External Penetration Testing

External penetration testing answers one question: if someone on the internet targeted your organisation today, what could they get into? Our testers work from outside your network against the IP addresses, domains and services you expose publicly. We find what is reachable, try to exploit it under agreed rules and report only what we have verified, with evidence and a fix for every finding.

It is the perimeter half of our network and infrastructure penetration testing service. To find out what an attacker could do once inside, pair it with internal penetration testing.

What is an external penetration test?

An external penetration test is a time-boxed, authorised attack on your internet-facing attack surface by a qualified tester working from outside your network. External network penetration testing, external infrastructure penetration testing and an “external pentest” are the same service under different names.

A scanner lists possible weaknesses; a tester proves which can be exploited, chains them and shows the business impact. The NCSC’s penetration testing guidance treats a test as assurance that your vulnerability management works, not a replacement for it. So our reports name the process gap behind each finding as well as the technical fix.

What does external penetration testing cover?

Everything reachable from the internet, within the scope you authorise:

Web applications on the perimeter get a check for high-risk flaws; full authenticated testing is web application penetration testing, scoped alongside. Between annual tests, external attack surface management watches for new hosts and services appearing on the internet.

How is an external pentest carried out?

An external pentest moves from scoping and reconnaissance to hands-on exploitation and reporting. We follow a documented methodology based on industry-accepted frameworks such as NIST SP 800-115 and PTES, which is the kind of approach PCI DSS Requirement 11.4.1 asks for.

1. Scoping and authorisation. We confirm IP ranges, domains, hosting providers, the testing window and contacts. You sign the authorisation before testing starts.
2. Reconnaissance. We map your public footprint from DNS, certificate transparency and code repositories, which often turns up hosts missing from your asset list.
3. Discovery and analysis. We scan every in-scope address, fingerprint live services and check weaknesses by hand, removing false positives.
4. Exploitation. Controlled exploitation to prove impact, never denial-of-service. Critical findings are reported straight away.
5. Reporting and debrief. The report, plus a walkthrough call with the tester.
6. Retest. Once you have fixed the findings, we retest them and reissue the report, because PCI DSS 11.4.4 expects testing to be repeated to verify corrections.

The steps above expand the five stages of penetration testing usually quoted: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.

Do you also need an internal penetration test?

Usually, yes. An external test shows whether an attacker on the internet can get in; an internal penetration test shows what they, or an insider, could reach once inside, and PCI DSS Requirement 11.4 covers both. Our comparison of internal vs external penetration testing explains which to prioritise, and our guide to the types of penetration testing covers the rest.

External pen test vs ASV scan: which do you need?

If you take card payments, usually both, because they meet different PCI DSS requirements:

We deliver PCI ASV scanning through a PCI SSC Approved Scanning Vendor partner, so both can run on one schedule.

Which compliance requirements does an external penetration test meet?

If card data is in scope, our PCI DSS penetration testing service covers Requirement 11.4 end to end, including segmentation. Before a Cyber Essentials Plus audit, an external test leaves time to fix what it finds.

How much does an external penetration test cost?

Cost depends mainly on how many live internet-facing hosts and services you expose. Published prices from UK providers we reviewed in September 2026 run from £550 for one to five IP addresses up to £3,500 for 50 or more, and typical UK day rates are quoted at about £1,000 to £1,500. We quote a fixed price once scope is agreed.

Our penetration testing cost guide compares prices across test types.

What do you receive after the test?

• A plain-English executive summary for leadership, auditors and customers
• Technical findings with evidence, CVSS ratings and step-by-step remediation
• An attack-path narrative and a list of the internet-facing assets we discovered
• A debrief call, then a retest of remediated findings and an updated report

A single finding looks like this (illustrative, not client data):

Why choose Sovereign Secure for external penetration testing services?

• A PCI QSA company. The PCI Security Standards Council approves us as a Qualified Security Assessor company, Qualified PIN Assessor and Card Production Security Assessor, and we sit on its Global Executive Assessor Roundtable for 2026 to 2028. We know what an assessor expects as Requirement 11.4 evidence.
• An IASME Cyber Essentials certification body. We issue Cyber Essentials and Cyber Essentials Plus certificates, so we know what the CE+ external scan looks for.
• ISO 27001 certified, so the information security management system that governs how we handle your data and findings is independently audited.
• Trusted by established organisations, with clients including Fiserv, Accor, Ticketmaster, Cashplus and Kuwait Finance House.
• UK headquartered in Accrington, Lancashire, testing remotely wherever your systems are hosted.

Get a fixed quote for your external penetration test

Send us your public IP addresses, domains, hosting providers, preferred testing window and the reason for the test, and we will confirm scope and send a fixed-price proposal. Use the penetration testing quote form or call +44 161 523 5276.