External testing
Public addresses, remote access, mail and web services, forgotten or unintentionally exposed systems.
Infrastructure test focus
Indicative view, not a measurement: 3 primary focus, 2 usual component, 1 context or scope-dependent, 0 outside normal scope.
| Area | Level |
|---|---|
| Authentication and sessions | primary focus |
| Authorisation and permissions | part of the test |
| Inputs and injection | limited focus |
| Business logic | out of scope |
| Configuration and exposure | primary focus |
| Data and secrets | part of the test |
External and internal tests answer different questions
External testing shows what anyone on the internet can see. Internal testing assumes attackers already have network access, for example through a compromised computer or account, and examines how far they can progress.
Scope reflects your goal: public addresses, network segments, sites and critical systems. Both perspectives can be combined.
Internal testing
Network and directory services, identity management, permissions, segmentation and paths to critical systems.
Cloud and hybrid environments
Exposed cloud services and access within provider terms and your authorisation.
A process planned around your operations
Before testing, we confirm written authorisation and Rules of Engagement: address ranges, exclusions, time windows, allowed and prohibited techniques, contacts and stop procedures. For third-party hosting or cloud services, we verify that provider terms permit testing.
Our approach draws on NIST SP 800-115 and penetration testing practice described in PTES. Techniques that could affect service availability require explicit agreement.
- Mapping available services and versions within agreed scope.
- Manual exploitability verification and false positive removal.
- For internal tests, checking permissions, segmentation and possible network movement.
- Ongoing escalation of critical findings as agreed.
Typical finding categories
Exposed services
Administrative interfaces, databases or remote access reachable from inappropriate locations.
Outdated software
Known vulnerabilities in unpatched systems and services, prioritised by actual reachability and exploitability.
Access and identities
Weak or default passwords, shared accounts, excessive privileges and identity management weaknesses.
Configuration
Unsafe defaults, weak encryption, unprotected shares or protocols.
Network segmentation
Missing separation between user, server and administration networks that facilitates attacker movement.
Attack paths, beyond a list of ports
Retesting is available when included in the proposal.
- Management summary: main attack paths and recommended priorities.
- Affected systems and services with evidence and reproduction steps.
- Weakness chains creating greater risk, with MITRE ATT&CK references where relevant.
- Recommended fixes and configuration changes referencing established guidance such as CIS Benchmarks.
- Test scope, exclusions and limitations.
What we need and the test's limits
External testing requires an address and domain list and confirmation you can authorise testing. For internal testing, we agree a starting point such as network access, a virtual machine or a standard account, plus an administrator contact.
Testing captures the state at a particular time and within agreed scope. It does not replace ongoing vulnerability management or monitoring and cannot prove the absence of other weaknesses.
