StonePath Cyber · Vulnerability Management
External Attack Surface Assessment
See your organization the way an outside attacker does — every internet-facing asset, exposure and misconfiguration, ranked by what to fix first.
$1,497 one-time
One-time payment · Secure checkout by Stripe · We email you after checkout to schedule your kickoff
What it is
A senior-led, outside-in review of everything your organization exposes to the internet: domains and subdomains, public IP ranges, cloud-hosted services, login portals, remote-access endpoints, email and DNS configuration, and certificates. Your named advisor maps what is reachable, identifies what should not be, and turns the findings into a prioritized remediation list your IT team or provider can act on. This is a non-intrusive assessment — no exploitation and no load testing.
What’s included
- Asset discovery — domains, subdomains, IP ranges and cloud-hosted services tied to your organization
- Exposure review — open services, remote-access endpoints, admin panels and login pages reachable from the internet
- Configuration checks — TLS/certificate hygiene, DNS and email-authentication records, and common misconfigurations
- Shadow IT findings — forgotten, unmanaged or third-party-hosted assets that still carry your name
- Prioritized remediation list — each finding rated by risk with a plain-language fix
- Findings walkthrough — a working session with your named advisor to review results and next steps
Who it’s for
Small and mid-sized organizations that have grown through new SaaS tools, cloud services, acquisitions or agency-built websites and no longer have a reliable inventory of what is exposed to the internet.
Senior-led, embedded
Every StonePath Cyber engagement is led by a named senior advisor who works alongside your team from kickoff to handoff — one accountable point of contact, plain-language findings, and recommendations sized for your organization.
How it works
Pay securely through Stripe.
Confirm your domains, known IP ranges and written authorization.
Your advisor runs the outside-in discovery and review.
Receive the written report and review it together.
Questions
Is this a penetration test?
No. This is a non-intrusive, outside-in assessment of what you expose. It does not attempt to exploit anything. If you need exploitation-based testing, see the Penetration Test: Web Application engagement.
Will it disrupt our systems?
It is designed not to. Discovery and checks are passive or lightweight, and scope and timing are agreed with you in writing before anything starts.
What do you need from us?
A list of the domains you own, any IP ranges you know about, a point of contact, and written authorization to assess them.
Do you fix the issues you find?
The deliverable is a prioritized remediation list. Remediation help can be scoped as a separate engagement if you want it.
Does this certify us as secure?
No. It is a point-in-time assessment, not a certification or guarantee of security.
External Attack Surface Assessment
See your organization the way an outside attacker does — every internet-facing asset, exposure and misconfiguration, ranked by what to fix first.
$1,497 one-time
Service descriptions reflect general industry practice. Nothing on this page is a compliance determination, a certification, a license, or a guarantee of any outcome. Final scope is confirmed with you in writing before work begins.