Overview
Internet-facing VPNs, firewalls, mail gateways and forgotten test servers are where many UK incidents begin. We map what is reachable from the internet, confirm which weaknesses can be exploited and show which ones open a route inwards. The results also help you check edge devices against the 14-day patching window that Cyber Essentials sets for high and critical updates.
An external test starts with honest discovery, because organisations rarely have a complete picture of what they expose. We enumerate the hosts, services, domains and forgotten assets reachable from the internet, then compare that against what you believe is in scope. Shadow infrastructure, a staging box left public or an exposed admin panel is often where the real risk sits, and finding it is half the engagement.
With the perimeter mapped we test each exposed service for the weaknesses that matter: default or weak credentials on remote access, VPN and firewall gateways; outdated software with known vulnerabilities; misconfigured mail, DNS and web services; and authentication that can be brute-forced or bypassed. We work carefully and avoid denial of service, because the point is to demonstrate a realistic route in, not to knock your services over.
The report is organised around that question of access. Rather than a flat list of open ports, you receive findings grouped by the risk they create, each scored with CVSS v4.0 and accompanied by evidence and a fix. Where several low-severity issues combine into a plausible path to internal access, we show the chain, because that is how real intrusions happen and how your remediation should be prioritised.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Scope & authorisationWe confirm ranges and gain written authorisation before any testing.
- DiscoveryWe enumerate the full internet-facing surface, including assets you may have missed.
- Service testingEach exposed service is assessed for configuration and known weaknesses.
- ExploitationWe safely demonstrate access where it exists, avoiding disruption to live services.
- Report & debriefFindings are grouped by route-to-access, scored and explained to your team.
What you receive
- Inventory of discovered internet-facing assets
- Risk-rated findings grouped by route to access
- CVSS v4.0 scores and prioritised remediation
- Illustrative evidence of any access achieved
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- PTES
- NIST SP 800-115
- OSSTMM
- MITRE ATT&CK
- CVSS v4.0
- CWE
- UK GDPR Art. 32
- Cyber Essentials controls
Frequently asked questions
What do you need to start an external test?
A list of in-scope IP ranges and domains, written authorisation to test them, and a technical contact. We confirm ownership of each range before testing and will flag anything we discover that looks related but was not on your list.
Will this disrupt our live services?
We design the engagement to avoid it. We exclude denial-of-service techniques, throttle intensive checks and schedule anything higher-risk with your team. A named contact can reach the tester throughout, so any unexpected behaviour is paused immediately.
How is this different from a vulnerability scan?
A scan lists potential issues from signatures; our testers confirm what is real, discard false positives, and chain findings into actual routes to access. You receive verified attack paths with evidence, not an unfiltered list that still needs triage.
What permission do you need before testing our network?
Signed written authorisation from someone entitled to give it, which keeps the work on the right side of the Computer Misuse Act 1990. If a hosting company, landlord or managed IT provider runs part of the estate, we ask you to confirm their permission too.
Is this the same as a Cyber Essentials Plus audit?
No. Cyber Essentials Plus has a Certification Body check, hands-on, that the scheme's five controls are in place. An infrastructure pentest goes further, chaining weaknesses to show real attack paths. Many teams use our findings to tidy up before their Certification Body visits.