External Network Penetration Testing
Attack-surface discovery and exploitation across everything you expose to the internet: perimeter services, remote access, cloud-hosted assets, and the forgotten hosts that never made it onto the inventory.
Service 14
AI does the sweep. A human does the proving.
Most of an external test's hours go to finding and sorting what you expose: hosts, services, logins, forgotten subdomains. Agentic tooling covers that ground in a fraction of the time, so you get a credible, human-validated answer about your perimeter in days instead of weeks.
Overview
The problem we are solving
This is a packaged engagement, not an add-on. Scope is bounded to what you expose to the internet, the quote is fixed before testing starts, and the delivery date is agreed up front. It is built for teams that need a fast, defensible external test: an annual requirement, a customer security questionnaire, a new environment going live, or a check between full-scope engagements.
AI agents handle discovery and enumeration across your agreed scope: mapping live hosts and services, ranking what they find by how an attacker would actually use it, testing exposed logins for weak or reused credentials within lockout-safe limits, and pursuing exploitation where a real path exists. A consultant then reproduces every candidate finding by hand. If it cannot be reproduced, it does not make the report.
The agents run through the same isolated infrastructure as all of our AI-assisted testing: an isolated Amazon Bedrock deployment inside our own dedicated AWS environment, or a private model on bare metal we operate in-house. Your scan data and findings are never sent to a shared consumer AI product and never used to train anything.
We are explicit about what this is not. It is not a scanner subscription, a red team, or a substitute for testing your internal network. For a fast, fixed-scope look inside the perimeter, see the five-day Rapid Assessment; for chained attack paths, Active Directory, and cloud identity, see our full external and internal penetration tests.
Coverage
What is in scope
Scope is agreed up front; these are the areas an engagement typically covers.
- External network perimeter
- Internet-facing hosts and services across your agreed IP ranges and domains, including the forgotten ones that never made the asset inventory.
- Exposed authentication
- VPNs, remote access portals, identity provider logins, and admin interfaces, tested for weak, default, and reused credentials at thresholds agreed in advance so nobody gets locked out.
- Public web applications
- Unauthenticated testing of your public-facing web applications for the exploitable flaws an attacker on the internet would reach first.
- APIs & exposed endpoints
- Discoverable APIs, management endpoints, and services that were never meant to be public, checked for exposure and exploitability.
- Not in scope
- Internal networks, Active Directory, cloud configuration and identity, authenticated application testing, chained multi-stage attack paths, social engineering, wireless, and red team work. These go to our human-led services.
Methodology
How the engagement runs
-
01
Scoping & fixed quote
Agree IP ranges, domains, credential-testing thresholds, any objectives you want pursued, and the delivery date. You receive a fixed quote, statement of work, and rules of engagement before anything starts.
-
02
Agentic sweep
AI agents enumerate and test your agreed scope. Scope is enforced in the tooling itself, and anything potentially disruptive waits for a consultant's approval before it runs.
-
03
Human validation
A consultant reproduces every candidate finding by hand and discards anything that does not hold up. Exploitation that lands in your report was confirmed by a person.
-
04
Reporting
Findings are written up by the consultant who validated them, ranked by real exploitability and business impact. A critical finding is flagged the day it is confirmed, not held for the report.
-
05
Debrief & validation handoff
A live walkthrough of the results, plus validation steps for every finding so your team can confirm each fix on its own. Retesting by InFocus is available as an additional option.
Deliverables
What you receive
- Technical report with ranked findings, evidence, reproduction steps, and remediation guidance
- Executive summary written for non-technical approvers
- Attestation letter for customers, partners, or auditors
- A plain statement of which infrastructure handled AI assistance on your engagement
- Validation steps for every finding, so your team can confirm and close out each fix on its own
- Live debrief with engineering and leadership
Aligned to
- PTES (Penetration Testing Execution Standard)
- OWASP Web Security Testing Guide
- MITRE ATT&CK (initial access)
- Anthropic usage policies for authorized security testing
Questions
Frequently asked
How is this different from your AI-Assisted Penetration Testing page?
AI-Assisted Penetration Testing describes how we use AI to speed up any engagement. This is a specific packaged product built on that approach: external scope only, fixed quote, fixed delivery date.
Is a person actually testing, or is this an automated scan?
Both, on purpose. AI agents do the broad sweep a scanner cannot (prioritizing, chaining, and pursuing real exploitation paths), and a consultant reproduces every finding by hand before it is reported. Nothing goes in the report on the model's word alone.
Could this take down our systems or lock out our users?
Testing is designed not to. There is no denial-of-service testing and no exploits known to cause damage, credential testing stays inside lockout thresholds you agree to, and potentially disruptive actions need a consultant's approval. You also have a named contact who can halt testing at any time.
Will this satisfy our compliance requirement?
Often, for the external portion. Frameworks such as PCI DSS, SOC 2, and HIPAA commonly expect external testing, and the attestation letter is written for auditors and customers. Many also require internal testing, which this does not cover. Tell us the requirement during scoping and we will confirm whether this fits.
Where does our data go?
Either an isolated Amazon Bedrock deployment inside our own dedicated AWS environment, or a private model on bare metal we operate in-house. It is never sent to a shared consumer AI product, never used for training, and kept only for the engagement.
Are you allowed to use AI models for offensive testing?
Yes. InFocus is Daybreak and Anthropic Offensive Trust approved: explicitly recognized to use frontier models for authorized offensive security testing under the vendor's own usage terms.
Related
Often scoped together
AI-Assisted Penetration Testing
Agentic AI accelerates reconnaissance, enumeration, and evidence correlation across an engagement, run through isolated infrastructure: Amazon Bedrock in a dedicated environment, or a private model on in-house bare metal when nothing can leave the building.
Get started
Ready to scope rapid external pentest?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 sales@infocus-security.com