External penetration testing is one of the most commonly purchased security services and one of the most commonly misunderstood. Organisations buy it because a customer asked for it, or because their cyber insurance renewal required it, and then receive a report they are not sure how to use. This article explains what the test actually covers, how a competent tester approaches it, and what you should expect to receive at the end.
What is in scope for an external penetration test ¶
An external penetration test covers assets that are reachable from the public internet without any prior authentication or network access. This typically includes web applications, APIs, VPN and remote access endpoints, mail servers, and any other services your organisation exposes publicly. The scope is agreed before testing begins, usually through a scoping questionnaire that asks you to list IP ranges, domain names, and any assets you want excluded. Exclusions are common for third-party hosted services where you do not have permission to test.
How a manual tester approaches the work ¶
A competent external penetration test is not a vulnerability scan with a report attached. Automated scanners are useful for identifying known CVEs and misconfigured headers, but they miss business logic flaws, authentication bypasses that require understanding the application flow, and chained vulnerabilities where no single finding is critical but the combination is. A manual tester will use automated tooling to map the attack surface and then spend the majority of their time on manual analysis of the interesting areas the scanner surfaces.
What the report should contain ¶
A good penetration test report contains an executive summary written for non-technical readers, a technical findings section with one entry per finding, and a remediation section that tells the person responsible for fixing the issue exactly what to do. Each finding should include a severity rating, evidence (screenshots or request/response pairs), and a clear explanation of what an attacker could do with it. Reports that contain only CVSS scores and CVE references without context are not useful to most development teams.
What to do with the findings ¶
The most important step after receiving a report is a remediation call with the tester. This is where the findings get prioritised based on your specific environment and your team's capacity. Critical and high findings should be addressed within 30 days in most cases. Medium findings within 90 days. Low findings can be tracked in your risk register and addressed in the normal development cycle. Once critical and high findings are patched, a retest of those specific vectors confirms the fix is effective.
How often should you test ¶
Annual testing is the minimum for most organisations. Organisations that deploy code frequently, operate in regulated sectors, or handle sensitive personal data should consider testing after significant infrastructure changes and after major product releases, in addition to an annual baseline test. The cost of a penetration test is small relative to the cost of a breach, but the value of the test depends entirely on acting on the findings.
If you have questions about scoping an external penetration test for your organisation, the fastest way to get a straight answer is a 30-minute scoping call. No commitment required.