The hosts you know about
One flat block: the servers on the host list. This is what an external test is usually scoped to, and the smallest part of the surface.
The identified external attack surface
People and exposed data, infrastructure, cloud services, applications and identity, mapped to identify relevant routes in.
People and exposed data
Names, roles, email formats and relevant public information reviewed where this is included in the agreed scope.
External infrastructure
VPN appliances, firewalls, mail and web servers, and the services they expose to the internet.
Cloud services
In-scope Microsoft 365, Google Workspace, Azure, AWS and other cloud services assessed through agreed identity and access paths.
Applications
Web applications hosted anywhere, by you or by a supplier, and the connected services wired to them.
Identity
Internet-facing authentication assessed for enumeration, password policy weaknesses and MFA gaps. Password spraying is used only when explicitly authorised.
What sits beneath it
Coverage follows a foothold inward, layer by layer, to the organisation itself. What a route reaches is what the exposure puts at risk.
External penetration testing
External penetration testing, as an attacker sees it
External penetration testing covers more than the hosts on a supplied list. We map exposed infrastructure, applications, cloud services and identity, then agree which paths to test.
A penetration tester replies within one working hour to ask the questions needed to scope your test.
Surface
What can an attacker see or reach?
An attacker sees more than internet-facing servers. They can use information about your people, exposed identities, cloud services, hosted applications and the infrastructure connecting them. We map those routes across the wider attack surface before testing where they lead in practice.
Overview
What is external penetration testing?
An external penetration test assesses what your organisation exposes to the internet. Authorised testers approach it from outside, as a real attacker would, then explain which routes they found, how far each one reached and how to close them effectively.
This is for you if…
Services face the internet
Mail, remote access, a website or a cloud tenancy that anyone can reach from outside.
Someone has asked for a test
A client's security questionnaire, an insurer or an auditor wants proof of an independent external test.
The edge has changed
A new service went live, a supplier moved you to the cloud or a firewall was replaced, and you want it checked.
New to the term? What penetration testing means, in our glossary
Motive
What are attackers after on your external perimeter?
Attackers are rarely interested in a server for its own sake. Their objective is the access behind it: the mailbox that can approve a payment, the cloud tenancy holding client files or the portal your staff and clients rely on.
We agree what matters most to your organisation, work back to the exposed routes that could reach it and focus testing where the potential impact is greatest.
Mailboxes
A mailbox that approves payments, and the people who trust what it sends.
Client files
The tenancy's shared files, and the connected applications included in scope.
Accounts
The identities behind a sign-in page, and what each one can reach.
The internal network
The systems behind a VPN appliance or a remote access service.
Reach
An overlooked route into the organisation
An organisation had previously focused its testing on its limited, well-secured internet-facing infrastructure. No practical route into the business had been identified. Expanding the assessment to include cloud identity uncovered a route through a compromised shared account into connected business services and sensitive information.
Anonymised assessment example
- Demonstrated
- Potential
Scope
Cloud identity included in the assessment
The organisation's internet-facing infrastructure was limited and well secured.
Yields Cloud identities available for assessment
Initial access
Shared account compromised through password spraying
A predictable password and the absence of MFA allowed access to the account.
Yields Access to the shared account and mailbox
Connected access
Access through single sign-on (SSO) and password resets
The compromised mailbox enabled password resets, while existing single sign-on (SSO) access provided entry to connected services.
Yields Authenticated access to connected business applications
Demonstrated outcome
Business applications and sensitive data accessed
Access was confirmed to WordPress administration, email distribution and CRM systems.
Verified by Adversify testers
Potential business impact
- Unauthorised changes to public websites
- Misuse of trusted email communications
- Exposure of customer and CRM information
In practice
Well-secured internet-facing infrastructure did not prevent compromise through cloud identity and a single compromised account provided access to multiple connected business services.
The attack path crossed identity, email, single sign-on (SSO) and password-reset mechanisms. Testing internet-facing infrastructure alone would not have identified this route.
Methodology
How Adversify tests your external perimeter
Every engagement follows a structured method, shaped by your attack surface. We look for routes into the business across internet-facing systems, apps, cloud identity and connected services, then follow each one as far as the agreed scope allows us to go.
- Credentials
- Applications
- VPN
- Microsoft 365
- People
Scoping and rules of engagement
Before testing begins, we agree the scope, objectives and authorised testing activities, covering relevant infrastructure, domains, cloud environments and identities. The rules of engagement establish testing boundaries, timelines, points of contact and procedures for reporting critical findings.
