Engagement
Remote penetration testing: what works from a distance, and what does not
Remote penetration testing covers most modern scopes, because applications, cloud accounts and the internet edge are reachable from anywhere. However, internal networks need a controlled way in, and some tests still need someone on site.
- Signed scope before testing
- Fixed price agreed in writing
- OWASP and PTES methods
What remote penetration testing covers well
Many targets are designed to be reached over the internet. As a result, they can be tested remotely with no loss of depth.
- Public web applications and APIs
- The external perimeter and exposed services
- Cloud configuration and identity roles
- Build pipelines and artefact stores
Reaching internal networks remotely
However, internal testing needs a starting point inside the network. Therefore the usual approach is a small testing device or virtual machine that your team installs, with access agreed in the rules of engagement. Then the access is removed when testing ends.
| Access option | Suits | Agreed in writing |
|---|---|---|
| Testing virtual machine | Virtualised internal networks. | Placement and removal date. |
| Shipped testing device | Physical sites. | Return and wipe procedure. |
| Assumed-breach account | Identity and lateral movement. | Privileges and monitoring. |
Ready for remote penetration testing?
Tick what you can arrange. Open items become part of the scope.
Your result appears here as you tick, so you can see what is still open.
What remote penetration testing cannot do
However, some controls only exist in the physical world. For example, door access, badge readers and on-site wireless need someone present. So those are scoped separately, or excluded in writing.
How remote access is controlled
Also, every access route is listed in the rules of engagement, with testing windows and escalation contacts. In addition, evidence moves over encrypted channels and is destroyed when the project closes. Our method follows the Penetration Testing Execution Standard.
Fees for remote penetration testing
Full engagements run from $35,000 to $120,000, and the floor is $25,000. The bounded Focused Exposure Review starts at $4,500. Its fee is credited in full against a full engagement commissioned within ninety days. Testing usually starts within 48 hours of signed authorisation.
Remote penetration testing questions
Is remote penetration testing as thorough as on-site work?
For applications, cloud and the perimeter, yes. Internal networks need an agreed access point.
How is the testing device secured?
Its placement, access and removal are also written into the rules of engagement.
Can remote penetration testing cover several countries?
Yes, provided each system owner authorises it in writing.
What happens to access afterwards?
Access is removed when testing ends. Also, evidence is destroyed at close.
Related guides
Scope remote penetration testing
Describe the systems and where they live. We reply with an access plan, a written scope and one fixed fee before anything starts.
Get a fixed price