Most external infrastructure assessments follow the same pattern: run a scan, map the output to CVEs, produce a report. That process has value, but it leaves a significant portion of your actual exposure unexamined.
At Nanorisk, our external assessments start with manual service enumeration - every port, every protocol, every exposed interface - followed by active exploitation attempts against each one identified. We don't stop at what a scanner surfaces. We also feed OSINT findings directly into the engagement, applying techniques like virtual host enumeration, password spraying, and credential stuffing using data gathered specifically about your organisation and its external footprint.
The difference matters because attackers don't limit themselves to known CVEs. They probe for weak authentication, forgotten subdomains, and credential reuse - and so do we.
If you want to understand what your external perimeter actually looks like to someone trying to get in, get in touch at nanorisk.co.uk.