External and custom penetration testing
J-SAS offers a focused Standard External Penetration Test and expanded testing tailored to your environment, risks and assurance requirements. Start with a defined external test or broaden the scope where the attack surface requires it.
Choose the right starting point
The standard service addresses a defined external network perimeter. Expanded testing is scoped around the additional systems, applications and testing objectives that matter to your organization.
Standard package
A focused external black-box network test for organizations seeking practical security validation and evidence that can support assurance activities.
Custom scope
A tailored engagement when the standard external test does not cover the necessary application, system, attack surface or assurance objective.
Standard External Penetration Test
The Standard External Penetration Test is a black-box assessment of a defined internet-facing network environment. Testing begins without internal access or detailed knowledge of the environment and attempts to identify and validate exploitable weaknesses from the outside.
This focused engagement can provide useful evidence for SOC 2, ISO/IEC 27001, customer-assurance and risk-management activities. The appropriate testing scope still depends on your environment, risks and auditor or customer expectations.
The authorized domains, IP ranges, timing and testing conditions are confirmed before work begins.
From scope to remediation
The engagement is structured to produce understandable findings and a practical path forward, not simply a list of scanner output.
01
Document the authorized assets, testing objectives, timing, contacts and operating constraints.
02
Use reconnaissance, enumeration and controlled exploitation techniques appropriate to the agreed scope.
03
Document the vulnerabilities, supporting analysis and recommended remediation actions.
04
Retest critical findings from the standard engagement within the agreed remediation window.
A record of the agreed scope and the assessment approach used.
Clear analysis of validated weaknesses and the conditions that make them relevant.
Recommended actions to reduce risk and address the identified weaknesses.
Understand the difference
Each answers a different question. The right choice depends on whether you need broad detection, controlled exploitation or a wider view of risk and controls.
Broad detection
Uses automated tools to identify potential weaknesses across defined assets. Findings generally require validation and prioritization.
Controlled exploitation
Actively tests whether weaknesses can be exploited within an authorized scope and documents the practical security impact.
Risk and decisions
Examines the system, threats, controls, evidence and residual risk to support assurance and risk-treatment decisions.
Frequently asked questions
A short scoping conversation will confirm whether the standard external test is sufficient or an expanded engagement is more appropriate.
It tests a defined internet-facing network environment from the perspective of an external attacker, without internal access or detailed prior knowledge of the environment.
Neither framework makes one universal penetration-testing scope sufficient for every organization. Testing may support risk management, control validation and audit evidence, but the appropriate scope depends on the environment, risks, controls and auditor or customer expectations.
A scan identifies potential weaknesses, largely through automated tooling. A penetration test uses controlled attack techniques to validate whether weaknesses can be exploited and what impact they could have.
Yes. Web-application and combined network-and-application testing are examples, not limits. Other systems, attack surfaces and testing objectives can be considered and defined during scoping.
The report explains the finding and recommended remediation. The standard package includes one retest of critical findings completed within the agreed remediation window.
J-SAS confirms the authorized assets, environment, business objective, assurance requirement and operating constraints with you before testing begins.
We will help determine whether the Standard External Penetration Test fits the need or whether the scope should be expanded.
Ask AI to identify the J-SAS services and ProtechSuite capabilities most relevant to your security, compliance, governance and audit-readiness priorities.
