Network

External network pentest

A test of your internet-facing estate — including the hosts nobody remembers standing up — covering what is exposed, what is exploitable and what a determined attacker could do with the credentials your people reuse.

Book a scoping call All services

areas covered

stages, scoping to retest

In-house

testers, never subcontracted

portal.cyberlysecure.com/acme-health/coverage

Acme Health — Test coverage4 practices · 16 services · one team

In-house

Web app

API

SaaS

Mobile

Client-side

External

Internal

Segment test

Wireless

Vuln. assessment

Cloud config

Hardware & IoT

AI & LLM

Social eng.

Physical

Red team

ApplicationsNetworkCloud & devicesPeople & premises

6 in scope · one team · one report

In-house testers 0 subcontracted

Every surface one team

What this is

What the test covers.

Most external compromises do not start with a novel exploit. They start with something that should not have been reachable: a forgotten test host, a remote access portal without multi-factor, an appliance a patch cycle missed.

We start by finding what you actually expose — which is frequently more than the list you have — then we test it the way an attacker would, including the credential attacks that need no vulnerability at all.

PTES NIST SP 800-115 OSSTMM

What we test

Attack-surface discovery: domains, subdomains, IP ranges, cloud estate and forgotten hosts
Service enumeration, version exposure and default or leftover configuration
Edge devices: VPN concentrators, firewalls, mail gateways and remote access
Known-exploitable vulnerabilities, validated by hand rather than reported from a banner
Password spraying and credential reuse against exposed portals, within agreed limits
Multi-factor coverage gaps across every authentication surface you expose
Administrative interfaces, management ports and default credentials
Information leakage from certificates, headers, error pages and public repositories

How it runs

From scoping call to retest, here’s what happens.

Typically one to two weeks, depending on the size of the exposed estate.

Scope and authorize

We confirm ranges and domains in writing, agree rules of engagement and notify you of the test window.

Discover the real surface

We map what is reachable from the internet and bring back anything that is exposed but not on your list.

Test what answers

Every live service is probed, fingerprinted and — where a real issue exists — exploited under the agreed rules.

Try the front door

Credential attacks and multi-factor gaps are tested with agreed lockout-safe thresholds.

Report, readout and retest

You get an evidenced report ordered by what to fix first, a readout, and a retest when fixes land.

What it surfaces

The kind of thing this test tends to find.

Real examples of what this engagement uncovers — anonymized, and never every time. What matters is that you find out before somebody else does.

Hosts and services nobody on the current team knew were exposed

Remote access portals where multi-factor is optional or partially deployed

Edge appliances running versions with public, working exploits

Management interfaces reachable from the whole internet

Valid credentials recovered through spraying or reuse of breached passwords

Frameworks this test supports

Testing that counts toward your framework.

These programs call for this test, or their assessors and your customers expect it. If one of them is on your desk, readiness and testing come from the same team.

SOC 2

Shows your internet-facing perimeter matches the protections your system description claims.

SOC 2 readiness

ISO 27001

An independent test of your internet-facing perimeter gives the certification body evidence that your network security and vulnerability controls work as your SoA states.

ISO 27001 readiness

PCI DSS

Requirement 11.4.3 calls for external penetration testing at least annually and after any significant infrastructure or application upgrade or change.

PCI DSS readiness

HITRUST

The HITRUST CSF includes requirement statements on technical vulnerability management and penetration testing, and External Assessors look for testing of internet-facing systems that handle protected health information.

HITRUST readiness

CMMC

Internet-facing systems are the front door to the CUI environment; testing them gives you boundary protection evidence and real findings to fix before an assessor looks.

CMMC readiness

NIST SP 800-171

Your internet-facing systems are where attackers start. Testing them gives you boundary protection evidence and findings to close before they become incidents you have to report.

NIST SP 800-171 readiness

FedRAMP

FedRAMP’s guidance includes an attack vector from outside the system to the CSP target system; an external test covers the same ground before the 3PAO does.

FedRAMP readiness

GovRAMP & TX-RAMP

Your internet-facing infrastructure is in scope for every baseline; an external test produces boundary protection evidence and findings to close before assessment.

GovRAMP & TX-RAMP readiness

HIPAA

Internet-facing VPNs, remote access, email and portals are where many healthcare intrusions begin, and the proposed Security Rule update would make penetration testing an explicit expectation.

HIPAA readiness

NIST CSF

Shows whether the outcomes you score under Protect hold up against your internet-facing attack surface.

NIST CSF readiness

Cyber Essentials

The firewall control turns on what is exposed at your boundary. Testing your external footprint finds open administrative interfaces and forgotten services that would fail that requirement.

Cyber Essentials readiness

IRAP

Your internet-facing gateways and administrative interfaces are among the first things an assessor and an agency’s security team consider.

IRAP readiness

Risk assessment

Shows what an outside attacker can actually reach and exploit, which is the evidence behind the likelihood ratings for your internet-facing risks.

Risk assessment readiness

Security program

Gives the program an independent measure of internet-facing exposure, one of the first things customers and insurers ask about.

Security program readiness

Vendor & third-party risk

Shows customers and auditors that your internet-facing exposure has been independently tested, a standard request in vendor due diligence.

Vendor & third-party risk readiness

M&A due diligence

With the target’s written authorization, an external penetration test shows whether its internet-facing exposure is actually exploitable — evidence that turns a concern into a finding the deal can price.

M&A due diligence readiness

Getting started

What you get, and what we need from you.

What you get

Technical report — Every finding, the evidence behind it and clear guidance your engineers can act on.
Executive summary — Your risk explained in plain language for leadership and the board.
Attestation letter — Signed confirmation of testing to hand your auditors.
Readout call — A walkthrough with the people who tested your systems.
Retest — Confirmation your fixes worked, documented for whoever needs to see it.

What we need from you

The IP ranges and domains you own, and written confirmation you own them
Your hosting or cloud provider’s testing policy, where one applies
Agreed test windows and an escalation contact
Whether we should test blind or with your asset list in hand

Missing something on this list? Bring it to the call — we scope around what you have.

Others in Network