Forgotten assets are the easiest way in
Every launch, trial or new provider leaves behind subdomains and services that nobody tracks. These assets usually sit outside patching and monitoring, and they are the first thing an attacker looks for.
Our services · External penetration testing
External penetration testing for everything your organization exposes to the internet
An external security assessment covering your web apps, APIs and mobile apps, plus subdomains, public IP addresses and exposed services. Tested manually by Saudi researchers with a real attacker's mindset, and only within the scope you approve.
- Pay only when a Critical or High finding is confirmed
- Manual testing by Saudi researchers ranked top 10 on bugbounty.sa
- Free retests until each finding truly closes
01 · Why external testing
Why you need full external penetration testing
Attackers do not start with the one app you chose to test. They map everything you have on the internet, then go in through the weakest point: a forgotten subdomain, an exposed admin panel, a test environment nobody closed. A full external assessment shows you your organization the way they see it.
A small flaw in one asset opens the path to another
An API key in a forgotten file on a subdomain can be enough to reach your main application's data. Testing each system on its own misses these chains; a full assessment finds them.
Regulatory requirements
The NCA Essential Cybersecurity Controls (ECC) and the SAMA Cyber Security Framework (CSF) include penetration-testing requirements. Our reports are documented in line with both, to help you evidence that you meet them.
The trust of your customers and partners
Your internet-facing systems are the first thing your customers and partners interact with. Finding and fixing a vulnerability before an attacker does protects their data and your reputation.
02 · Scope
01
02
03
04
05
06
07
08
09
What external penetration testing covers
We test internet-facing systems only: those you own or are authorized to test, and that you list in scope. Reliant's services do not cover internal networks or on-premise infrastructure.
External asset discovery and mapping
We enumerate the subdomains, public IP addresses and exposed services that belong to the agreed domains, within the approved scope only. Any new asset found during reconnaissance is not tested until you add it to the scope.
Admin panels, login portals and forgotten environments
We look for admin panels exposed to the internet, weakly protected login portals, and staging and test environments left open. We test them for weak authentication such as default credentials and missing login rate limiting.
Subdomain takeover and DNS misconfiguration
We check DNS records that still point to services or providers you no longer use, a flaw that lets an attacker publish content under your domain. We also review DNS misconfigurations that leak information about your systems.
TLS and security configuration of exposed services
We review TLS settings, certificates and allowed protocols, security headers, and ports and services left open without need. A single misconfiguration can be enough to expose data in transit or open an unexpected way in.
Exposed files, secrets and backups
We look for configuration files, backups, .git repositories and open directory listings, as well as API keys and access tokens left in public files or in JavaScript code.
Outdated or vulnerable internet-facing software
We identify the versions of servers, content management systems, plugins and components reachable from the internet, then manually verify whether known vulnerabilities in them are exploitable instead of relying on the version number alone.
Web applications and APIs
We test business logic, sessions and authentication including JWT, OAuth and SSO, and REST and GraphQL APIs, looking for IDOR, SQLi, XSS, SSRF and privilege bypass between users and roles.
Mobile applications
We test iOS and Android apps together with the backend APIs they talk to, using OWASP MASVS / MASTG as the checklist. For example, we look for sensitive data stored on the device and keys embedded in the app.
Chaining issues across assets
We chain findings the way a real attacker does: a secret exposed in a forgotten test environment can grant access to the production API. We document the full chain so its real business impact is clear.
03 · Methodology
How we run an external assessment
Testing is manual, performed by Saudi researchers ranked among the top 10 on bugbounty.sa, the Saudi Federation's national vulnerability-discovery platform, and led by co-founders with 3,900+ combined documented findings. We do not hand you automated scanner output formatted as a report. We start with reconnaissance within the approved scope, test each asset, then chain vulnerabilities the way an attacker would. Every finding is manually reviewed, verified and reproduced before it reaches you.
PTESOWASP Top 10OWASP API Security Top 10OWASP MASVS / MASTGNCA ECCSAMA CSF
04 · How it works
Full external assessment, from first contact to retest
- 01
Share your requirements
Send us your main domains and the web apps, APIs and mobile apps you want tested, or book a 30-minute consultation with a lead penetration tester to define the right scope.
