External Infrastructure Testing
Everything you expose to the internet — mail, VPN, remote access, forgotten subdomains — is being probed constantly by people who never asked permission. We examine your perimeter with the same persistence, find what is actually reachable, and tell you which exposures matter before someone else does.
Who this is for
- You are commissioning your first penetration test and want to start where attackers start
- The board or an audit committee has asked for independent assurance on internet-facing risk
- Your cyber-insurance policy or renewal questionnaire requires evidence of external testing
- Your footprint has grown — cloud services, acquisitions, remote working — faster than your inventory of it
What we test
Coverage runs in depth, not breadth alone — each stage goes past where the one above it stops.
- Surface
What is actually listening
Every service and port reachable across your public ranges — including the systems nobody remembered were there. The inventory usually differs from the one you were given.
- Services
Mail, DNS and remote access
SPF, DKIM and DMARC posture, zone-transfer and subdomain-takeover risk, and the remote-access gateways that front your network — with their authentication.
- Exploitability
Which known issues actually work
Rather than flagging a vulnerable version and moving on, we safely demonstrate which CVEs are genuinely exploitable from the internet against your build.
- Credentials
What is already for sale
Breached and stealer-log credentials for your domains, tested with care against your login portals where scope permits — the route that needs no exploit at all.
- Beyond the range
The perimeter you did not draw
Subdomains, certificates and third-party services that widen the attack surface past the IP ranges you handed us. Attackers do not stop at your asset register.
What you get
The package in three parts — what you read, what you act on, and what happens after.
What you read
A statement of exposure, not a scanner export.
- A clear statement of what an internet-based attacker can see, reach and exploit today
- Findings rated by CVSS and ordered by real-world exploitability, not scanner noise
What you act on
Enough detail to reproduce and to brief upward.
- Reproduction detail and remediation steps for every finding
- An executive narrative for leadership alongside the technical detail
- Same-day notification of critical exposures so remediation starts before the report lands
What happens after
We confirm the fix rather than take it on trust.
- Verification of your fixes through a free remediation retest*
* Free remediation retesting applies to penetration testing engagements. It is subject to the size of the assessment and available for three months from delivery of your report. A web application test is typically covered; a large engagement — an internal test across hundreds of systems, for example — is scoped and quoted, and a full re-assessment is always chargeable.
How it runs
The same six phases, every engagement
Threat Model Development
We agree what the exercise is replicating: the credible threats to your organisation, the starting position, the objectives, and which controls are in scope. It is also where disruption is bounded, so the test does not cost you a working day.
Information Gathering
Enumerating the systems and services actually in play from that starting point, so the attack surface is mapped as it is rather than as the asset register describes it — and choosing tools and techniques that suit it.
Vulnerability Identification
Examining that surface for weakness, using automated tooling for breadth and manual technique for everything a scanner cannot reason about. Neither finds what the other does, which is why the blend is deliberate.
Attack Vector Development
Weighing each weakness against your actual environment — how exploitable it really is, what skill it demands, what it would cost you. The output is the routes that are practical here, not the ones theoretically possible somewhere.
Exploitation
Where it is appropriate, we exploit, which usually opens a fresh attack surface and sends us back round the cycle. Where exploiting would cause harm we verify the finding is genuine rather than a stale banner, and assume the worst case.
Reporting
One document for two audiences: an executive summary your board can act on, and the technical chain your engineers can reproduce step by step, each finding carrying its severity and its remediation.
Prerequisites
- Confirmed ownership of the IP ranges and domains in scope
- Allowlisting of Laneden's public IP addresses on protective controls where required
- A signed Laneden authorisation form
Frequently asked questions
How is this different from a vulnerability scan?
A scan lists possible weaknesses; we establish which are real. Our engineers verify exploitability by hand, remove false positives, chain findings together and add exposures — like leaked credentials — that scanners never see.
Could testing knock our services offline?
We do not run denial-of-service attacks, and exploitation is attempted only where it can be done safely. Anything with residual risk is agreed with you first, including out-of-hours windows if you prefer.
We only have a handful of public IPs. Is it worth testing?
Often yes — small perimeters concentrate risk. A single exposed VPN gateway or mail server with a weakness can be the whole story, and OSINT frequently reveals more surface than the IP list suggests.
What if you find a critical issue mid-engagement?
We phone your named contact immediately with enough detail to act. Severe findings are never held back for the final report.
Related services
Web Application Testing
Your web applications are your most exposed attack surface.
Learn more →
Internal Infrastructure Testing
When an attacker gets past the perimeter — through phishing, a compromised laptop or a rogue device — how far can they go?
Learn more →
Vulnerability Assessment
Not everything needs a full penetration test, and not every budget stretches to one each quarter.
Learn more →
Ready to test your defences?
Tell us about your external infrastructure testing requirement — we'll come back with a scoped proposal within two working days.
Free remediation retesting* to confirm your fixes (subject to assessment size).