Method
Inside an EXTERNAL10 penetration test.
We attack your internet-facing estate the way a real adversary would — starting from nothing but your domain name — then prove what matters safely and hand you findings you can act on. This is how the engagement runs, end to end.
Evidence-first
Reproducible proof, not scanner noise
Independently reviewed
A second tester confirms every finding
You stay in control
Every high-impact step needs your approval
One disciplined engagement, from scope to report.
Not a scan and a PDF. A human-led assessment with a defined method: map, plan, test, prove, review, report.
- 01
Scope & authorization
Your work-email domain is the starting point. We map what your organisation owns and set out the exact domains and hosts in the engagement letter. Nothing is touched until an authorized signatory confirms it, and anything we discover later stays out of scope until you add it.
- 02
Reconnaissance & attack-surface mapping
We start passively — DNS and certificate records, subdomains, mail configuration, exposed services, forgotten dev and staging systems, admin panels, and CDN or cloud origins — then reconcile everything into one inventory of what you actually expose to the internet.
- 03
Coverage plan
Every applicable area of the attack surface becomes a tracked lane on a coverage matrix — around thirty of them, from DNS and email security to authentication, access control, APIs and business logic. Each lane ends with a result, so gaps are disclosed, never silently skipped.
- 04
Hypothesis-driven testing
We turn observations into specific, testable questions — "does the server trust this value?", "is this record reachable by another account?" — and test the least-invasive explanation first. A version number or a missing header is a lead, not a finding.
- 05
Safe impact validation
When we find something, we prove the consequence with the smallest possible action, using our own synthetic test accounts and data. We stop the moment real customer data, an administrator function, payment or an irreversible action comes into reach, and come back to you for approval.
- 06
Independent review
Every candidate finding is handed to a second, independent reviewer who tries to break it — checking the evidence, alternative explanations, reproducibility and severity. Only what survives that review reaches your report. Unproven leads are recorded, not dressed up as findings.
- 07
Written report
You receive an executive summary for management and a technical report for engineers: every finding with severity, evidence and reproduction steps, a prioritised fix list, and the attack narrative of how far we got.
- 08
Cleanup & handoff
We remove the test accounts and artifacts the engagement created and tell you anything left for you to clear. You keep the full report and the prioritised remediation list to drive the fixes.
The whole surface an attacker sees.
We tailor depth to what you run, but every relevant area below is on the coverage matrix with a tracked result — including the ones we could not reach, stated plainly.
External attack surface
Everything reachable from your domain — related domains, forgotten subdomains, hosts and services — confirmed as yours before we touch it.
DNS & domain security
Delegation, DNSSEC, CAA and record hygiene, and subdomain-takeover risk from dangling or deprovisioned records.
Email security
SPF, DKIM, DMARC and mail-transport protection — can someone send mail as your domain and phish your customers?
Transport & edge
Certificates, TLS protocols and ciphers, HTTP-to-HTTPS handling, and proxy, cache, routing and origin-exposure issues.
Web applications
Authentication, sessions, access control between accounts (IDOR), input handling, file uploads and business-logic abuse.
Authentication & accounts
Login, MFA, recovery and user-enumeration, plus controlled checks for default and commonly-used passwords — rate-limited so nobody is locked out.
APIs
Exposed schemas, mass assignment, missing rate limits, webhooks and GraphQL surface.
Admin & operational surface
Admin panels and dashboards, debug, health and metrics endpoints, dev and staging systems, CDN/WAF origins, and source-control or CI leaks.
Secrets & information exposure
Source maps, build artifacts, backups, verbose errors and exposed cloud metadata.
Mobile apps
When you publish one: static analysis of the app and the back-end surface it exposes — secrets, weak transport, insecure configuration.
A real attack, run under control.
The point of a test is to find what an attacker could do — without the damage an attacker would cause. Four rules keep it that way.
- 01
Authorized, from the outside only
We work only from the internet, with no credentials from you and nothing beyond what is publicly reachable. Testing begins only after an authorized signatory confirms the engagement letter.
- 02
Safe by default
Ordinary discovery and browsing carry no special risk. Anything that writes, authenticates, or could disrupt a system is a separate, higher-risk step we only take with your explicit written go-ahead — spelling out the exact target, limits and stop conditions.
- 03
Synthetic data only
Where a test needs an account, we self-register our own and use clearly synthetic details. We never use, retain or expose real customer data, and we log every test identity so it can be cleaned up.
- 04
We stop and ask
If a test reaches real user data, an administrator capability, another tenant, a payment or anything irreversible, we stop at the minimum proof and return to you before going further.
Never, without separate written approval
- Denial-of-service or anything that degrades availability
- Phishing or social engineering of your staff
- Physical access and on-site testing
- Testing with credentials you supply — we never receive your passwords
- Third-party SaaS you do not operate yourself
What a scanner walks straight past.
An anonymised example from a recent engagement — the kind of business-logic flaw that only a human, testing the actual workflow, will find.
Nordic building-systems group · webshop
The shop listed a product at SEK 1,870.00. By changing a value the browser was trusted to send, the cart total came back as SEK 1.25 — the server never re-checked the price it was given.
Every automated scan reported a healthy, well-patched store. The flaw lived in the checkout logic, not in any version number. We proved it in a controlled cart and stopped before any order, payment or fulfillment — exactly the boundary our method draws. It reached the report as a reviewed, reproducible high-severity finding.
Findings your team can act on the same day.
One fixed price, 1 000 EUR excl. VAT. A written report within 10 business days, including prioritised remediation guidance.
The penetration test report
- Executive summary for management
- Every finding with severity (CVSS), evidence and reproduction steps
- Prioritised remediation list
- Attack narrative: how far we got and how
Every finding is backed by traceable evidence and independently reviewed before you see it. We state plainly what we could not reach, so a clean result means what it says.
Before we start.
The practical questions your security team tends to ask. The exact source IP(s) and testing dates for your engagement are confirmed in the engagement letter.
- How aggressive is the testing?
- Low-impact by default. We work at a controlled, rate-limited pace so nothing is knocked offline and no accounts are locked out, and we never run denial-of-service. Anything that could change data or disrupt a system is a separate step we take only with your written approval, stopping at the minimum proof. Active testing runs over about 2 business days.
- Which IP addresses does the testing come from?
- Our traffic originates from Mullvad VPN exit nodes in a region we agree with you (for Nordic clients, typically Sweden). We share the active exit IP(s) on request so you can allowlist and monitor them; note they may rotate during the test window, so treat the region — not a single fixed address — as the constant.
- When will testing happen?
- Testing may begin immediately after you sign the authorization. Active testing runs for about 2 business days inside the authorized 30-day window, and we prepare the full report regardless of purchase. Payment only unlocks its delivery.
Start with your work email.
Its domain is where we begin. No commitment and no payment now — we review the request and send an engagement letter with exactly what we will test.