External Attack Surface Assessment
We look at your business the way an attacker does: from the outside, starting from your domain, looking for the easiest way in.
5 days of testing
All from the outside, the way an attacker works.
Outside in
We start from your company name and main domain.
No access needed
No installs, accounts or VPN. Just your written go-ahead.
Report in 2 to 3 working days
Proof and fixes in priority order, then a 60 minute walkthrough.
Retest included
Once you have fixed things, we check the fixes held.
Why attackers start here
Attackers don’t pick you. They find you.
They sweep the whole internet for the one server that missed a patch, then go after whoever owns it.
31%
of breaches began by exploiting a vulnerability. Now the most common way in.
- Exploiting a vulnerability31%
- Stolen credentials13%
SourceVerizon, 2026 Data Breach Investigations Report (opens in a new tab)
The patching gap
Cyber Essentials: fix critical and high risk flaws within
14 days
Typical time to fix a flaw attackers already use
43 days
That gap is the window attackers work in.
SourcesCyber Essentials, Requirements for IT Infrastructure v3.3 (opens in a new tab)Verizon, 2026 Data Breach Investigations Report (opens in a new tab)
26%
of critical flaws already under attack were fixed. Down from 38%.
SourceVerizon, 2026 Data Breach Investigations Report (opens in a new tab)
204
nationally significant incidents handled by the NCSC in a year, up from 89.
- 892024
- 2042025
Read the researchHide the research
- 31%
of breaches began with the exploitation of a vulnerability, overtaking stolen credentials (13%) as the most common way in for the first time in the report’s history.
Verizon, 2026 Data Breach Investigations Report (opens in a new tab)Nov 2024 to Oct 2025
- 43 days
is now the typical time it takes to fully fix a critical vulnerability that attackers are known to be exploiting, up from 32 days. Worse, only 26% of those vulnerabilities were fixed at all, down from 38% the year before.
Verizon, 2026 Data Breach Investigations Report (opens in a new tab)Nov 2024 to Oct 2025
- 204
nationally significant incidents were handled by the NCSC in a year, up from 89, out of 429 incidents that needed its support.
NCSC, Annual Review 2025 (opens in a new tab)Sep 2024 to Aug 2025
- 14 days
Cyber Essentials requires critical and high risk security updates to be applied within 14 days of release.
Cyber Essentials, Requirements for IT Infrastructure v3.3 (opens in a new tab)v3.3, April 2026
How we work
We think like an attacker
Map everything, find the weakest point, then spend our time there.
Every domain, cloud host and forgotten service.
ATT&CKTA0043ReconnaissanceThe software each one runs, and what’s out of date.
ATT&CKT1595Active ScanningThe domain most likely to give way.
Five full days showing how far an attacker could get.
ATT&CKT1190Exploit Public-Facing ApplicationWe map your whole outside footprint, then focus on one domain. If it has nothing of interest, we move to the next.
Your five days
Five days of testing, then your report
We map everything, then dig in where an attacker would. Your report follows two to three working days later.
Testing week
Mon
Map the outside
Everything with your name on it.
Tue
Pick the domain
The one with the weakest point.
Wed to Fri
Dig in
To see how far an attacker could get.
Two to three working days later
Report and walkthrough
Your written report, then a 60 minute call.
After you fix things
Later
Retest included
We check your fixes worked.
What you get
A report your engineers can act on
- The attack pathHow we got in, and how far it went.
- Every exposed assetIncluding the ones you didn’t know about.
- Proof for every findingScreenshots, not scanner guesses.
- Fixes in priority orderWhat to do first, and how.
Sample report, fictional client
What we need from you
Almost nothing
Two things to get started, and one more if you have it.
Your written go-ahead
A signed authorisation for the testing.
Your main domain
The one we start from.
Your asset listOptional
Helpful if you have one.
What we don’t need
- Software to install
- Logins or accounts
- Network or VPN access
Common questions
Before you book
A scan lists everything that might be wrong. We prove what an attacker could actually do, so you get a short list of real problems.
Penetration Testing usually covers systems you choose and tell us about. Here we start from your domain, like a real attacker, and find the rest ourselves.
We agree any limits with you before we start, such as systems to leave alone, and we tell you straight away if we find something serious.
Yes. We only start once you have signed a written authorisation.
A fixed five day engagement, priced for your organisation. Get in touch for a quote.