External Discovery Audit
Not sure where to start? Start by seeing what an attacker sees of you. In one day, I build an inventory of what you expose on the Internet, test the riskiest entry points and tell you, with figures, which audit to run next.
What I do during the day
- Inventory of exposed assets
- Domains, subdomains, IP addresses, services and technologies visible from the Internet, including the ones you forgot.
- Information leaks
- Employee credentials found in public breaches (masked in the report), exposed documents or code repositories.
- DNS and email hygiene
- Stale DNS records, protection against email spoofing (SPF, DKIM, DMARC).
- Priority entry points
- Admin portals, remote access, outdated software, default settings, transport encryption.
What you get
- A short, readable report: asset inventory, vulnerabilities rated by severity, and the 5 actions to take first.
- A “where to go next” roadmap: which audits to run, in what order, with duration and price estimates.
- A 30-minute video debrief.
How it works
- You order through the form or during a 15-minute call.
- You sign a test authorisation stating scope and dates.
- I run the testing day and notify you at the start and end.
- You receive the report within 3 business days, then we go through it together.
What the offer does not cover
- Beyond 2 main domains or about 30 exposed services, I will suggest a full external audit.
- No authenticated testing, no in-depth exploitation: it is a first look, not a full pentest.
- No test likely to disrupt your services (no denial of service).
Discovery or full external audit?
| Discovery | Full external audit | |
|---|---|---|
| Goal | A first view of your exposure | In-depth assessment of every entry point |
| Duration | 1 day | 1 to 4 days depending on scope |
| Price | €500 excl. VAT | on quote |
| Testing | Focused on obvious risks | In-depth, with controlled exploitation |
| Retest | Optional | Included |
Frequently asked questions
Do I need to give you access?
No. Your main domain name and a signed test authorisation are enough. I work like an outside attacker, with no account or internal information.
Who is it for?
Companies that never had an audit, that just went through a migration or provider change, or that need to show a first security step to a customer.
Is it risky for my website?
Tests in this offer are chosen not to disrupt your services: no denial of service, no destructive exploitation. I notify you at the start and end of the day.
What if you find a critical issue?
I call you immediately, without waiting for the report, so you can fix it as soon as possible.