One baseline across your public edge and internal network.
Assess authorised internet-facing systems and internal infrastructure in a single engagement, then receive a coordinated picture of what to fix first.
Final pricing is confirmed after a short scope review.
A single programme of work, not two disconnected scans.
Many organisations need both an external view of what is reachable from the internet and an internal view of servers, endpoints and network infrastructure. Combining them produces one authorised scope, one reporting cycle and one remediation plan.
What we assess
- Approved public IP addresses and internet-facing services
- VPN, firewall and remote access exposure
- Authorised internal servers and endpoints
- Internal network infrastructure in scope
- TLS, certificate and selected configuration checks
- Agreed exclusions and testing windows
Only explicitly authorised systems are assessed. Third-party systems remain out of scope unless authority can be demonstrated.
Understand exposure from both directions.
The combined assessment is designed to show how public exposure and internal weaknesses sit together, so priority is based on the whole environment rather than a single perimeter.
Evidence your team can use.
Clear documentation for leadership, technical teams and stakeholders who need to understand the assessment outcome.
View a Sample ReportA controlled path from scope to verification.
You know what is happening, why it is happening and what comes next at each stage.
Joint scope
Confirm public and internal targets, access, exclusions and the testing window in writing.
External discovery
Assess authorised internet-facing systems for known weaknesses and exposed services.
Internal discovery
Assess the agreed internal environment using the approved access method.
Review and context
Validate significant findings and consider how internal and external issues interact.
Coordinated report
Deliver one baseline that leadership and technical teams can act on together.
Verification
Retest agreed remediated findings where included in the proposal.
Combined assessment is still not penetration testing.
This engagement identifies and prioritises vulnerabilities across authorised external and internal systems. It does not simulate a full attacker kill chain or include exploitation unless a separate authorised service is agreed.
If a customer questionnaire asks for a pentest, we will say so plainly rather than stretch this service to fit the wording.
Starting price assumes a combined external and internal baseline. Asset count, locations, access method, testing restrictions and reporting requirements determine the final fixed proposal.
What to know before the assessment.
How is this different from two separate assessments?
Is this cheaper than buying both assessments separately?
Do you need onsite access for the internal portion?
Is this a penetration test?
Can we exclude sensitive systems?
Can remediations be verified afterwards?
See the inside and the outside in one report.
Tell us about the public systems and internal environment you need assessed. We will confirm scope and provide a fixed-price proposal before work begins.