AI-assisted external security assessment

See what you expose.Know what to fix first.

From one critical website to your whole external estate: see what is exposed, how sure we are about each issue, and what to address first. Every finding comes with supporting evidence, practical recommendations and clear coverage limitations.

Written authorisation
Agreed targets and techniques
A defined assessment window
Controls to minimise operational impact

Request assessment scope Compare packages

In plain language

What is an externalsecurity assessment?

A permitted, carefully controlled check of what your public-facing website or service exposes to the outside world. It runs only against the targets and techniques you approve in writing, within a defined window. You get a clear answer to one question: what is visible from outside, how sure are we about each issue, and what should you address first?

Dimension	A vulnerability scanner	A manual test	AI-assisted assessment
Coverage in the window	Wide but shallow	Deep but limited by hours	The agreed surface, planned and coordinated by AI
Signal versus noise	Hundreds of possible issues, many of them noise	Confirmed by hand	Each finding labelled by the strength of its evidence
Turnaround and cost	Minutes, cheap	Weeks, expensive	An agreed window, priced after qualification
Novel, creative logic flaws	No, it matches patterns	A tester's real strength	Adversarial package, under human supervision
Rules of engagement	Point it and run	Agreed scope	Written profile: techniques, rates, exclusions, stop conditions
What you walk away with	A raw export	A written report	Evidence-graded findings, fixes, and one re-test

Clear strength
With conditions
Weak, or not its job

A skilled human tester still leads on novel, creative attacks, and we don't pretend otherwise. AI does the broad, coordinated work within the window and keeps the people supervising it focused on judgement.

Why AI-assisted

Broader coverage. Clear evidence.Controlled scope.

AI helps plan, coordinate and analyse checks across the agreed surface within the assessment window, under experienced human supervision and inside rules of engagement built for your board, your auditors and your engineers.

Broader coverage in the window

AI-supported planning and coordination work through transport security, headers, cookies, CORS, error handling and selected application checks across the agreed surface, so more of what you expose actually gets looked at.

Evidence you can act on

Findings come with supporting evidence and practical recommendations. Where a permitted test reproduces a behaviour, the request, the response and the reproduction steps are in the report.

Controlled by design

Permitted techniques, request rates, exclusions and stop conditions are agreed in writing before anything runs. Controls are designed to minimise operational impact on live services.

Three packages

Start focused. Go wide.Go deep.

Most organisations start with one critical website or service. Step up to Extended when you need to see everything your domains expose, including what has been forgotten. Choose Adversarial when leadership needs to know how an attacker would actually get in, and what it would mean for the business.

Included in every package Remediation guidance for every finding, and one remediation re-test after your team has fixed the issues.

Package 01Recommended start

Focused External Assessment

One selected website or service, assessed thoroughly from the outside.

Answers the question“Is this website or service safe to expose to the internet, and what should we fix first?”

Key coverage

One agreed website or service
Seven core areas: exposure, encryption, hardening, secrets, access control, APIs, and email and domain security
Evidence-backed findings, prioritised by what to fix first

Subdomains, additional systems and login accounts are not included.

Best forA single critical application, SMEs, a launch, or a customer security request

Scope Focused

Package 02Whole estate

Extended Exposure Assessment

Everything in Focused, across all your subdomains and entry points, including the assets you may have forgotten.

Answers the question“What do we actually have exposed across our estate, and is any of it putting us at risk?”

Everything in Focused, plus

All subdomains of your agreed targets
Multiple systems and entry points in one engagement
Deep discovery of hidden content and unlisted parameters
Subdomain-takeover checks on hosts confirmed as yours

Discovered hosts are checked for attribution before any testing.

Best forGrowing or multi-brand estates, and recurring assurance

Scope Extended

Package 03Executive visibility

Adversarial Assessment

Everything in Extended, plus AI-led investigation that tests, verifies and connects what it finds.

Answers the question“If a capable attacker targeted us, how far could they get, and what would it mean for the business?”

