External Infrastructure Penetration Testing
Your perimeter looks secure. Let's prove it.
Assess your internet-facing infrastructure and gain assurance of your security posture through our CREST-accredited external penetration testing services.
- CREST-accredited
- Consultant-led testing
- Transparent pricing
External Network Security Testing
What our testing covers
We test your perimeter the way an attacker would, manually probing every exposed firewall, web service, gateway and remote access service rather than running a scan and stopping there. You get a working list of what's reachable and exploitable from the outside, in order of risk.
Because these systems are publicly reachable, they are continuously probed by attackers looking for misconfigurations, exposed services, and known vulnerabilities. A single weakness on the perimeter can provide an entry point into internal systems or sensitive data.
Typical external attack surface
- Firewalls & network gateways
- Remote access services (VPN, RDP)
- Web servers & applications
- Email & DNS infrastructure
- Third-party & cloud services
Why run an external pentest?
Attackers don't need to be inside your network, they just need one weakness on the outside. An external penetration test shows you where that risk exists and provides the remediation advice to close it.
Who Needs This
Who needs external penetration testing?
Any organisation with an external attack surface.
Get an External PentestBusinesses hosting public-facing infrastructure
Remote access services, web and mail servers, DNS and cloud-hosted assets all need assessing from the position an attacker would take.
PCI DSS, ISO 27001, and Cyber Essentials Plus
PCI DSS Requirement 11.4 mandates external penetration testing at least annually and after significant changes. For ISO 27001 it is a common way to evidence Annex A control 8.8, and testing ahead of Cyber Essentials Plus lets you fix issues before the assessment.
Organisations preparing for internal testing or red teams
Closing known external weaknesses first makes a later internal engagement or red team exercises more realistic.
Scope & coverage
What external infrastructure penetration testing covers
Scope depends on what your organisation exposes to the internet, and we confirm it during scoping. These are the asset classes we typically assess.
Remote access services
VPN gateways, RDP, SSH, and similar remote access endpoints. These are among the most targeted services on the perimeter and are assessed for weak credentials, known vulnerabilities, and misconfigurations.Firewalls, gateways, and edge devices
Perimeter appliances and any exposed management interfaces. Misconfigured firewall rules and publicly accessible admin panels are a common source of high-severity findings.Mail infrastructure
Mail servers, submission ports and related services, including your domain's SPF, DKIM and DMARC configuration and its exposure to spoofing.DNS and domain hygiene
DNS records, subdomain enumeration, and certificate transparency data to identify shadow IT, forgotten services, and misconfigurations that extend your attack surface beyond what is obviously in scope.Web services and APIs
Internet-facing web applications, admin panels, and APIs that form part of the infrastructure scope. Full application-layer testing is available as a separate web application penetration test.Cloud edge assets
Internet-facing infrastructure on AWS, Azure, GCP and similar platforms, assessed in the same way as on-premise infrastructure, from the position of an external attacker with no prior access. For testing of cloud workloads and a review of your cloud configuration, see cloud penetration testing.
Our Pentest Methodology
How we conduct external penetration testing
External testing follows a structured process: mapping what is exposed, validating what is exploitable, and documenting impact in terms that support both technical remediation and compliance evidence.
01
Scoping & Rules of Engagement
We agree the target IP ranges, domains, and testing boundaries with you before any active work begins. You specify constraints, such as timing windows, excluded systems and acceptable techniques, and we operate strictly within them.
02
Reconnaissance & Asset Discovery
We map your external attack surface through passive and active techniques: identifying servers, cloud assets, exposed services, subdomains, and infrastructure attributable to your organisation from the position of an unauthenticated attacker.
03
Vulnerability Analysis
Manual enumeration combined with targeted scanning to identify outdated software, exposed management interfaces, misconfigured services, and exploitable weaknesses across your external footprint. Every finding is manually validated.
04
Exploitation & Validation
Where vulnerabilities exist, we attempt controlled exploitation to confirm real-world impact. Brute force protections, default credential testing, and chained attack paths are assessed to determine what an attacker could actually achieve from initial access.
05
Reporting & Debrief
Findings are documented with reproduction steps, severity scoring, and remediation guidance mapped to CVE, CVSS, and MITRE ATT&CK where applicable. We provide methodology notes suitable for QSA and auditor requirements, and offer a debrief session to walk through findings.
Pricing
From £2,100
for external network penetration testing
Not sure where your network fits? A 30-minute scoping call is free and gets you a fixed written quote.
No obligation · Strictly confidential · Reply within one business day
Pricing Examples
| Small network 1 to 25 IP addresses | £2,100 - £2,950 |
| Medium network 26 to 50 IP addresses | £2,950 - £3,750 |
| Large network 51 to 100 IP addresses | £3,750 - £4,650 |
| Enterprise network More than 100 IP addresses | £4,650 - £7,350+ |
Indicative ranges only. Pricing is based on the number of IPs, domains, and hosts in-scope, and the expected number of active services exposed. Your exact price is confirmed after a short scoping conversation.
Compare all our penetration testing services.
What's Included
- Fixed-price proposal agreed before testing starts
- Manual, consultant-led testing. Not automated scans
- Report within 2 business days, with an executive summary and technical findings
- Free focused retesting included to verify remediation
- Debrief call and Exploitr platform access at no extra cost
Common Questions
External network penetration testing: frequently asked questions
External network penetration testing starts from £2,100 for up to 25 IP addresses, with larger perimeters costing up to £7,350+. The number of live hosts and exposed services drives the testing time, and so the price.
Our penetration testing pricing guide compares costs across every service.
Typical external penetration tests take 2-5 days depending on scope. Reports are delivered within 2 business days of testing completion.
If you're preparing for your first assessment, our guide to scoping a network penetration test covers what information to have ready.
External testing is designed to safely simulate real attacks without causing service outages. We coordinate timing and agree acceptable testing windows in advance, and can schedule testing during off-peak hours if preferred.
There is an inherent element of risk in any penetration test or vulnerability scan. During scoping we ask about legacy, sensitive, or business-critical services to ensure extra care is taken where needed.
External penetration testing is a requirement or recommended control under several major frameworks:
- PCI DSS Requirement 11.4 mandates penetration testing of all cardholder data environment boundaries, including internet-facing systems. Annual testing at minimum, with additional testing after significant changes.
- ISO 27001 doesn't mandate penetration testing by name, but Annex A control 8.8 (management of technical vulnerabilities) expects you to identify and assess them, and an independent penetration test is a common way to evidence it.
We can provide methodology notes and structured reporting that supports QSA and auditor evidence requirements for each of these frameworks.
Annual testing at minimum. We recommend additional testing after significant infrastructure changes, new service deployments, or following any security incidents.
External testing focuses on what an attacker can reach from the internet, while internal penetration testing covers what they can do once inside your network. See network penetration testing for the full comparison and how to choose.
No, our external penetration testing is performed remotely. We do not require any physical access to your premises or infrastructure for this service.
You can request an external penetration testing quote using the form on our quote page. Include your IP ranges or subnet size, whether cloud infrastructure is in scope, and your preferred testing window.
We reply within one business day to confirm your scope, then send a fixed-price written proposal. External network testing starts from £2,100.
Ready to test your perimeter network security?
Our team will review your external footprint and provide a tailored scope that fits your budget and security needs.