External infrastructure testing
External network penetration testing
Everything you expose to the internet is being scanned right now. We show you what an attacker sees and which doors actually open.
Who it is for
- Organisations with VPNs, remote desktops or firewalls facing the internet
- Businesses that have moved services to the cloud
- Teams needing evidence for insurers, auditors or customers
- Anyone unsure what they actually expose online
What we cover
Attack surface discovery
Finding forgotten subdomains, hosts and services using open-source intelligence and DNS.
Service testing
Manually testing exposed services for weaknesses, default credentials and known vulnerabilities.
Remote access
VPNs, remote desktop gateways, Citrix and email portals: the usual first way in.
Cloud exposure
Publicly reachable storage, management interfaces and misconfigured security groups.
Email security
SPF, DKIM and DMARC configuration and how easily your domain can be spoofed.
Credential attacks
Carefully controlled password spraying against login portals, where agreed.
How it works
Scope
You give us the IP ranges and domains. We confirm ownership and agree testing windows.
Discover
We map your real attack surface, which often includes assets you did not know about.
Exploit
We verify each weakness by hand, so you get confirmed findings, not scanner noise.
Report & retest
A prioritised report, a debrief call and a retest once fixes are in.
What you get
- Map of your discovered internet-facing assets
- Verified findings rated by risk, with remediation steps
- Same-day notification of critical exposures
- Executive summary for leadership and insurers
- Debrief call and free retest
Frequently asked questions
Can't find your answer? Ask in the form below and we will get back to you as soon as we can.
What do you need from us to start?
The IP addresses, ranges and domains in scope, plus written authorisation from someone who can approve testing. If you are unsure what you own, we can start with a discovery exercise.
Will testing disrupt our services?
External testing is low risk. We avoid denial-of-service techniques and throttle our tools. If you have fragile systems, tell us and we will test them outside business hours.
Do we need to tell our hosting or cloud provider?
AWS, Azure and Google Cloud no longer need advance notice for most testing, but some hosting providers do. We will tell you if your provider has a policy you need to follow.
How is this different from a vulnerability scan?
A scan lists potential issues automatically. A penetration test has a person confirm what is exploitable, chain weaknesses together and remove false positives, so you know what genuinely matters.
What does the report look like?
You get a management summary written for non-technical readers, then a technical section with every finding rated by risk. Each finding has evidence, steps to reproduce and clear remediation advice. We walk you through it on a debrief call.
Is a retest included?
Yes. Once you have fixed the issues, we retest the findings rated critical, high and medium within 90 days of the report at no extra cost, and give you an updated report.
Get a fixed quote
A few quick questions so we can scope it properly. No obligation, no hard sell.
Thanks, we have your enquiry.
We will reply as soon as we can. If it is urgent, email hello@redstackd.com.