter: default or weak credentials on remote access, VPN and firewall gateways; outdated software with known vulnerabilities; misconfigured mail, DNS and web services; and authentication that can be brute-forced or bypassed. We work carefully and avoid denial of service, because the point is to demonstrate a realiztic route in, not to knock your services over.
The report is organized around that question of access. Rather than a flat list of open ports, you receive findings grouped by the risk they create, each scored with CVSS v4.0 and accompanied by evidence and a fix. Where several low-severity issues combine into a plausible path to internal access, we show the chain, because that is how real intrusions happen and how your remediation should be prioritized.
How US engagements run
- Delivered remotely from India, 9.5 hours ahead of US Eastern in US daylight time and 10.5 hours in winter; calls and testing windows are set around your time zone at scoping
- Fixed-price proposals in US dollars, with scope, dates and the free retest written in before any work begins
- Written authorization signed by someone with authority over every target, because the federal Computer Fraud and Abuse Act and state laws make permission the dividing line
- Reports that name the requirement a test supports, such as PCI DSS 11.4, the FTC Safeguards Rule or SOC 2, without claiming a QSA, ASV or C3PAO role we don't hold
What's included
Our approach
- Scope & authorizationWe confirm ranges and gain written authorization before any testing.
- DiscoveryWe enumerate the full internet-facing surface, including assets you may have missed.
- Service testingEach exposed service is assessed for configuration and known weaknesses.
- ExploitationWe safely demonstrate access where it exists, avoiding disruption to live services.
- Report & debriefFindings are grouped by route-to-access, scored and explained to your team.
What you receive
- Inventory of discovered internet-facing assets
- Risk-rated findings grouped by route to access
- CVSS v4.0 scores and prioritized remediation
- Illustrative evidence of any access achieved
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- PTES
- NIST SP 800-115
- OSSTMM
- MITRE ATT&CK
- CVSS v4.0
- CWE
- PCI DSS v4.0.1 Req. 11.4
- NIST SP 800-171
Frequently asked questions
What do you need to start an external test?
A list of in-scope IP ranges and domains, written authorization to test them, and a technical contact. We confirm ownership of each range before testing and will flag anything we discover that looks related but was not on your list.
Will this disrupt our live services?
We design the engagement to avoid it. We exclude denial-of-service techniques, throttle intensive checks and schedule anything higher-risk with your team. A named contact can reach the tester throughout, so any unexpected behavior is paused immediately.
How is this different from a vulnerability scan?
A scan lists potential issues from signatures; our testers confirm what is real, discard false positives, and chain findings into actual routes to access. You receive verified attack paths with evidence, not an unfiltered list that still needs triage.
Does an internal and external test cover PCI DSS Requirement 11.4?
It can, when scoped for it. PCI DSS v4.0.1 wants penetration tests from inside and outside the network every year and after significant changes, following a documented methodology, plus proof that segmentation holds. We aren't a QSA or ASV, so quarterly ASV scans and the assessment itself stay with those firms.
Can you test our US networks without traveling?
Network, Active Directory, cloud and Kubernetes testing run remotely through a VPN account, jump host or small test device you place on the network. Wireless and hardware work need someone near the equipment; tell us the sites at scoping and we'll say plainly whether and how we can cover them.