What We Find on External Penetration Tests

An external penetration test starts where most real-world attackers start: the public internet, with no prior access, no credentials, and no insider knowledge of your environment. The goal is to reach a foothold inside your perimeter — or demonstrate the damage that can be done without one. Certain findings appear consistently across external engagements, regardless of organisation size or sector.

Unpatched remote access services

The highest-severity findings on external tests almost always involve internet-facing services running software with known, exploitable vulnerabilities. VPN gateways are the most common category. Vendors including Fortinet, Cisco, Ivanti, and Citrix have each published critical vulnerabilities in recent years that allow unauthenticated remote code execution or credential extraction. These products sit at the edge of the network, process internet traffic, and are often difficult to patch quickly because doing so requires downtime.

The result is that many organisations are running remote access infrastructure with critical vulnerabilities that have been public knowledge for months. Ransomware groups specifically scan for these — the vulnerability gives them authenticated access to an internal network without needing to phish a user or bypass any additional control.

Exposed management interfaces

Firewall management consoles, hypervisor interfaces, network switch administration panels, and storage management UIs are regularly found accessible from the internet. These were never intended to be public-facing, but they end up that way — a temporary change that was never reversed, a misconfigured network rule, or a device that listens on all interfaces by default.

Default credentials on these interfaces are found in a material number of cases. The same organisations that have strong password policies for user accounts have never changed the factory default on a firewall management interface installed five years ago. The impact is significant: access to a firewall management interface is, in practice, network access.

Forgotten subdomains and shadow assets

External tests regularly surface assets the organisation did not know were still running. Old development and staging environments. Microsites built for specific campaigns. Subdomains pointing at cloud instances or third-party platforms that were never cleaned up when a project ended. These assets share a common characteristic: no one owns them, so no one patches them, monitors them, or thinks about them.

Attackers enumerate subdomains using the same passive and active techniques we use during testing. A forgotten subdomain running software from three years ago, with no monitoring and no patch management, is a significantly easier target than any well-maintained system.

Email authentication gaps

Missing or misconfigured DMARC is one of the most consistently present findings across external tests, and one of the most underestimated. An organisation without a DMARC policy of p=quarantine or p=reject can have its domain spoofed with no technical barrier — an attacker can send email that appears to come from your domain to your customers, partners, and staff.

Many organisations implement DMARC in reporting mode (p=none) and never advance it to enforcement. This provides visibility into spoofing attempts but does not prevent them. It is the equivalent of having a burglar alarm that logs intrusions without triggering any response. SPF records that include too many third-party sending services, or that rely on the soft-fail (~all) qualifier rather than hard-fail (-all), are similarly prevalent.

Account enumeration and credential exposure

Many internet-facing applications reveal whether a username or email address is valid, through login error messages that distinguish between unknown accounts and wrong passwords, or through password reset flows that confirm whether an address is registered. Once a valid account list is in hand, password spraying — testing a small number of common passwords across many accounts, slowly enough to avoid lockout — succeeds in most environments we test.

Separately, credentials from previous data breaches are available in bulk and are tested against business services as a routine step in external testing. Accounts that reuse passwords across personal and professional services are present in every organisation. Multi-factor authentication is the control that matters here; its absence on external-facing services is consistently a critical finding.