Network Penetration Testing: Your External Infrastructure
Network penetration testing checks the infrastructure beneath your applications: the exposed services, open ports, edge appliances and cloud network settings an attacker uses to get a first foothold. Matproof Sentinel maps your external network attack surface, tests it from the internet and re-tests each finding to show what is really exploitable. With a read-only cloud role it also checks your AWS network configuration. You get an evidence report mapped to ISO 27001, NIS2 and DORA. Free 3-minute scan, full report from €149.
Why network-layer testing still matters in a cloud-first world
Even cloud-native organisations run on networks: VPCs and security groups, VPN and identity gateways, internal services that trust each other implicitly, and the management interfaces that quietly accumulate at the edges. Network penetration testing answers a question application tests cannot: what can an attacker reach and exploit at the infrastructure layer from the internet. It finds exposed services, vulnerable edge appliances (the repeat cause of high-profile breaches), and misconfigured cloud network controls. An internal network test is a separate job. It starts from inside your network and checks lateral movement and segmentation. A specialist tester does that work on site or over VPN. NIS2 Art. 21 and DORA Art. 24 both expect infrastructure-level technical testing, and cyber-insurers increasingly ask for evidence that internet-facing systems have been tested.
- Edge appliances (VPN, firewall, file-transfer, mail) remain a top initial-access vector. Known-CVE RCEs are weaponised within days. Network testing confirms whether yours are reachable and exploitable.
- Forgotten hosts, open database ports and exposed admin panels are often missing from the asset list. An external scan finds what the internet can see.
- Weak TLS settings and legacy protocols on public endpoints are easy to miss and easy to fix once found.
- Cloud network controls drift: over-broad security groups, exposed management ports and forgotten peering routes are common and are exactly what infrastructure testing surfaces.
- NIS2 Art. 21, DORA Art. 24 and ISO 27001:2022 A.8.20–A.8.22 (network security and segregation) expect tested — not merely documented — network controls.
What Matproof tests in a network penetration test
- External service exposure: open ports, management interfaces, databases reachable from the internet, RDP/SSH exposure, default/weak credentials
- Edge appliance vulnerabilities: VPN, firewall and file-transfer devices fingerprinted and checked for known RCE and auth-bypass CVEs
- AWS cloud network configuration through a read-only role (Prowler): over-permissive security groups, exposed management ports, public storage
- DNS and certificate checks: subdomains, dangling records and expired or weak certificates
- TLS and protocol hardening (RFC 8446), weak ciphers, and exposed legacy protocols
- Exposed files on public hosts: backups, config files and version-control folders
- Findings risk-rated with CVSS 3.1 and mapped to ISO 27001 A.8.20–A.8.22, NIS2 Art. 21 and DORA Art. 24 for audit evidence
Sample finding
Production database port open to the internet
A typical external network finding: a PostgreSQL server answers on port 5432 from any internet address. A cloud security group rule allows 0.0.0.0/0 on that port, added for a quick test and never removed. The server accepts password logins, so anyone can try to guess or reuse credentials. A database that should only be reachable from the application subnet is one of the most common and most damaging external network findings.
Fix: Remove the public rule and allow port 5432 only from the application subnet or a private endpoint. Use deny-by-default rules, not allow-lists that have drifted. Rotate the database credentials. Re-test from the internet to confirm the port is closed. Sentinel records the before and after state in the report as evidence for ISO 27001 A.8.20 and DORA testing requirements.
Reference: CWE-284 Improper Access Control · ISO 27001:2022 A.8.20 Networks Security · NIS2 Art. 21 technical measures
Network pentest: free scan vs Matproof Sentinel vs traditional consultancy
| — | Free scan | Matproof Sentinel | Traditional consultancy |
|---|---|---|---|
| Automated scan engine | ✓ (3-min preview) | ✓ Full scan | ✗ Manual only |
| OWASP Top 10 coverage | Partial | ✓ Complete | ✓ Complete |
| Proof-of-exploit evidence | ✗ | ✓ Confirmed findings (request/response) | ✓ Per finding |
| Regulatory mapping (DORA/NIS2/ISO 27001) | ✗ | ✓ Automated | ✓ Manual |
| PDF evidence report | ✗ | ✓ Instant | ✓ 2–4 weeks delivery |
| Continuous / recurring scans | ✗ | ✓ Per deploy | ✗ Annual engagement |
| Time to first result | ~3 min | ~30 min full scan | 2–4 weeks |
| Price | €0 | From €149 | €8,000–€25,000 |
| Source code review (SAST) | ✗ | ✓ On Growth plan | ✓ Scoped engagement |
| API testing (REST/GraphQL) | ✗ | ✓ Automated | ✓ Manual |
Network penetration testing pricing
- 1 full pentest scan
- AI-prioritized findings with CVSS 3.1
- Re-tested findings with request/response proof
- PDF evidence report
- Regulatory mapping (DORA, NIS2, ISO 27001)
- 3 full Sentinel pentests per month
- Continuous monitoring
- CI/CD integration (GitHub, GitLab)
- All regulatory mappings
- Priority support
- 10 Sentinel pentests per month
- Extra scans at €149 each
- All 10 agents, including Cloud (Prowler) and Mobile (MobSF)
- Continuous schedules: hourly, daily or weekly
- Authenticated scanning (session cookies, bearer tokens)
- Webhook delivery and priority support
Frequently asked questions about network penetration testing
What is network penetration testing?
Network penetration testing assesses your infrastructure, such as exposed services, edge appliances and cloud network configuration, rather than the application logic that runs on top of it. It has an external part (what an attacker can reach and exploit from the internet) and an internal part (how far an attacker can move once inside). Sentinel does the external part. A specialist tester does the internal part.
Is network penetration testing still relevant if we're fully in the cloud?
Yes. Cloud environments are still networks: VPCs, security groups, VPN and identity gateways, and internal service trust relationships all have network-layer attack surface. Over-permissive security groups, exposed management ports and public storage are common cloud network findings. Sentinel checks them from the internet and, with a read-only role, in your AWS configuration.
What is the difference between network, external and internal testing?
Network testing is the infrastructure layer. External testing looks at it from the internet. Internal testing starts inside your network and checks lateral movement, privilege escalation and segmentation. Sentinel tests the external surface. For the internal network, a specialist tester works inside your environment. Many organisations need both.
How much does a network penetration test cost?
Traditional consultancy network pentests range widely with the number of hosts and IPs in scope, roughly £2,000–£6,000 for a focused external network test, more for large internal estates, over 2–4 weeks. Matproof Sentinel delivers continuous external network testing and an evidence report from €149 (single run) or €299/month. An internal network test by a specialist tester is priced separately.
Go deeper — related blog articles
See what your network shows the internet
Run a free 3-minute external scan now, or get a full network penetration test report: exposed services, edge appliances and TLS, re-tested findings with request/response proof, mapped to ISO 27001, NIS2 and DORA, from €149.
Run free network scan