Your internet-facing infrastructure is the first thing an attacker sees. External network penetration testing shows whether your public-facing systems can withstand a targeted attack from outside your network perimeter.
years testing for government and enterprise
CREST-accredited through CREST ANZ
Our external tests go beyond automated scanning. Assessors combine vulnerability discovery tools with manual exploitation to find what scanners miss, including chained attack paths, misconfigured cloud services and exposed APIs.
Every finding is validated, assessed for real-world exploitability and reported with prioritised remediation guidance.
An external network penetration test is a controlled security assessment in which an assessor works from the internet to identify and exploit vulnerabilities in your organisation’s publicly accessible systems. The assessor has no internal network access or credentials (unless a grey-box approach is agreed), simulating an external attacker targeting your perimeter.
The scope covers any system reachable from the internet, which today extends well beyond firewalls and mail servers.
validates each finding by hand
attempts real exploitation
chains individually low-risk issues into higher-impact attack paths
assesses the business impact of a successful compromise
A vulnerability scan only identifies the potential presence of known weaknesses. NIST SP 800-115 describes the difference between the two.
We do not run a single scanning tool and hand over the output. Each external engagement is scoped to your environment and includes manual testing across five areas.
We identify open ports, running services and their versions across your external IP ranges, then assess service configuration, default credentials, known vulnerabilities in exposed software, and network-level misconfigurations such as permissive firewall rules or unnecessary exposed services.
Public web applications and APIs are tested against the OWASP Web Security Testing Guide for injection flaws, broken authentication, insecure direct object references and business logic errors. REST and GraphQL testing covers authentication, rate limiting, data exposure and input validation.
Where your footprint includes cloud resources, we look for configuration weaknesses that allow unauthorised access: publicly accessible storage, overly permissive IAM policies on internet-facing services and exposed management interfaces, within the shared responsibility boundaries of AWS, Azure or GCP.
We assess email for spoofing resilience (SPF, DKIM and DMARC), open relay conditions and information disclosure in mail server banners. DNS testing covers zone transfer controls, subdomain enumeration, and DNSSEC where it is used.
VPN gateways, remote desktop services and other remote access infrastructure are tested for known vulnerabilities, weak authentication and configuration weaknesses that could give an attacker a foothold in your internal network.
Your external perimeter is the most exposed part of your infrastructure. It is continuously scanned by automated tools, targeted by opportunistic attackers and probed by more capable adversaries doing reconnaissance for targeted campaigns.
External penetration testing finds the specific weaknesses an attacker could use to gain initial access, exfiltrate data or disrupt services, and shows how those weaknesses combine into exploitable attack paths. Several compliance frameworks require or strongly recommend it.
Requirement 11.4 requires penetration testing of the external network perimeter at least once every 12 months and after significant changes (PCI SSC document library). dotSec is a PCI QSA company and a PCI DSS-compliant service provider.
Requires APRA-regulated entities to test the effectiveness of their information security controls. External pen testing is a direct way to test the controls on your perimeter.
The maturity model does not prescribe penetration testing, but it draws on ASD’s penetration testing experience, and external testing gives evidence for the patching and configuration controls.
Annex A control A.8.8 (Management of technical vulnerabilities) needs objective evidence about your exposure, which external testing provides.
Control CA-8 (Penetration Testing) is part of the high-impact baseline for US federal systems in NIST SP 800-53B.
If you operate a managed SOC or SIEM, external pen test findings also give context for detection rule tuning and alert prioritisation. Findings can feed directly into secure configuration and hardening and identity and access management, and our GRC specialists can align them with your risk register and provide audit-ready evidence.
External testing targets systems reachable from the internet, simulating an attacker with no internal access. Internal testing works from inside the perimeter, simulating an attacker who already has a foothold, for example through phishing or stolen credentials. External testing shows whether someone can break in; internal testing shows how far they can go once inside. Most organisations benefit from both, and we can scope a combined engagement.
It depends on the size of the external attack surface. A handful of public IPs and a web application may take several days; multiple network ranges, cloud environments and several web applications can take two to three weeks. Timelines are agreed during scoping, and we schedule testing with your operations team to avoid disruption.
Yes, where cloud-hosted services form part of your external footprint. We test for publicly accessible storage, misconfigured IAM policies on internet-facing resources, exposed management consoles and other cloud-specific weaknesses across AWS, Azure and GCP, within each provider’s shared responsibility boundaries. Provider-specific authorisation is handled during scoping.
At a minimum, annually and after any significant infrastructure change, such as a major application deployment, cloud migration or network redesign. PCI DSS requires annual testing plus testing after significant changes. Higher-risk or fast-changing environments may need more frequent testing, or continuous vulnerability scanning between pen test engagements.
If your organisation needs an external penetration test, whether for compliance, risk management or as part of a broader security improvement programme, dotSec can scope an engagement to match your requirements.
Not sure what to include in scope? We can advise based on your internet-facing systems, cloud footprint and compliance obligations.
