Infrastructure
Network Vulnerability Assessment & Penetration Testing
Understand what is exposed, what is reachable and where segmentation holds.
Explore scopeInfrastructure / 8 of 32
OSINT & External Attack Surface Review.
See the public footprint your organisation presents before choosing what to test.
An external attack surface review brings public-facing assets and exposure signals into a usable inventory. It helps teams connect domains, applications and third-party services to accountable owners. Findings are assessed for relevance; a public signal alone is not treated as proof of compromise.
A clear scope makes the differenceWhat the work
What the work
can cover.
Explore the areas that can shape this engagement. Final coverage follows your systems, priorities and access.
01 / Inside the scope
Domain inventory
Map agreed domains and publicly discoverable subdomains. Separate owned systems from hosted or third-party infrastructure before recommending active follow-up.
02 / Inside the scope
Application footprint
Identify publicly visible portals and service entry points. Record their apparent purpose and the team best placed to confirm ownership.
03 / Inside the scope
DNS and certificates
Review public DNS and certificate information for asset relationships. Document stale or unexpected records for owner validation.
04 / Inside the scope
Public documents
Review agreed public material for unnecessary technical disclosure. Focus recommendations on information management and publishing practices.
05 / Inside the scope
Repository exposure
Review agreed public repositories and references for potentially sensitive material. Handle suspected secrets through a controlled notification path.
06 / Inside the scope
Exposure triage
Validate relevance with asset owners and recommend a follow-up path. Distinguish confirmed ownership, uncertain attribution and retired services.
01 / 06
What your team receivesFrom evidence
From evidence
to owned action.
A useful result explains coverage, impact and next steps. The agreed proposal makes the deliverables clear.
- 01
Public-facing asset inventory
- 02
Ownership and confidence notes
- 03
Prioritised exposure observations
- 04
Recommended follow-up testing scope
Before the assessmentA useful
A useful
starting point.
These inputs establish the effort, coverage, intended use and timing.
- Primary domains and known brands
- Ownership boundaries and third-party services
- An asset owner for validation
Common questions
What defines the scope?
The systems, business objective and evidence you need determine the scope. The assets, access, deliverables and timetable are agreed before work begins.
What will our team receive?
A clear account of coverage, evidence-backed observations and prioritised next actions. The proposal sets out the exact deliverables and any follow-up review.
Can this fit an upcoming release or audit?
Share the milestone and the systems involved. The assessment can be shaped around that decision once technical fit and availability are confirmed.
Connected priorities
You may also need.
Infrastructure
Cloud Security Configuration Review
Make identity, exposure and configuration risks visible across your cloud estate.
Explore scopeInfrastructure
Infrastructure & Firewall Configuration Review
Check the settings behind the controls. Turn exceptions into an achievable hardening plan.
Explore scope