External infrastructure penetration testing
Human-led testing of what the internet can already see: hosts, DNS, mail authentication, VPN and the cloud edge. Validated exposure and a retest — not a raw scanner dump, and not your internal Active Directory.
- Human-led
- Every reported finding reproduced
- Retest included
-
Human testers leadTooling widens coverage only
-
Scoped firstScope and rules agreed before testing
-
Retest includedIn-scope fixes retested
-
Reproduced findingsEvidence a developer can replay
What we test
Attack-surface discovery
Details
Internet-facing hosts, ranges, names and listening services that form the perimeter you asked us to look at.
DNS and domains
Details
Configuration and exposure that aid takeover or impersonation, limited to domains in scope.
Email authentication
SPF, DKIM and DMARC posture and mail-gateway exposure that changes spoofing resistance.
Details
SPF, DKIM and DMARC posture and mail-gateway exposure that changes spoofing resistance. This is a control review with evidence, not a phishing campaign.
Exposed services
Risky services, default configuration and known-vulnerable components on reachable hosts, manually validated.
Details
Risky services, default configuration and known-vulnerable components on reachable hosts, manually validated.
VPN and remote access
Details
Externally reachable VPN, bastion and admin endpoints: authentication and configuration, without a lockout stunt.
Cloud edge
Load balancers, published management endpoints and perimeter filtering that are in scope.
Details
Load balancers, published management endpoints and perimeter filtering that are in scope. Account-wide IAM is the cloud assessment.
Validation
Scanner output is a lead.
Details
Scanner output is a lead. A finding in the report was checked. Unconfirmed noise is not billed as a critical.
Paths
How exposed weaknesses connect, in language a platform owner can remediate.
Details
How exposed weaknesses connect, in language a platform owner can remediate.
About this scope
The starting point is an outsider with no VPN account and no domain password. If the question is what a stolen laptop can do inside Active Directory, that is network and Active Directory penetration testing, scoped on purpose.
A test, not a scan subscription
Read more
Vulnerability scanning has a place in hygiene. It does not explain which exposed service an outsider could use, and it does not retest your fix. This engagement plans, discovers, validates and reports, in the spirit of external testing described in NIST SP 800-115 and the pre-engagement discipline in the Penetration Testing Execution Standard. Those documents are a backbone, not a logo we paste on the cover.
There is one method sequence. The page used to repeat it; it does not any more.
Deliverables
- Executive summary of external risk and the order to fix it.
- Technical findings with evidence and reproduction appropriate to an external test.
- An inventory of in-scope hosts and services observed.
- Retest confirmation.
More about the report
A report can support SOC 2 and ISO 27001 evidence. It does not certify the company, and it does not replace the auditor. PoCForge is not a certification body and does not claim CERT-In empanelment. If a contract names an empanelled auditor, read when CERT-In empanelment is required and check the official list before you shortlist.
Who this fits
A good fit
- Teams with public IPs, VPN gateways or a hybrid edge who need a customer-ready answer about the perimeter.
- Often paired with web or API testing when those are separate systems, and with internal testing when you also want the assumed-breach story.
Worth knowing
- It is the wrong product if you wanted someone to sit inside the domain on day one.
Investment
Indicative $2,500 – $6,500 before taxes. Large ranges, many VPN portals, or a combined internal test change the quote. Starting prices · India external page.
TYPICAL INVESTMENT: $2.5K – $6.5K · taxes as applicable · final quote based on address space and services.
Preparing the perimeter scope
A useful external scope is a list, not a feeling. Send the domains you own, the ranges you want included, and the names you know are third parties so we do not test a vendor’s host by accident. If a VPN portal or a mail gateway is the asset you care about, name it. If a marketing site sits on a platform you do not control, say whether findings there should be reported or skipped.
Tell us the change window and the person who can confirm an outage is not us. We do not run high-volume availability tests, and we do not need them to answer whether a service is exposed. Production stays in scope only with that contact. Staging that does not match production is called out in the report so you do not remediate a twin that was never live.
Decide explicitly if this engagement stops at the internet edge. Internal Active Directory, assumed-breach objectives and cloud IAM inside the account are available, and they are not included by silence. Buyers who want both usually save time by booking them together with two starting positions written down, rather than hoping one narrative covers an outsider and a domain user.
How to read an external report
Start with validated exposure: services that answered, weaknesses that were reproduced, and the business impact of leaving them as they are. Informational hygiene is labelled as hygiene. An inventory of what we saw is there so your asset list can be corrected; it is not a promise that no other name exists on the internet. Remediation order follows reachability and impact, not a raw severity average. The retest checks the items you mark ready, from the outside, and says what is still open.
Recurring tests make sense after a migration or a new VPN, not as a way to repurchase the same unchanged range every month. If you need a cadence, say so at scoping and we will price only the delta.
Scope and rules
- Scope and rules. Domains, ranges, exclusions, windows and an escalation contact before active testing.
- Reconnaissance. Public registration and DNS, then reachable hosts and services from the outside.
- Validate. Safe checks of exposure and configuration. Exploitation only where the rules allow and impact is proportionate.
- Report. What is exposed, how sure we are, and what to change first.
- Retest. Closed items checked from the internet again.
- Say what was not internal. The report states that internal identity was out of scope unless you bought that too.
External perimeter hardening
Anonymised external perimeter hardening pattern: inventory gaps, exposures and email-auth posture before deeper application testing.
Read the case study →- Human-led
- Every reported finding reproduced
- Retest included
Related
Frequently asked questions
How is this different from a vulnerability scan?
A scan lists possible issues. This test checks what an outsider can actually use, writes the evidence, and retests what you fix.
Do you need credentials?
No. Credentials would make it a different test. Authenticated application testing belongs on the web or API pages.
Will testing disrupt production?
We avoid disruptive checks. Fragile services and change windows are written into the rules. You get a contact path if something looks wrong.
Is email phishing included?
No. We review mail authentication and exposed mail services. A phishing exercise is not hidden inside this scope.
Do you claim CERT-In empanelment?
No. PoCForge does not claim CERT-In empanelment.
Scope an external perimeter test
Send the domains and ranges, and say whether internal Active Directory is in or out.
Request a free scope review →