Is this intrusive or disruptive to our systems?
No. This assessment is entirely passive — we use the same open-source intelligence techniques an attacker would use in initial reconnaissance, before touching your systems. No scanning, no exploitation, no impact on system performance or availability.
How is this different from a penetration test?
A penetration test is active — it involves attempting to exploit vulnerabilities with explicit permission. This assessment is passive intelligence. We map what is exposed and what has leaked, rather than testing whether specific vulnerabilities are exploitable. They serve different purposes and are often complementary.
What if you find something critical during the assessment?
We don't wait until the final report. If we identify an active threat — credentials actively being used, an open port with a known critical vulnerability, or evidence of current targeting — we contact you the same day.
Do you need access to our internal systems or networks?
No. We need only a list of your primary domains and an NDA. Everything we do is from the outside, using publicly available information and breach data.
How is engagement pricing structured?
Every engagement is fixed price. Tell us roughly how many digital assets are in scope (domains, email domains, mobile apps, cloud accounts) and you'll receive a fixed quote within 24 hours. No hourly billing and no surprise invoices: the price you approve is the price you pay.
Can the report be provided under NDA and remain confidential?
Yes. A mutual NDA is standard before any engagement begins. The report and all findings are confidential. We do not retain client data after delivery.
What is an external attack surface assessment?
It's an outside-in review of everything your organization exposes to the internet: domains and subdomains, IP ranges, cloud services, exposed services, leaked credentials and code, and dark web mentions. It shows you what an attacker would find during reconnaissance, ranked by real risk, with a plan to fix it.
What counts as a digital asset for pricing?
Count each root domain, email domain, mobile app, and cloud account (AWS, Azure, GCP or other) you want covered. You don't need to count subdomains, IP addresses or individual services; finding those is the job of the assessment. If you're unsure, give your best estimate and we'll confirm scope before quoting.
How long does an assessment take?
Most assessments are delivered within 2–4 weeks of the scoping call, depending on the number of assets. If we find something critical along the way, we contact you the same day.
How is this different from an EASM platform?
External attack surface management (EASM) platforms scan continuously and generate alerts your team has to triage. This assessment is analyst-led: a senior investigator verifies every finding, removes false positives, connects exposure to real threat activity, and delivers a prioritized report with a walkthrough. Many clients use it to baseline their exposure before, or instead of, buying a platform.
