External penetration testing. Self-serve, started today

Test everything an attacker can reach from the internet.

Your external attack surface is whatever's reachable from the public internet — firewalls, VPNs, mail, DNS, web apps, and anything else with a public IP. We manually test all of it for real, exploitable weaknesses, not just what a scanner flags. Buy online in minutes, no scoping call.

Start Your Test View Sample Report
Internet-facing perimeter only Manual exploitation Published pricing Attestation letter included
15+
Years of penetration
testing experience
500+
Clients served across
major industry sectors
12
Active professional
certifications held
F500
Fortune 500 client track record
Why teams start with external testing

Your perimeter is the first thing tested in a real attack. It should be the first thing you test too.

External penetration testing covers exactly what's exposed to the internet: your firewalls, VPNs, remote-access gateways, mail and DNS infrastructure, and public-facing applications. It's the most common starting point for a real intrusion, and the most well-defined, repeatable scope to test — which is why it's the fastest thing to get started here, self-serve, without a procurement cycle.

What audit-grade means

Five commitments that separate a real pentest from a quick-find scan.

"Audit-grade" is a category, not a slogan. It means the report holds up to your auditor's review, your prospect's security team, and your insurance underwriter — not because we say so, but because of what we commit to do on every engagement.

Full perimeter coverage

Every public IP, host, or cloud endpoint you list gets tested — every service, not a sample.

Multi-protocol depth

VPNs, firewalls, DNS, mail, and proprietary protocols get tested, not just web ports.

Retest from scratch

When you remediate, we retest everything from scratch, not just the listed findings. New issues that surfaced since the original test get reported too.

Honest pricing

Published list pricing by the number of assets you want tested. No quote, no negotiation, no sales-rep discount theater.

Self-serve, no calls

Answer a few quick questions, purchase, and receive your report. No scoping call, no sales rep, no procurement-cycle drag.

Coverage, not quick wins

Bug-bounty and PtaaS testing chases quick wins.
A real external pentest is graded on coverage, not the first finding.

The cheap pentest options inside compliance platform marketplaces optimize for time-to-first-finding. They're excellent at surfacing the obvious. They're not designed to comprehensively test what's exposed across your perimeter.

Quick-find testing

Bug-bounty and PtaaS researchers race for the first finding. Coverage of the rest of your perimeter isn't the goal of the system, and it isn't what gets reported.

Scanner-only testing

Automated tools find what they recognize. Anything beyond a web server — VPNs, firewalls, DNS, mail, proprietary protocols — is mostly missed.

Audit-grade testing

Every service on every in-scope asset, including non-standard ports and non-web protocols. If you list it, we test it.

Honest pricing

Published rates. No quotes. No sales calls.

External footprints range from a single public IP to large, segmented perimeters. Pricing scales with the number of hosts, IPs, or cloud endpoints you want tested.

How pricing works: The first asset covers the essential work every engagement requires — scoping, setup, validation, and reporting. Pricing scales with your environment from there. Count each public-facing host, IP, or cloud endpoint you want tested — they don't have to be contiguous or in the same network. If you have more than 256 assets, contact us.
Hosts, IPs, or cloud endpoints to test Price Price per asset
1$4,995$4,995
2–4$7,995$1,999 – $3,997
5–8$10,995$1,374 – $2,199
9–16$15,995$1,000 – $1,777
17–32$25,995$812 – $1,529
33–64$36,995$578 – $1,121
65–128$52,995$414 – $815
129–256$72,995$285 – $566

Manual validation included on every engagement. No false-positive reports. Fixed pricing designed for fast procurement.

Start Your Test
External Pentest FAQ

What teams ask before they buy an external test.

What counts as "external"?
Anything reachable from the public internet: firewalls, VPNs, remote-access gateways, mail, DNS, web apps, and any host or service with a public IP. If you list it, we test it.
Do you test internal network segments too?
Not on this page — this is external-perimeter testing specifically. If you need internal network testing too, see our Network page, or email hello@pentestexpress.com to scope both together.
How fast is the report?
There's no sales queue to wait on — scoping starts as soon as you check out. Report timing scales with the number of in-scope assets; we'll confirm your specific timeline before testing begins.
Is there a sales call?
No. Choose your scope from the pricing table and checkout online.
What if I need a retest after remediation?
We retest everything from scratch, not just the listed findings. Free retest within 14 days of report delivery. From day 15 through day 60, retest is 25% of the original price. After 60 days, a full re-engagement is recommended because the environment has typically drifted.
Can our procurement team approve this without a custom SOW?
Yes. Pricing is fixed and published. The standard authorization and rules-of-engagement are in our Terms of Service — most procurement teams clear it in days, not weeks. If your process specifically requires a Statement of Work, select that option at signup and we'll send it for signature through DocuSign instead of running payment through Stripe.
See it before you buy

The exact deliverable you'll receive.

Download a full sample report. No email required, no pressure, no follow-up calls. The format is the format.

Download Sample Report Start Your Test
Pentest Express sample report cover
Operated by senior practitioners

Pentest Express is built and operated by a senior practitioner team.

Founded by Trey Blalock — 15+ years of penetration testing experience, 12 active certifications, and engagements across Fortune 500 companies and federal agencies including the DIA, FBI, and NSA. Speaker at DefCon and MITRE ATT&CKcon. Two DHS CISA keynotes.

The brand carries the quality reputation, not any individual tester. Every report is held to the same standard, on every engagement, regardless of who performs it.

Read Trey's full background →
Trey Blalock, founder of Pentest Express
Get started

Ready to test your external perimeter?

Self-serve checkout, published pricing. No call, no quote, no waiting.

Start Your Test hello@pentestexpress.com