External Network Penetration Testing: Scope and Cost

Everything below assumes you are buying one, not performing one. The sections are ordered the way a purchase actually runs: what is in scope, how it differs from an internal test, what the tester does, what it finds, which framework is forcing your hand, what it costs, and how to tell a real engagement from a scan with a cover page.

What an external network penetration test covers

"External" means reachable from the public internet by someone with no account and no foothold. That sounds obvious until you try to write it down, because most organisations do not have an accurate list of what they expose. The perimeter is wider than the asset register in almost every engagement.

Six layers make up a realistic external scope:

• Address space. Owned IP ranges, cloud elastic addresses, and whatever is still pointed at a decommissioned provider.
• Edge appliances. Firewalls, VPN concentrators, SSL gateways, load balancers. The devices that cannot be patched during business hours and therefore often are not.
• Remote access. VPN portals, RDP gateways, jump hosts, anything answering on a management port.
• Published services. Mail, DNS, FTP, SSH, database ports that were opened for a migration and never closed.
• Authentication surfaces. Login portals, SSO endpoints, API gateways, webmail. Tested for authentication weakness rather than application logic.
• Forgotten hosts. Staging environments on public IPs, abandoned subdomains pointing at live infrastructure, a server a departed engineer stood up.

External vs internal: which one do you need?

The two answer different questions. External asks whether someone on the internet can get in. Internal asks how far they get once inside. Buying one and calling it the other is the most common scoping error in this category.

The methodology, step by step

Vendors describe this differently, but a competent external engagement runs these six phases in this order. Ask any prospective supplier to walk you through theirs and compare.

Phases 2 and 3 are the ones to interrogate. A supplier who tests only the list you hand over will never find the host you forgot, which is precisely the host an attacker will use. If a vendor's methodology begins with "client provides in scope assets" and ends there, they are testing your paperwork.

What it finds that a vulnerability scanner does not

A scanner is excellent at the first half of phase 4 and incapable of phase 5. The distinction matters because several frameworks accept a scan for one requirement and demand a test for another.

Which frameworks require external network testing

This is usually the reason the budget exists, and the frameworks are more specific than people expect. Two of them distinguish explicitly between scanning and testing, which is why buying a scan to satisfy a pentest requirement fails audit.

What it costs, and how to compare quotes

Almost nobody publishes a list price for network testing, and that is not evasion. The work is sold in tester days, and the number of days is set by what discovery finds rather than by your headcount or revenue. A thirty person company with four hundred live hosts costs more to test than a four hundred person company with twelve.

So the honest model is tester days multiplied by day rate, and the useful question is what moves the day count.

Three quotes for "an external network penetration test" can differ several fold and all be honest, because they are quoting different work. Make them comparable by asking each supplier the same five questions in writing:

• How many tester days, and what is the day rate? A single total hides everything.
• Do you perform independent discovery, or test only our supplied list?
• Is manual validation included for every finding, or is some output tool generated?
• Is one retest of the original attack path included in this price?
• Who writes the report, and will the tester join a remediation call?

Any supplier who will not answer those in writing has answered them.

How to spot a port scan sold as a penetration test

The external network test is the easiest assessment in the industry to fake, because a scanner produces a plausible looking report in an afternoon. Six signals, each checkable before you sign:

• The proposal has no day count. Real effort is measured in days. A fixed price with no stated effort is a product, and the product is usually a scan.
• Discovery is not in the methodology. If the first phase is "client provides in scope IP addresses", nothing will be found that you did not already know about.
• No named tester or certification. You are entitled to know who is doing the work and what they hold.
• Findings arrive with CVSS scores and no reproduction steps. Scanner output has scores. Test output has evidence, a request, a response, a screenshot.
• Every finding is a version number. A report consisting entirely of "upgrade to version X" with no configuration, authentication or chained findings is a scan with a cover page.
• Retesting is not offered. A supplier confident in their findings will verify the fix. One that is not will sell you a new engagement.

The single best check costs nothing: ask to see a redacted sample report before signing. Whether a firm has one ready tells you most of what you need to know, and reading it tells you the rest.

What the report should contain

The report is the deliverable you will still be using in nine months, when an auditor or a customer asks for it. Six things make it usable:

An executive summary that states the perimeter's condition in plain language, suitable for someone who will not read further. The discovery delta, listing assets found that were not on your register, which is frequently the most actionable page in the document. Findings with reproduction steps and evidence, so an engineer can confirm the issue without contacting the tester. A severity rating with stated methodology, so you can convert it to your internal scale and defend the conversion to an auditor. Remediation guidance specific to your configuration, not a vendor documentation link. And an attestation page or summary letter you can share with a customer without releasing the full technical report.

That last one matters more than it looks. Most buyers eventually need to prove testing happened to someone they will not send a full report to, and the usual fallback is an informal letter. Ask what your supplier provides before you need it.

Questions buyers ask

What is an external network penetration test? An authorised assessment of everything your organisation exposes to the public internet, performed without credentials or internal access. The tester discovers your perimeter independently, maps exposed services, then manually validates and safely exploits findings to prove real impact. It stops at the point of entry; what happens deeper inside is an internal test.

What is the difference between external infrastructure and external network penetration testing? Nothing meaningful. Different suppliers use different words for the same engagement. "Infrastructure" sometimes signals that cloud hosted assets are explicitly included, so confirm the asset list rather than relying on the label.

How long does an external network penetration test take? Commonly three to five tester days for a modest perimeter, with reporting after. Elapsed time is usually two to three weeks including scheduling and the report. The day count scales with live hosts and exposed services, not with company size.

How often should we run one? Annually as a floor, and after any significant perimeter change: a new edge appliance, a cloud migration, a merger, or newly exposed remote access. PCI DSS requires annually and after significant change. Most frameworks leave the interval to your own risk policy, which means you have to justify whatever you choose.

Is an external penetration test the same as a vulnerability scan? No, and several frameworks require both separately. A scan identifies known issues on hosts you declare. A test discovers hosts you did not declare, confirms findings by hand, proves exploitability, and chains low findings into high ones. PCI DSS asks for quarterly ASV scanning under 11.3.2 and external penetration testing under 11.4.3 as distinct obligations.

Do we need to tell our hosting provider or SOC? Your hosting or cloud provider may require notification; check their testing policy during scoping. Telling your own SOC is a judgement call. Warning them makes the test smoother and less realistic. If you want to know whether detection works, that is a purple team exercise, and it should be bought as one.

Can an external test cover our web application too? Partly, and this is the most common scoping disappointment. An external network test finds your login portal and tests it at the authentication layer. Business logic, authorisation and injection flaws behind a valid login need a web application test. Buy both if the application is the thing you are actually worried about.

Where to start

If you have never had the perimeter tested, buy the external network test before anything else. It is the cheapest assessment in the category, needs no deployment, and covers the exact path an unauthenticated attacker takes. Pay for independent discovery on the first engagement even though it costs more days, because the reconciliation output is usually worth more than the findings.

Then fix what comes back, retest it, and only after the perimeter holds should you spend money asking how far a breach would spread inside.