Everything in Extended, plus

Autonomous investigation beyond the standard checklist
Every finding challenged and reproduced before it reaches your report
Attack chains showing how minor issues combine into real impact
Severity rated for technical, business and regulatory impact

Autonomous does not mean unsupervised. Every action stays inside your written assessment profile, under human oversight.

Best forRegulated sectors, high-value services, and board or audit reporting

Scope Adversarial

Every engagement is scoped to your systems, and pricing is confirmed after qualification. Not sure which fits? Say so in the form and we will recommend one.

From the report

One finding,rated three ways.

Every finding is rated for business impact, technical severity and legal liability, then placed on a roadmap your team can run. Here is the shape of one, illustrative and generic by design.

Customer portal exposes an internal lookup API without authenticationCriticalFix today

Business impact: The endpoint returns a customer's full account record, so one request can read what the whole support team can see.
Technical severity: Unauthenticated, no precondition, keyed on a sequential account number, so it can be enumerated end to end.
Legal liability: Returns names, addresses and identity-document numbers. Bulk processing without consent is a serious data-protection breach under PDPA.

The roadmap

TodayClose the unauthenticated endpoint and rotate anything it exposed.
This weekRequire a session and an ownership check on every record lookup.
This cycleAdd rate limits and logging on customer-data endpoints.
Next passRe-test, then recheck the rest of the estate for the same pattern.

The request, the response and the reproduction steps are in the report, with a clear note wherever a result was read from code rather than executed.

Compare packages

What eachpackage covers.

Capability	Focused	Extended	Adversarial
Scope
Targets in scope	One target	Multiple systems and entry points	Multiple systems and entry points
Core checks
Seven core areas: exposure, encryption, hardening, secrets, access control, APIs, email and domain	Included	Included	Included
Discovery
Deep discovery: hidden content, parameters and subdomain takeover	Not included	Included	Included
AI layer
Autonomous investigation beyond the checklist	Not included	Not included	Included
Adversarial verification of every finding	Not included	Not included	Included
Attack-chain correlation	Not included	Not included	Included
Severity in business context: technical, business, regulatory	Not included	Not included	Included
Support
Remediation guidance for every finding	Included	Included	Included
One remediation re-test	Included	Included	Included
Fit
Best suited for	A single critical application, SMEs, a launch, or a customer security request	Growing or multi-brand estates, and recurring assurance	Regulated sectors, high-value services, and board or audit reporting

Ready to scope? Request an assessment →

How we work

A method you can putin front of auditors.

Every engagement is evidence-graded and non-intrusive by default. We state what we tested, what we did not, and how sure we are about each finding.

Evidence-graded

Every finding says how sure we are: confirmed by a permitted test, read from code, or still needs investigation. Your team knows what to fix now and what to verify first.

Non-intrusive by default

External scanning is rate-limited. Active application checks run only where you have authorised them. No denial-of-service, no destructive actions, nothing outside scope.

Limits stated, not hidden

Each report records the targets assessed, the tests performed, the exclusions and the coverage limitations. The results are a floor, not a ceiling.

Supports your compliance

Findings can be mapped to the frameworks you report against:

ISO 27001
PCI DSS
BNM RMiT (Malaysia)
MAS TRM (Singapore)
Cyber Essentials (UK)

We are an assessment and advisory provider, not a certification body. An assessment informs compliance; it is not itself an attestation.

Rules of engagement

Agreed before we start.Stated when we finish.

Approved checks may include selected active application tests. Every engagement runs to a written profile, and controls are designed to minimise operational impact.

