External security audit
Before attacking, an attacker looks at what you expose on the Internet. Companies often do not have the full list themselves: an old test site, a remote access service, a forgotten subdomain. I build that inventory, then check how solid each entry point is.
What I assess
- Inventory
- Domains, subdomains, IP addresses and services actually exposed.
- Remote access
- VPN, remote desktop, administration portals.
- Email configuration and user authentication.
- Exposed services
- Outdated versions, default settings, interfaces that should not be public.
- Information leaks
- Credentials or internal documents already published or leaked.
How I work
- Black-box approach: I start from your domain name only, like an attacker.
- Scope validated with you before any active testing, so only your assets are targeted.
- The report separates the inventory (what you expose) from vulnerabilities (what is exploitable).
Full methodology and deliverable
What you get
- A PDF report: executive summary, then one entry per vulnerability (proof, CVSS score, impact, fix).
- A debrief meeting with your technical team.
- A retest of your fixes, offered in the quote.
Frequently asked questions
Is it useful if everything is in the cloud?
Yes. The cloud often adds exposed services nobody has listed. An external audit finds them, and can be paired with a cloud audit for the tenant’s internal configuration.
External or internal first?
On a small budget, an external audit gives the fastest view of your exposure. If you run Active Directory, an internal audit measures what happens once an attacker is in, which is the ransomware scenario.
Do I need to notify my hosting provider?
Some providers require it. I tell you what to do during scoping, and tests run from IP addresses I share with you.
Planning a security audit?
Estimate your audit online in 2 minutes, or book a call. You leave with a duration and price range, no strings attached.
Get a quote