In short
External attack-surface testing looks at your business the way an outsider would: what is reachable from the public internet, and where the soft spots are. It maps the footprint you did not know you had, then ranks what an attacker would try first. Most findings are forgotten systems rather than exotic flaws.
Attackers start with what they can reach without help. Your website, your mail platform, remote-access services, anything else facing the public internet. External attack-surface testing looks at that footprint the way an outsider would, then tells you where the soft spots are.
The uncomfortable part is usually not the vulnerability. It is discovering the system was exposed at all.
The footprint is always bigger than the list
Ask most businesses what they have facing the internet and you get the website and the mail. The real answer tends to include a VPN appliance from a previous provider, a test environment somebody stood up for a project, a legacy subdomain still pointing at a server nobody owns, and a remote-desktop port opened during a busy week in 2021.
None of that appears on an asset register, because none of it was ever added. Testing finds it by looking rather than asking.
How the mapping works
The reconnaissance stage is deliberately the same one an attacker would run:
- Passive collection from DNS records, WHOIS, and certificate transparency logs. Certificate logs are particularly effective, because every TLS certificate ever issued for your domain is published. Internal hostnames leak this way constantly.
- Active discovery, meaning network scanning and port and service enumeration, to establish what is actually listening and what version it is running.
Only then does the assessment start. Mapping first, judgement second, because a finding on a system you did not know existed is worth more than a finding on the one you monitor daily.
What gets flagged, and in what order
Findings are ranked by what an attacker would realistically do next, not by raw severity score. In practice the recurring themes are:
- Services that should not be public at all. Management interfaces, database ports, remote desktop. The fix is usually a firewall rule rather than a patch.
- Unpatched edge devices. VPN concentrators and firewalls are attractive precisely because they sit at the boundary and are awkward to take offline.
- Weak or absent multi-factor authentication on anything that accepts a login from the internet.
- Expired or misissued certificates, and mail records that allow your domain to be spoofed.
A CVSS 9.8 on a system with no route to anything of value matters less than a CVSS 6 on the box that holds your finance data. The report reflects that.
Where it stops
External testing tells you what is reachable and what could be used to get in. It deliberately does not tell you how far an intruder could travel afterwards. That is a separate question, and it is answered by internal testing, which starts from the assumption that someone already has a foothold.
The two are complementary. Running only the external test is a reasonable place to begin, but it leaves the more expensive question unanswered.
How often it needs repeating
Your attack surface changes without anyone deciding to change it. A new marketing microsite, a supplier integration, a firmware update that quietly re-enables a service. Point-in-time testing goes stale.
For most businesses the sensible pattern is a full external test annually, with continuous or quarterly vulnerability scanning in between to catch drift. Scanning finds the known-bad quickly and cheaply. Testing brings judgement to what the scan produces.
The regulatory angle
If you are in scope for NIS2, Article 21 sets ten minimum risk-management measures, and knowing your own exposure underpins several of them. Ireland transposes NIS2 through the National Cyber Security Bill, and the NCSC is the competent authority.
Worth knowing even if you are under the size thresholds: NIS2 reaches smaller firms through the supply chain, because regulated entities have to assess the security of their providers. If you sell to anyone in a covered sector, expect the questionnaire. Being able to answer "we test our external surface annually, here is the report" shortens that conversation considerably.
What we hand over
A report with an executive summary that a non-technical director can act on, a ranked list of findings with evidence, and a remediation plan that separates what to fix this week from what to schedule. Where a finding is ours to fix under a managed agreement, we fix it rather than adding it to your list.
Testing follows recognised methodology. For infrastructure work that means the CREST penetration testing methodology; for anything web-facing, the OWASP Web Security Testing Guide.
To scope an external test for your business, talk to us or read more about penetration testing and vulnerability scanning.