Does your service provider only test the IP list you provide, or also what is missing from the list?
An external penetration test examines what aspects of your company are accessible from the internet, including systems not listed in any inventory. We map the attack surface via DNS, subdomains, and hosting partners, and manually verify exploitable vulnerabilities according to OWASP WSTG and PTES standards. We classify findings according to MITRE ATT&CK and evaluate them using CVSS.
The externally accessible attack surface is growing silently. A new cloud serviceA test system that remained online, a service provider's subdomain, a remote access point that no one has even noticed anymore. This is where attackers strike, because the perimeter is the first point of contact and doesn't require insider access. They are particularly focused on... VPN gatewaysFirewalls and remote maintenance access points, whose vulnerabilities ransomware groups exploit them in a targeted way.
The crucial point is rarely a single spectacular vulnerability, but rather an interplay of several factors: an exposed login alongside leaked access data, an outdated component behind a forgotten DNS recordWe examine which vulnerabilities in your context actually open the way in.
We determine which systems, services, and subdomains are publicly accessible, including shadow IT and systems at hosting partners. This scope also includes systems that were previously unknown or undocumented internally.
Any vulnerabilities identified are assessed and verified within the context of the company. You will not receive an unfiltered list of scanned vulnerabilities, but rather an assessment of what is exploitable and the associated risks.
Management access points, poorly secured remote maintenance, open administrative interfaces, and outdated software versions can give attackers entry points. These are the focus of the audit.
In the case of multiple locations or companies, we examine how systems expose each other and whether a vulnerability in one place opens a path to another.
Upon request, we can link perimeter findings with insights into exposed access data to reveal password reuse on accessible login services.
An external penetration test examines your company's internet-accessible systems and services from an attacker's perspective, without insider knowledge. The focus is on firewalls, VPN connections, web services, administrative interfaces, and forgotten subdomains. This test is designed for companies with remote access, portals, or cloud services. It ends at the perimeter and can be extended to include internal infrastructure or darknet exposure. Following the test, a technical workshop is recommended, especially given the constantly evolving attack surface. Pentest as a Service .
Together we determine which systems and address ranges will be checked, which are outside the scope, and how critical findings will be reported immediately.
We assess the accessible attack surface from the perspective of an external attacker before actively testing it.
The audit follows traceable attack paths. Every finding is documented immediately. We report critical vulnerabilities without delay, regardless of the reporting schedule.
Before the report is handed over, a second person checks the plausibility and risk assessment of each finding.
You will receive a structured report and a technical meeting where we will review findings and priorities with your team.
First, the technical findings for your IT team, then the remediation plan, then the summary for your management, and finally the audit report for customers, auditors, or insurers. Everything is based on the same findings.
Each finding is documented with evidence, CVSS score, and its impact and relevance to your environment. You will also receive an overview of the affected systems and devices. All findings are documented in a traceable manner and can be verified in a retest upon request.
A prioritized action plan with clear responsibilities, optionally refined in a technical workshop with your team. It forms the basis for resolving the issue, and upon request, we will support the implementation through to retesting.
Situation, risk, and decision-making requirements summarized in just a few pages, easily understandable without technical expertise. This allows you to engage management, committees, and specialist departments, communicate the findings, and identify necessary actions.
Confirmation of the completed audit, without disclosing technical details. For clients, auditors, regulators, and your cyber insurance.
The sample report shows which documents are part of a penetration test and what they cover. We determine the specific content and scope of the documents during the scoping process. We would be happy to explain this in more detail for your specific test type in a brief consultation; please feel free to contact us directly.
"As part of the penetration test, ProSec provided us with a comprehensive picture, not only of the requested landing page, but also of all URLs associated with the domain. They exceeded our expectations and, through clear recommendations (action plan), directly outlined concrete measures to ensure the long-term security of our data."
Philipp Klein, Board Member, scan.up AG
The external audit ends at the perimeter and shows the status at the time of the test. Depending on the specific questions being addressed, it can be supplemented with further audits or ongoing monitoring.
If you want to know how far an attacker can get after a successful entry at the perimeter, the internal test starts at this point.
Regarding the performanceIf the audit reveals more unknown systems than expected, the ongoing recording of shadow IT keeps the inventory up to date.
Regarding the performanceIf the test shows accessible login services, the Darknet scan clarifies whether leaked login credentials from your company still work there.
Regarding the performanceBriefly describe what it's about. We'll work out the details with you during the scoping process. For the consultation, we need...
You don't need to prepare; we'll guide you expertly step by step. Based on your business processes and IT systems, we'll work together to determine the right testing concept.
These are the questions we most frequently receive regarding this service. We'd be happy to clarify anything that's missing in a personal consultation.
A scan usually doesn't provide a reliable assessment. It reveals known vulnerabilities, but not which of them actually open a path to attack in your specific context, and it doesn't reliably detect misconfigurations or shadow IT. We conduct manual reviews, verify usable findings, and categorize them within attack chains.
A vulnerability analysis automatically identifies known vulnerabilities and manually confirms the findings to prevent false positives in the report. A penetration test goes further: it exploits vulnerabilities in a controlled manner and reveals the actual entry points into your network. The analysis is suitable for regular monitoring, while the penetration test provides a reliable assessment of your network's vulnerability.
External tests are generally not critical for ongoing operations. However, where a test could potentially impact a production system, we announce it in advance and coordinate the timeframe.
As a guideline, annually, and additionally after major changes to the accessible infrastructure. If your attack surface changes frequently, continuous testing in line with the changes is more effective than a single annual test.
An external penetration test examines the attack surface at a specific point in time and at a deeper level. Attack Surface Management It is constantly monitored. The penetration test manually verifies vulnerabilities and evaluates them in context. If your infrastructure changes frequently, continuous monitoring and targeted in-depth testing complement each other.
At a minimum, we need your known domains, IP ranges, and the companies involved. We'll determine the rest ourselves and verify it with you before testing. We only test systems at hosting partners or cloud providers if we have your permission.
We will immediately report any critical findings to your designated contact person without waiting for the report. This applies particularly to easily exploitable vulnerabilities in accessible systems and to indications of an ongoing compromise. We will then coordinate the next steps together.
Cloud resources accessible from the internet that you operate yourself are considered part of the external attack surface and therefore included in the scope of testing. For third-party SaaS services, the respective provider's testing rules apply, usually limited to your own configuration. We test identities and configurations in Entra ID and Microsoft 365 separately under Cloud & Microsoft 365.
Depending on the scope, the process takes anywhere from a few days to several weeks. The scope is primarily determined by the number of accessible systems and services, the number of companies and locations, the web applications being tested, and any specific test windows.
Further background information on the external audit and the vulnerability analysis.
Both methods test the resilience of your IT. They differ in depth and informative value.
| feature | IT vulnerability analysis | Penetration test |
|---|---|---|
| Agenda | Automated scan, findings manually confirmed | Manual review along real attack paths |
| exploitation | No | Yes, controlled and coordinated |
| depth | Broad, mostly on the surface | Deep, even across multiple weak points |
| Result | List of confirmed vulnerabilities | Attack vectors with evidence and evaluation according to CVSS |
| Suitable for | Regular monitoring | Reliable statement regarding vulnerability, proof for third parties |
The results of a vulnerability analysis often serve as the starting point for a penetration test. The external attack surface can be continuously monitored using Attack Surface Management.
Almost every company has interfaces to the internet: a website, an online shop, VPN access for employees, or email services. Vulnerabilities can exist at any of these points. This applies to corporations as well as medium-sized businesses.
