Practice 03
External exposure discovery, scoped web application penetration testing by a certified tester, and a risk governance plan your leadership can actually run — with owners, deadlines and a monitoring baseline that keeps working after the report is delivered.
Scope agreed in writing before work begins.
The problem
Every subdomain a marketing agency spun up, every test server someone forgot to shut down, every certificate about to expire, every admin panel reachable from the open internet — it is all public, and an attacker enumerates it in minutes with free tooling.
Most companies without a security team have never seen that list. The first deliverable here is not a fix — it is simply knowing what exists, because you cannot govern a risk you cannot name, and you cannot test an application you forgot you were running.
Scope
Stated before you ask, so the first call is about your problem rather than about what we do or do not cover.
How it runs
Nothing is scanned or tested before the asset owner authorises it in writing. For a penetration test we also agree the rules of engagement first: which targets, which techniques, which hours, and who to call if something breaks.
Domains, subdomains, DNS, certificates, exposed services. The inventory almost always contains something nobody in the room knew was online.
Not a raw scanner dump. Each finding gets a severity, a business consequence and an owner, so leadership can decide what is worth money now and what can wait.
A risk register your team keeps, monitoring that alerts on change, and a reporting rhythm — so the second month is better than the first instead of identical to it.
Track record
Certified Web Penetration Tester (American Council for Cybersecurity) — not a course badge but the credential the testing runs under. Two live engagements in parallel during 2026: vulnerability assessments for one of Mexico's largest public universities, and risk management for a legal and real-estate consultancy.
Designed a full risk management plan — threat identification, prioritisation and mitigation — and neutralised active phishing and impersonation campaigns aimed at a firm and its clients. Not a tabletop exercise: live attacks, shut down.
Built automation so recurring security assessments run the same way every time, plus a monitoring dashboard covering DNS visibility, service discovery, change alerting and operational reporting.
Questions
Yes — scoped web application penetration testing, run by a certified Web Penetration Tester under written authorisation and agreed rules of engagement. What is not included is full-scope red-team work, social engineering and physical intrusion: those need a different team, a different contract and a different conversation with your legal counsel. The scope is written down and signed before anything is tested.
Yes, in writing, from whoever owns the assets — before anything begins. If the target runs on a third-party platform, that provider usually has to authorise it too. Testing infrastructure without documented authorisation is a legal problem for both sides, so it is a hard prerequisite rather than a formality.
The opposite: companies without a security team are the ones with the largest blind spot, and the discovery step is cheap. Knowing what you expose costs far less than finding out through an incident.
An inventory of your external footprint, a test report with reproduction steps for each finding, severity and business impact, a mitigation plan with owners and dates, a risk register, and a monitoring baseline that keeps running. Retesting after remediation is agreed up front rather than sold back to you later.
Start here
Describe the problem in a few lines. You get a written reply with a first read on it, whether or not there is an engagement in it. The message is sent from this page — no email client, no third-party form service, no trackers.