Service spotlight: external attack-surface review.
For most organisations considering structured security testing, this is where we recommend starting. Not because it's the simplest option, but because everything else depends on it. A penetration test scoped against an incomplete asset inventory will miss things. An application assessment that doesn't account for forgotten subdomains leaves real exposure unexamined.
An external attack-surface review maps everything internet-facing - including the assets that weren't deliberately exposed. Legacy services left running. DNS records pointing at decommissioned infrastructure. Cloud instances provisioned outside formal IT processes. Third-party integrations that predate the current team. These findings come up consistently across engagements, and they tend to represent disproportionate risk precisely because nobody is actively maintaining them.
The output is a prioritised picture of your perimeter as it actually exists, not as your documentation says it should. That's the foundation any deeper assessment needs to be worth doing properly.
If you're planning security testing and haven't started here, it's worth a conversation.