® 
Know what attackers see
before they find your network.
A controlled attack simulation on everything reachable from the outside. Your external attack surface fully mapped and tested by certified ethical hackers.
What is an external pentest?
You know your systems are reachable from the outside. You have services exposed to the internet. You get a confirmed picture of what an attacker can actually do with them. An external pentest simulates the perspective of an attacker with no prior knowledge or internal access. You discover which systems are reachable, which vulnerabilities are exploitable, and which attack chains are open. You receive a report with concrete findings, exploitation evidence, and direct remediation steps.
External Pentest: the attacker's perspective as your foundation
Your external attack surface is what an attacker sees first. Every publicly reachable service, from your website to your VPN gateway, is a potential entry point. An external pentest simulates the perspective of an external attacker who has no prior knowledge or internal access and attempts to get in.
The team starts with OSINT: what information about your organisation is findable online? Subdomains, email addresses, technology choices, leaked credentials. Then all publicly reachable services are systematically tested for vulnerabilities. Not only known CVEs, but also misconfigurations, weak authentication, information leaks, and logic flaws.
What sets a DEFION external pentest apart is the focus on attack chains. An individual vulnerability may appear low risk, but combined with other findings the path to full compromise can open up. The team thinks like an attacker: not in isolated vulnerabilities, but in scenarios.
Three risks that undermine your external security
-
Attackers continuously scan your public systems
Automated scanners run 24/7 and find your systems within minutes. One exploitable entry point can lead to full compromise of internal systems.
-
Shadow IT and forgotten systems expand your attack surface
Forgotten test environments, misconfigured cloud services, and undocumented subdomains sit exposed without your knowledge. OSINT retrieves more than most IT teams expect.
-
Isolated vulnerabilities combine into attack chains
A CVSS 5.0 vulnerability looks low risk in isolation. Combined with an information leak and weak authentication it becomes the gateway to your network. Automated scans do not see that combination.
Scope of the external pentest
How DEFION conducts an external pentest
Kick-off and scoping
Inventory of external assets, domains, and IP ranges. Rules, constraints, and planning are documented.
OSINT and reconnaissance
Passive and active information gathering. Subdomain enumeration, credential leaks, technology fingerprinting.
Threat analysis
Based on gathered information, likely attack vectors are identified for the target environment.
Exploitation
Active testing of CVEs, misconfigurations, weak credentials, brute-force attacks, web application flaws, and information leaks. Findings are chained into attack paths.
Post-exploitation
Determining what an attacker can reach after initial access. Lateral movement, privilege escalation, and data exfiltration are documented.
Reporting and debrief
Report with executive summary, technical details, CVSS scores, and remediation steps. Walkthrough with your team.
Deliverables
- Executive summary suitable for board and management
- Technical report per vulnerability: description, evidence (screenshots, PoC), CVSS score, and remediation steps
- Overview of the external attack surface
- Report debrief (virtual or on-site)
- Logs, screenshots, and tool output as attachments
- Optional: retest after remediation
Who is an external pentest for?
An external pentest is relevant for any organisation with publicly reachable systems. You face not only a technical risk but also a compliance obligation if you deliver digital services to customers or partners.
- Organisations with customer-facing portals, webshops, or SaaS platforms
- Companies that need to demonstrate ISO 27001, SOC 2, or NIS2 compliance
- IT and security teams seeking independent validation of their external security posture
- Organisations that recently migrated to the cloud or launched new services
- Companies after a merger or acquisition where the external landscape changed
FAQ
What is the difference between an external pentest and a vulnerability scan?
How do you define the scope of an external pentest?
Can I exclude specific systems from the test?
How quickly do I receive the report?
How does an external pentest relate to red teaming?
Ready to test your external attack surface?
Tell us what you want to test. We define the right scope together and start within days.
Want to learn more about pentesting? Read: What is a Pentest? A Complete Guide for Organizations in 2026