@meta
  v: 1
  route: /external-pen-testing/
  generated: 2026-11-11T18:22:46Z
  ttl: 1d

@intent
  purpose:    Authorized external penetration testing in Austin: attack surface discovery and validated findings, only inside a signed scope. (512) 623-9199.
  audience:   visitor, prospective-client, ai-agent
  capability: learn, compare, contact, call

@state
  business: Titanium Computing
  page: External Penetration Testing
  phone: +1-512-623-9199
  address:
    street: "2013 Wells Branch Pkwy, Suite 310"
    city: Austin
    region: TX
    postal: 78728
  hours: "Office Mon-Fri 9:00-17:00 Central; monitoring and critical response 24/7"
  parent_service: /cybersecurity/
  vantage: "outside-in, public internet only, no prior access"
  phases[4]: Attack surface discovery, Enumeration, Vulnerability identification, Validated exploitation (separately authorized)
  authorization: written rules of engagement signed by the asset owner and countersigned by Titanium before any testing
  scope_control: signed scope and time window enforced in code; out-of-scope assets are never touched
  never_included[5]: denial of service, phishing or social engineering, persistence, data taken beyond a minimal proof, third-party infrastructure
  deliverables[3]: executive summary, technical findings with reproducible evidence and remediation, testing timeline tied to the authorization
  data_handling: findings confidential to named contacts; destroyed after the agreed retention period
  pricing: quoted per engagement after a scoping call
  related_product: /keelpin/
  key_stats[3]{value,metric}:
    2,Signatures before any testing starts
    In scope,"Only the assets you list, only in the window"
    No DoS,We never try to knock you offline
  whats_included[6]:
    - A map of your internet-facing attack surface
    - "Findings ranked by risk, each with reproducible evidence"
    - Clear remediation steps your team or ours can act on
    - "An executive summary written for owners, not engineers"
    - A testing timeline tied to your signed authorization
    - "A retest of fixed findings, under a new signed window"
  page_sections[7]:
    - What Does an External Pen Test Cover?
    - How Does an Engagement Run?
    - What Separates a Pen Test From an Attack?
    - The Rules We Test By
    - What Is Not Part of This Service?
    - Common Pen Testing Questions
    - Scope an External Pen Test
  section_summaries[7]{section,summary}:
    What Does an External Pen Test Cover?,"Everything an outsider can reach over the public internet, and nothing you have not put in writing."
    How Does an Engagement Run?,"Paperwork first, testing second. Five steps, each one recorded."
    What Separates a Pen Test From an Attack?,"Permission, limits and a record. A penetration test uses the same view an attacker has, but it is done with the owner's written consent, inside agreed limits, by people who stop when the agreement says stop. That is what makes it lawful, and it is what makes the results trustworthy."
    The Rules We Test By,These apply to every engagement. They are not optional extras.
    What Is Not Part of This Service?,"An external pen test is the outside-in view. Some kinds of testing need different authorization or a different service, and we say so up front."
    Common Pen Testing Questions,"An authorized test of your internet-facing systems from the outside, with no inside access. We find what is exposed, identify weaknesses, and, if you authorize it, prove which ones an attacker could use. You get a report with evidence and fixes."
    Scope an External Pen Test,"One scoping call, no obligation. Fixed quote and written rules of engagement before any testing."
  what_does_an_external_pen_test_cover[4]{title,detail}:
    Attack Surface Discovery,"We start from your domains and address ranges and find what is actually exposed: subdomains, hosts, certificates, cloud assets and forgotten systems."
    Enumeration,"For each in-scope asset we identify live services, software versions, web applications, APIs and encryption settings, so nothing is assumed."
    Vulnerability Identification,"Known vulnerabilities, misconfigurations, exposed secrets and takeover-prone records, each tied to the asset it affects and ranked by real risk."
    Validated Exploitation,"Only when you separately authorize it, we confirm a finding is real with a minimal, reversible proof. No persistence, no data taken beyond that proof."
  how_does_an_engagement_run_steps[5]{step,title,detail}:
    01,Scoping call,~
    02,Signed rules of engagement,~
    03,"Discover, enumerate and identify",~
    04,"Validate, only if authorized",~
    05,Report and readout,~
  the_rules_we_test_by[8]{title,detail}:
    Written authorization first,The asset owner signs the rules of engagement and Titanium countersigns them before any testing starts. A verbal yes is not enough.
    Scope enforced in code,"Our testing systems check every action against the signed scope and refuse anything outside it. When in doubt, they block."
    A fixed time window,Testing runs only between the signed start and end times. At the end of the window it stops on its own.
    No denial of service,We do not try to overload or take down your systems. Request rates are capped in the agreement to protect fragile services.
    Exploitation only when separately authorized,"Proving a weakness is its own approval, by type of test. Proofs are minimal and reversible. No persistence and no data taken beyond the proof."
    No third-party systems,"If an in-scope host sits on shared hosting or a content network, we flag it rather than risk touching someone else's systems."
    You can stop it at any time,Your named contacts can halt the engagement with one call to (512) 623-9199. Testing stops and stays stopped until you say otherwise.
    "Confidential findings, destroyed on schedule","Findings and evidence go only to your named contacts. We keep them for the retention period in your agreement, then destroy them."
  what_is_not_part_of_this_service_drawbacks[6]:
    - Anything not listed in the signed scope
    - Denial of service or stress testing
    - Phishing or social engineering of your staff
    - Persistent access or data taken beyond a minimal proof
    - Pivoting into shared or third-party infrastructure
    - Any testing before both signatures or after the window closes
  faqs[7]{question,answer}:
    What is an external penetration test?,"An authorized test of your internet-facing systems from the outside, with no inside access. We find what is exposed, identify weaknesses, and, if you authorize it, prove which ones an attacker could use. You get a report with evidence and fixes."
    Who can authorize a test?,"Only someone who owns the systems or has legal authority over them. We confirm that during scoping. If your systems run with a hosting or cloud provider that requires notice before testing, we capture that in the agreement. We do not test systems on behalf of anyone other than their owner."
    Will testing take our website or systems down?,"It is not designed to. Denial of service is never part of the test, request rates are capped in the agreement, and any proof of a weakness is minimal and reversible. You can also set allowed hours and stop testing at any time with one call."
    How is this different from a vulnerability scan?,"A scan lists possible problems on systems you already know about. A pen test first discovers what you actually have exposed, then confirms which problems are real, with evidence attached. That cuts out the false alarms and shows the forgotten systems a scan never sees."
    How is it different from Keelpin?,"Keelpin tests your own applications and code from the inside, on every change. An external pen test looks at your whole business from the outside, with no prior access, the way an attacker would. Many clients use both, and the findings use the same format."
    What happens to our findings after the test?,"They are confidential. The report goes only to the contacts named in your agreement. Evidence is kept for the retention period you agree to, so we can support remediation and a retest, and is then destroyed."
    How is an external pen test priced?,"It is quoted per engagement after the scoping call, based on how many assets are in scope and whether validated exploitation is included. You get a fixed quote before you sign anything. Call (512) 623-9199 to start."

