Frequently asked questions
Is this a penetration test?
No. A penetration test targets a defined system to find as many exploitable issues as possible within it. An External Attack Surface Check starts from the outside with little or no prior knowledge of your environment — the same starting point an attacker has — and focuses on discovering what's exposed, understanding what it means, and validating the exposures that matter most. Many clients use both: an Attack Surface Check to map and validate what's reachable, and a pentest to go deep on a specific application.
Is this an automated scan?
No. Automated tools are used for discovery — they're good at finding candidates quickly and at scale. But every observation that could become a reported finding is manually reviewed and validated by an experienced offensive-security professional before it reaches you. We report validated findings, not raw scanner output.
Do you need access to our internal network or systems?
No. This is an outside-in assessment. We don't require VPN access, credentials, agents, or internal network access. We work from what's visible and reachable from the public internet — the same starting position an external attacker has.
Will you test destructively or cause downtime?
No destructive testing is performed. Validation techniques are chosen to confirm a weakness safely without degrading availability or integrity. Anything higher-risk is explicitly scoped, discussed, and agreed with you in advance as part of the Rules of Engagement.
What happens if you find something critical during the assessment?
Critical findings with immediate business risk are escalated to you as soon as they're confirmed — we don't wait for the final report to tell you about something urgent.
What if nothing critical is found?
That's a genuinely useful outcome, and we report it as such. You receive full visibility into every attack hypothesis we tested and the evidence for why each one didn't hold up — validated assurance that your external defenses are working, not just an absence of news.
How long does an assessment take?
Typically two to four weeks from authorization to report, depending on the size of your footprint and agreed scope. Discovery and analysis run in the background; validation and any attack-path investigation take the most time.
How much does it cost?
It depends on your organizational footprint, number of assets, and required depth — see the full breakdown on the pricing page. Focused engagements typically start from €3,950.
Do you offer ongoing or continuous monitoring?
The core service is a scoped, point-in-time assessment. If you need continuous external monitoring, we can discuss a periodic assessment cadence during scoping — talk to us about what fits your organization.
Do you work with organizations outside your home country?
Yes. Assessments are delivered remotely worldwide. Scope, authorization, and Rules of Engagement are agreed in writing regardless of location.
We're an MSP/MSSP — can we resell or subcontract this?
Yes — see the partners page for the available models.