Penetration testing
External Network Penetration Testing
What an attacker on the internet can see, reach and exploit, validated against the assets you authorise.
Engagements from $5,000 CAD. Free scoping, a fixed price in writing before any work begins, and one retest included.
At a glance
Is this the right test?
- Best when
- You have not reviewed your perimeter since the last migration, acquisition or new remote-access service.
- Covers
- Discovery of what you expose, service enumeration, leaked credentials, login surfaces, exposed management interfaces, and exploitation of what is found.
- You learn
- A confirmed inventory of what you expose, and which of those exposures lead somewhere.
Before we start
What we need from you
Scoping settles the details. These are the things that usually decide whether testing can start on the agreed date.
- The IP ranges and domains you own and authorise, in writing.
- Anything in that range that must not be touched, such as third-party hosted services or systems under contractual limits.
- A contact who can be reached during the testing window if something needs a quick decision.
Deliverables
What lands in your inbox
- Executive summary
A plain-language account of perimeter exposure, written for the people who approve the remediation budget.
- Overall security grade
A single grade derived from the most severe confirmed finding, using the thresholds set out in the report.
- Confirmed asset inventory
What we found exposed, which is frequently more than the inventory you started with.
- Detailed technical findings
Every finding with CVSS vector, CWE classification, affected hosts and reproduction steps.
- Proof-of-concept evidence
Evidence for each finding, captured from our declared testing IP range so every action is traceable.
- Remediation recommendations
Written against the exposed service or configuration, and ranked by exploitability, business impact and what to close first.
- Retest summary
Issued after remediation, confirming what is closed and what remains exposed.
See a redacted excerpt from a real finding, and what the full report adds.
Why it matters
What this protects you from
-
Your perimeter is larger than your inventory
Testing regularly turns up hosts nobody remembered were running. You cannot patch what is not on the list.
-
Exposure is continuous, testing is not
A service published for a migration two years ago is still published. Attackers scan for exactly that.
-
Credentials leak outside your network
Employee credentials surface in third-party breaches and get reused against your perimeter. That path needs no exploit at all.
-
The first foothold is the expensive one
An exposed remote-access service, a forgotten host or a reused password is a common way in. Closing it before it is used costs far less than responding after.
Coverage
What we test
-
Attack surface discovery
Subdomain enumeration, IP range validation, and identification of hosts and services you may not have inventoried.
-
Service enumeration and fingerprinting
Open ports, running services, software versions and end-of-life components across the confirmed scope.
-
Credential and information exposure
Public and breach-sourced credential exposure, exposed documents, metadata and other openly available intelligence.
-
Authentication surfaces
VPN portals, webmail, remote access and admin interfaces, tested for weak configuration and credential attacks within agreed limits.
-
Misconfiguration and exposed management
Default credentials, open administrative interfaces, permissive access rules and unnecessary exposure.
-
Exploitation of identified weaknesses
Confirmed exploitation where it is safe and in scope, so impact is demonstrated rather than assumed. Anything left unconfirmed is reported as such.
Approach
Three ways to run it
-
Black box
We start from your organization name alone and discover the perimeter as an attacker would. The most realistic option.
-
Grey box
You supply a confirmed IP and domain inventory, and testing depth goes into the hosts rather than into finding them.
-
White box
Inventory plus network documentation and firewall rules, so exposure can be compared against what was intended.
Process
How the engagement runs
-
Scoping and authorisation
We agree address ranges, domains, exclusions and testing windows in writing, with authorisation confirmed before anything starts.
-
Discovery and enumeration
Full external discovery and enumeration to establish what is actually reachable, then validation of each host against the agreed scope.
-
Vulnerability identification
Automated and manual identification of weaknesses, with every automated result verified by hand before it reaches a report.
-
Targeted exploitation
Controlled exploitation of confirmed weaknesses to establish real impact. Denial of service is always excluded.
-
Reporting and remediation
Findings written with affected hosts, evidence and remediation steps, ranked by exploitability, business impact and what reduces exposure fastest.
-
Retest
After remediation we retest the reported findings, one round, requested within 60 days of the report, and issue a retest summary confirming closure.
Standards
What we test against
- NIST SP 800-115
- The assessment structure follows the NIST technical guide, which is what procurement and audit teams expect referenced.
- OSSTMM
- Methodology discipline and scope control, so testing stays inside agreed boundaries and results are repeatable.
- PTES
- Execution standard for intelligence gathering and exploitation phases, keeping discovery systematic rather than ad hoc.
- MITRE ATT&CK
- Findings are mapped to initial access techniques, so results line up with how your defensive team already models threats.