- Scope
- Rules of engagement
- Named contacts
Reconnaissance
We map the in-scope attack surface through active discovery and open-source intelligence, identifying exposed services, cloud identities and potential entry points. Findings from reconnaissance guide where testing is focused and which attack paths are investigated.
- Attack surface
- Open-source intelligence
- Entry points
Exploitation and attack-path validation
We assess identified entry points for exploitable weaknesses, including exposed infrastructure, applications and cloud identity services. Where access is achieved, we investigate potential attack paths and validate their impact within the agreed rules of engagement.
- Exploitation
- Attack paths
- Impact validation
Reporting and debrief
We provide a report detailing identified vulnerabilities, demonstrated attack paths and their business impact. Findings include technical evidence and actionable remediation guidance, followed by a consultant-led debrief to explain the results and recommended priorities.
- Reporting
- Debrief
- Remediation
Coverage
What does an external penetration test cover?
Our external perimeter testing examines the routes an adversary could use to gain access to your organisation. We assess internet-facing infrastructure, web applications, cloud identity and connected services, following potential attack paths within the agreed scope and rules of engagement.
Attack surface discovery
We identify and map your internet-facing assets, services and identities to understand the available entry points and guide testing.
Cloud identity and authentication
We assess exposed identity services, authentication controls and potential initial access routes across Microsoft 365 and other in-scope identity platforms.
Credential exposure
We examine relevant breach data and approved intelligence sources for exposed organisational credentials that could enable unauthorised access.
Internet-facing infrastructure
We assess firewalls, VPN gateways, servers and exposed services for exploitable weaknesses, insecure configurations and potential entry routes.
Cloud services and access
We investigate internet-accessible cloud services and management interfaces, including potential routes into connected cloud environments.
Applications and APIs
We assess exposed application entry points, authentication controls and routes to connected systems. Full application and API testing is scoped separately.
What you get
What you get from an external penetration test
You receive a clear report and a debrief with the testers. Each finding includes evidence, the route it opened, what it reached and practical remediation guidance. Priorities are based on business impact, and the next scope starts with what has changed.
You receive
The penetration test report
A clear summary for decision-makers and detailed findings for the people responsible for fixing them.
Evidence for every finding
Evidence and reproduction steps showing exactly how each validated weakness was demonstrated.
Validated attack paths
How weaknesses combined, what each tested route reached and where controls prevented further progress.
Remediation guidance
Practical improvements prioritised by business impact and the routes each control would close.
A debrief with the testers
A walkthrough for technical and leadership teams with the people who performed the assessment.
What changes
- Scope is drawn from the identified external attack surface
- Findings are validated by exploitation
- Priority follows what each route reached
- The next test starts from what changed
Your perimeter changes between tests. A new service goes live, a cloud setting changes or a credential is exposed. Continuous penetration testing combines monitoring of agreed exposure with human review and focused testing when a release, access change or new service creates risk.
Questions
External penetration testing questions
Answers to common questions about our approach, cloud coverage, live testing and what happens when access is achieved. For anything specific to your own environment or suppliers, our consultants can talk it through in detail with you on a scoping call.
Have another question? Speak to our team.
How is your external penetration testing different from a traditional infrastructure test?
Traditional infrastructure testing often focuses on known public IP addresses and exposed services. Our approach considers the wider external attack surface, including cloud identity, applications and connected services, to identify and investigate potential routes into your organisation.
Does testing include Microsoft 365, Google Workspace, Azure and AWS?
These environments can be included where relevant to the agreed scope. Testing focuses on externally accessible services, identity and authentication controls, and potential routes into connected environments. Comprehensive cloud configuration assessments are scoped separately.
Will you test against our live systems?
Yes. External penetration testing is normally conducted against live systems. Before testing begins, we agree the testing boundaries, permitted activities and escalation procedures. Potentially disruptive testing requires explicit approval and appropriate safeguards.
What happens if you gain access to our environment?
Where access is achieved, we investigate what an adversary could reach and the potential impact on your organisation, within the agreed rules of engagement. We document demonstrated attack paths and their business implications, rather than reporting individual vulnerabilities in isolation.
How often should external penetration testing be performed?
Annual testing is a common starting point, supplemented by assessments following significant changes to infrastructure, cloud environments, applications or identity services. The appropriate frequency depends on your exposure, risk profile and business requirements.
What happens next?
Ask for a quote scoped the way an attacker would scope it
Tell us what you believe is exposed and what you most need to protect. A penetration tester will reply within one working hour, clarify the scope and prepare a quote against agreed deliverables. If you would prefer to talk first, book a scoping call.
- Scoped to your perimeter, agreed before we start
- CREST-accredited penetration testing
- Based in York, working across the UK
A tester goes through the scope with you, and the quote follows once it is settled.