@actions
  - id: request_free_consultation
    method: GET
    href: /contact/
    inputs[1]{name,type,required}:
      need,string,false
  - id: call_titanium_computing
    method: GET
    href: tel:+15126239199
  - id: view_pricing
    method: GET
    href: /pricing/
  - id: view_human_page
    method: GET
    href: /external-pen-testing/

@context
  > External penetration testing is an authorized test of your business from the outside, the way an internet attacker would see it. We map what you have exposed, find the weaknesses, and prove which ones matter. Testing starts only after you sign a written authorization and we countersign it, and it stays inside that scope and time window.
  > Authorized external penetration testing in Austin: attack surface discovery and validated findings, only inside a signed scope. (512) 623-9199.
  > Titanium Computing is an engineer-run managed IT, cybersecurity, and compliance provider in Austin, TX, serving Central Texas since 2016. Flat per-user monthly pricing, no setup fees, and a named engineer who knows your network.

@nav
  self: /external-pen-testing.agent
  parents: [/.agent]
  peers: [/managed-it.agent, /cybersecurity.agent, /help-desk.agent, /cloud-virtualization.agent, /data-backup-recovery.agent, /security-awareness-training.agent, /email-spam-protection.agent, /voip.agent, /compliance.agent, /accounting-firms.agent, /vcio.agent, /pricing.agent, /faq.agent, /contact.agent]