- 02
Create the program and define the scope
You create a program on the platform listing in-scope and out-of-scope assets, from domains and public IP addresses to app links. You set the rules of engagement: testing windows, forbidden techniques such as DoS, rate limits and the escalation channel, along with a suggested budget.
- 03
Scope review and agreement
Reliant reviews the scope and agrees the budget with you. The program runs under Reliant's standard Engagement Agreement, or under your own contract once Reliant accepts it, and an NDA is signed before any testing.
- 04
Testing and triage
The assigned researchers start with reconnaissance within the approved scope, then test each asset and chain vulnerabilities. Reliant triages every submission, and an approved Critical or High finding can be sent to you immediately, ahead of the report.
- 05
Report and finding discussion
You receive the report with every approved finding in your dashboard. You discuss each finding with Reliant through comments, and you may be asked for your view through Company review.
- 06
Free retest
After fixing, you request a free retest while the program is in its report or retest stage, and you get the result as soon as the check is done.
05 · Deliverables
What you receive after testing
- A stable reference for every finding in RLT-000123 format, easy to track across your teams
- A CVSS severity score with a clear description of the business impact
- Detailed step-by-step reproduction (proof of concept) with supporting evidence
- Practical remediation guidance for every finding, including chains that span more than one asset
- Findings for every asset in one dashboard, from subdomains to mobile apps
- An auditable PDF report from the report stage or on request
- Free retests until each finding truly closes
06 · Pricing
Outcome-based pricing for the full external assessment
You pay only if Reliant confirms at least one Critical or High severity finding. The fee is then the program's agreed budget: one amount for the whole engagement, with the invoice issued automatically with the report. If no Critical or High is confirmed, the invoice is zero and the test and its report are delivered free. Price depends on scope size, testing depth and timeline.
- One amount for the whole program, no per-finding charge and no hidden fees
- Duplicate, invalid or out-of-scope reports are never billed
- No minimum engagement: a small scope is priced the same way
07 · FAQ
All frequently asked questions
External penetration testing FAQ
What is the difference between a full external assessment and penetration testing a single app?
Testing a single app focuses on one specific system. A full external assessment starts by mapping what your organization exposes to the internet within the agreed domains, then tests your web apps, APIs, mobile apps, subdomains and public IP addresses together. That is how we find vulnerabilities that come from chaining more than one asset, which stay hidden when each system is tested on its own.
How do you avoid testing assets we do not own?
You define and approve the scope on the platform, including what is in scope and out of scope. We only test assets you own or are authorized to test and have listed in scope. If reconnaissance turns up an asset that seems to be yours but is not listed, it is not tested until you add it to the scope.
Does external testing include our internal network or on-premise servers?
No. This service covers internet-facing systems only; internal networks and on-premise infrastructure are out of scope. We test what an attacker can reach from outside: your apps, APIs, subdomains, public IP addresses and the services exposed on them.
Is external penetration testing safe for production systems?
Testing runs within clear controls. The rules of engagement are signed before we start, and we keep to the agreed testing windows, rate limits and forbidden techniques such as DoS, with an immediate escalation channel. We test like a real attacker without disrupting your operations.
How long does a full external assessment take?
It depends on the scope: the number of domains, apps, APIs and mobile apps. Most engagements are completed within 5 to 10 working days. You do not have to wait for the report to learn about serious risk: an approved Critical or High finding can reach you immediately.
How is a full external assessment priced?
It is priced by scope size, testing depth and timeline, with a single agreed budget for the whole program. You pay only if we confirm at least one Critical or High finding; otherwise the invoice is zero and the report is delivered free. If you only need one part, each service has its own scope and price.
Which teams benefit from a full external security assessment?
Cybersecurity teams that need a complete picture of what the organization exposes to the internet, and compliance teams that need a report documented in line with NCA ECC and SAMA CSF. Development and IT teams that need clear reproduction steps and remediation guidance. And leadership that needs to understand the business impact of each finding.
See what an attacker sees of your organization online
Share your requirements or book a 30-minute consultation with a lead penetration tester. You pay only if we confirm a Critical or High.
- info@reliant.sa
- +966 54 966 9661
- Riyadh, Saudi Arabia