TITANIUM COMPUTING
(512) 623-9199
Free consultation
SERVICES · CYBERSECURITY · EXTERNAL PEN TESTING
External Penetration Testing
External penetration testing is an authorized test of your business from the outside, the way an internet attacker would see it. We map what you have exposed, find the weaknesses, and prove which ones matter. Testing starts only after you sign a written authorization and we countersign it, and it stays inside that scope and time window.
What Does an External Pen Test Cover?
Everything an outsider can reach over the public internet, and nothing you have not put in writing.
Attack Surface Discovery
We start from your domains and address ranges and find what is actually exposed: subdomains, hosts, certificates, cloud assets and forgotten systems.
Enumeration
For each in-scope asset we identify live services, software versions, web applications, APIs and encryption settings, so nothing is assumed.
Vulnerability Identification
Known vulnerabilities, misconfigurations, exposed secrets and takeover-prone records, each tied to the asset it affects and ranked by real risk.
Validated Exploitation
Only when you separately authorize it, we confirm a finding is real with a minimal, reversible proof. No persistence, no data taken beyond that proof.
How Does an Engagement Run?
Paperwork first, testing second. Five steps, each one recorded.
What Separates a Pen Test From an Attack?
Permission, limits and a record. A penetration test uses the same view an attacker has, but it is done with the owner's written consent, inside agreed limits, by people who stop when the agreement says stop. That is what makes it lawful, and it is what makes the results trustworthy.
We do not rely on good intentions for those limits. The signed scope is loaded into our testing systems, and they refuse any target outside it or any action after the window closes. Every action is logged with who ran it, against what, and when, so the record matches the report.
The Rules We Test By
These apply to every engagement. They are not optional extras.
Written authorization first
The asset owner signs the rules of engagement and Titanium countersigns them before any testing starts. A verbal yes is not enough.
Scope enforced in code
Our testing systems check every action against the signed scope and refuse anything outside it. When in doubt, they block.
A fixed time window
Testing runs only between the signed start and end times. At the end of the window it stops on its own.
No denial of service
We do not try to overload or take down your systems. Request rates are capped in the agreement to protect fragile services.
Exploitation only when separately authorized
Proving a weakness is its own approval, by type of test. Proofs are minimal and reversible. No persistence and no data taken beyond the proof.
No third-party systems
If an in-scope host sits on shared hosting or a content network, we flag it rather than risk touching someone else's systems.
You can stop it at any time
Your named contacts can halt the engagement with one call to (512) 623-9199. Testing stops and stays stopped until you say otherwise.
Confidential findings, destroyed on schedule
Findings and evidence go only to your named contacts. We keep them for the retention period in your agreement, then destroy them.
What Is Not Part of This Service?
An external pen test is the outside-in view. Some kinds of testing need different authorization or a different service, and we say so up front.
Testing your own code and applications from the inside is the job of Keelpin, our continuous application security monitoring. Day-to-day defense is part of our cybersecurity services.
Common Pen Testing Questions
What is an external penetration test?+
An authorized test of your internet-facing systems from the outside, with no inside access. We find what is exposed, identify weaknesses, and, if you authorize it, prove which ones an attacker could use. You get a report with evidence and fixes.
Who can authorize a test?+
Only someone who owns the systems or has legal authority over them. We confirm that during scoping. If your systems run with a hosting or cloud provider that requires notice before testing, we capture that in the agreement. We do not test systems on behalf of anyone other than their owner.
Will testing take our website or systems down?+
It is not designed to. Denial of service is never part of the test, request rates are capped in the agreement, and any proof of a weakness is minimal and reversible. You can also set allowed hours and stop testing at any time with one call.
How is this different from a vulnerability scan?+
A scan lists possible problems on systems you already know about. A pen test first discovers what you actually have exposed, then confirms which problems are real, with evidence attached. That cuts out the false alarms and shows the forgotten systems a scan never sees.
How is it different from Keelpin?+
Keelpin tests your own applications and code from the inside, on every change. An external pen test looks at your whole business from the outside, with no prior access, the way an attacker would. Many clients use both, and the findings use the same format.
What happens to our findings after the test?+
They are confidential. The report goes only to the contacts named in your agreement. Evidence is kept for the retention period you agree to, so we can support remediation and a retest, and is then destroyed.
How is an external pen test priced?+
It is quoted per engagement after the scoping call, based on how many assets are in scope and whether validated exploitation is included. You get a fixed quote before you sign anything. Call (512) 623-9199 to start.
Scope an External Pen Test
One scoping call, no obligation. Fixed quote and written rules of engagement before any testing.