External penetration testing
How an attacker sees your organisation from the outside — and how a controlled test finds the gaps first. What external testing covers, how it differs from internal testing, and what a good engagement should deliver.
What it covers
An external penetration test looks at everything your organisation exposes to the internet and tries to break in the way a real attacker would — starting with no access at all. Typical targets include:
- Public web servers, portals, and APIs
- Firewalls, VPN gateways, and remote-access services
- Mail servers and other exposed application services
- Misconfigured cloud storage and forgotten or shadow assets
The tester enumerates what is reachable, identifies weaknesses, and — within the agreed rules of engagement — safely demonstrates what could be exploited, rather than just listing theoretical issues.
External vs internal
The two answer different questions. External testing measures your exposure to the open internet: could a stranger get in? Internal testing assumes a foothold already exists — a phished laptop, a rogue insider, a compromised supplier — and measures how far that foothold could spread. A mature programme uses both, because a hard perimeter with a soft interior is a common and dangerous shape. See the guide to internal penetration testing.
Much of a modern perimeter now sits in the cloud. If your internet-facing services run on AWS, Azure or Google Cloud, read the cloud testing guide for the provider rules your tester must follow.
Testing and scanning work together
The NCSC recommends regular vulnerability scanning as part of vulnerability management, and, where scanning everything is not practical, advises prioritising the assets that are Internet-accessible. It is equally clear that automated scanning does not match manual testing for breadth and depth. An external penetration test is the periodic, manual check; scanning keeps watch in between. The guide to vulnerability assessment vs penetration testing explains how to buy both.
External testing is also a common requirement. PCI DSS requires external as well as internal testing of the cardholder data environment, and an external test is useful evidence for cyber insurance and ISO 27001.
What a good engagement looks like
Expect a clearly scoped list of in-range assets, a mix of automated and manual testing, and a report that ranks findings by real-world risk with concrete remediation advice — not just raw scanner output. A good firm will also offer a retest once you have fixed the issues, so you can prove the gaps are closed. The NCSC’s penetration testing guidance sets out the same shape: scoping, testing, reporting with severity ratings, and follow-up.
Next steps
Sources
- NCSC: Penetration testing guidance
- NCSC: Vulnerability scanning tools and services
- NCSC: Vulnerability management
- CREST: A Guide to Penetration Testing
- PCI Security Standards Council: Information supplement: Penetration Testing Guidance
Frequently asked
What is external penetration testing?
External penetration testing assesses the systems an organisation exposes to the internet — its perimeter — from the position of an outside attacker with no prior access. It targets public-facing servers, firewalls, VPNs, mail and web services, and anything else reachable from the open internet.
How is it different from internal penetration testing?
External testing starts from the internet with no credentials and asks "what can an outsider reach and exploit?" Internal testing starts from inside the network — as if an attacker already had a foothold, or a malicious insider — and asks "how far can they go from here?" Many organisations do both.
How long does an external test take?
It depends on how many live hosts and services are exposed: a larger perimeter, or one with many web applications, takes longer. Ask each firm how many days it has allocated and why.
How often should we run one?
Often enough that weaknesses do not sit unnoticed: the NCSC notes it is not uncommon for a year or more to pass between penetration tests. Retest after significant change to internet-facing systems, and check any compliance regime you work to; PCI DSS, for example, requires penetration testing at least annually and after significant change.
Compare UK penetration testing companies
Filter firms by service and accreditation, then contact the ones you like.
Browse the directory