Agreed in writing before execution

The exact targets, assets and any third-party permissions
Permitted techniques and evidence limits
Request rates and the assessment window
Exclusions and stop conditions
Named contacts for scope, escalation and report review
For Adversarial engagements, the boundaries of autonomous investigation: what it may and may not pursue

What we will never do

Test anything without your signed, written authorisation
Touch domains, IPs or subdomains outside the approved scope
Generate denial-of-service or high-volume traffic
Take destructive actions, or attempt password guessing or credential stuffing
Treat an enquiry, or a discovered hostname, as permission to test
Ask for credentials or sensitive scope details through a web form

Each report records the assessed targets, tests performed, exclusions, evidence, recommendations and coverage limitations. After your team has addressed the findings, we re-test them and record the outcome. The report does not guarantee security, complete discovery or compliance.

What happens next

Qualified, authorised,then assessed.

Every engagement follows the same path, and nothing runs until the scope is agreed and the authorisation is signed.

Step 01

Qualify

We review your request: who you are, the target type, the outcome you need. No credentials or target details at this stage.

Step 02

Authorise

We agree targets, techniques and the assessment window in writing. For systems you don't own, the owner signs too. Nothing runs before this.

Step 03

Assess

Controlled testing within the agreed window and limits, AI-assisted and under experienced human supervision throughout.

Step 04

Report

Evidence-backed findings, prioritised, each with practical recommendations and a clear note on how sure we are.

Step 05

Re-test

Once your team has fixed the issues, we re-test them and record the outcome. Included in every package.

Questions

Before you scope.

What is an external security assessment?

A permitted, carefully controlled security check of what your public-facing website or service exposes to the outside world. It runs only against the targets and techniques you approve in writing, within a defined assessment window, and answers one question: what is visible from the outside, how sure are we about each issue, and what should you address first?

How is it different from a vulnerability scanner?

A scanner lists hundreds of possible issues, many of them noise, and someone still has to work out which ones matter. An AI-assisted assessment covers the agreed surface within the window, labels every finding by the strength of its evidence, and comes with recommendations and a re-test, so your team knows what is confirmed and what still needs investigation.

How is it different from a manual penetration test?

A manual test is deep and careful, but slow and expensive, so coverage is often limited to a few days of a tester's time. AI helps plan, coordinate and analyse checks across a broader surface in the same window, under experienced human supervision. For novel, creative logic flaws a skilled tester still leads, which is what the Adversarial package adds.

Will testing affect our live service?

Controls are designed to minimise operational impact. Request rates, exclusions and stop conditions are agreed in writing before execution, and we never generate denial-of-service or high-volume traffic.

Can we choose the testing window?

Yes. The assessment window is agreed in writing before any testing begins, and can be scheduled around your operations.

Do you test without permission?

Never. Testing starts only after signed, written authorisation for the exact targets. An enquiry, or a hostname discovered during an engagement, is not permission to test. Discovered hosts are checked for attribution before anything runs against them.

Who sees our findings?

Only the named assessor and lead on your engagement, and the contacts you name. Reports and evidence are encrypted and shared only with those contacts.

Can you sign our NDA?

Yes.

Do you test APIs, mobile apps or internal networks?

The three packages cover external, public-facing assessment: websites, APIs and internet-facing services are in scope. Mobile apps, source-code review and internal networks are scoped separately. Mention them in the form and we will advise.

What do I get at the end?

A report that records the assessed targets, the tests performed, the exclusions, the evidence, the recommendations and the coverage limitations, with findings prioritised into a plan: today, this week, this cycle, next pass. After your team has fixed the issues, we re-test and record the outcome. The report does not guarantee security, complete discovery or compliance.

More from Auris: SSHepherd® · Auris Lab · Enterprise AI · the blog.

After the assessment

Found exposed servers or admin ports? Make them disappear.

Fixing a finding closes one door. SSHepherd® removes the open ports altogether, so the next assessment finds nothing to reach.

Explore SSHepherd®

Assessment scope

Start witha few details.

Tell us who you work for, which package you have in mind, and the outcome you need. We qualify the request before agreeing targets, techniques and written authorisation.

No credentials, target URLs or IP addresses now
A focused qualification review
Clear next steps for authorisation

An enquiry does not authorise testing; we agree scope and authorisation securely after qualification.