What Is an External Vulnerability Assessment? A Small Business Guide
An external vulnerability assessment looks at your business from the outside, the same way an attacker on the internet would: no logins, no VPN, no software installed on your computers. It finds the weaknesses anyone can see in your website, your email domain and anything else you have exposed online, and ranks them so you know what to fix first.
This guide explains what an external assessment covers, how it differs from an internal assessment and a penetration test, who needs one and how often, and what you should receive at the end.
What an external vulnerability assessment covers
The scope is everything about your organisation that is reachable from the public internet. For a typical small business that means:
- Your website and the software behind it: CMS, plugins, themes and their versions
- HTTPS and TLS configuration: certificates, protocol versions and redirects
- Security headers and cookies that tell browsers how to protect your visitors
- Forms, logins and file uploads visible to the public, and whether they are protected
- Exposed files and panels: backups, configuration files, directory listings, admin and database tools
- Subdomains, including forgotten test or staging sites, found in public sources such as certificate transparency logs
- Email authentication: SPF, DKIM and DMARC records that decide whether criminals can send email that looks like it came from you
- Information leakage: software versions, error messages and other details that help an attacker plan
It does not cover what is only reachable from inside your network, such as office computers, internal servers or your Wi-Fi. Those need an internal assessment.
External vs. internal assessment vs. penetration test
| External assessment | Internal assessment | Penetration test | |
|---|---|---|---|
| Viewpoint | An outsider on the internet | Someone already inside your network | An attacker actively trying to get in |
| Access needed | None | Network access or an installed scanner | Agreed in advance; often test accounts |
| Method | Scanning and manual review, without exploiting anything | Scanning devices and systems inside the network | Exploiting weaknesses to show real impact |
| Typical output | Ranked findings with fixes | Ranked findings per device or system | Attack narrative and evidence |
| Who usually does it | A specialist reviewer | Your IT provider | A penetration testing firm |
They complement each other. Many small businesses start with an external assessment because it needs no access and shows exactly what attackers see first. For a deeper comparison, read penetration test vs. vulnerability scan vs. security review.
Why the outside view matters most for small businesses
Most attacks on small businesses are automated. Bots scan the internet continuously for known weaknesses, such as an outdated plugin, an exposed backup file or a login page without two-factor authentication, and they do not care how big your company is. Your internet-facing systems are the part of your business those bots can reach without breaking in first. An external assessment checks that part systematically, before they do.
Who needs an external vulnerability assessment?
- Firms covered by the FTC Safeguards Rule. Tax preparers, mortgage brokers, lenders and other non-bank financial institutions that do not use continuous monitoring must run vulnerability assessments at least every six months, plus an annual penetration test (16 CFR 314.4(d)(2)). Firms with customer information on fewer than 5,000 consumers are exempt from that testing requirement. See our Safeguards Rule guide for tax preparers.
- Businesses that answer security questionnaires. Larger clients increasingly ask suppliers how they test their security. A dated assessment report is a clear, factual answer.
- Anyone collecting data online. If your website has lead forms, file uploads, a client login or a shop, it handles information worth protecting.
- Businesses after a change. A redesign, a new host, a new booking tool or a security incident are all good reasons to check what is now exposed.
How often should you run one?
At least once a year for most small businesses, and after any significant change to your website or hosting. If the FTC Safeguards Rule applies to you and you do not monitor continuously, the Rule sets the minimum at every six months. Between assessments, keep software updated and recheck the basics with our website security checklist.
How an external assessment works
- Scope. You confirm which website and domains are included and that you are authorised to request the assessment.
- Discovery. The reviewer maps what is publicly visible: pages, subdomains, technologies, email records.
- Testing and review. Automated tools and manual checks look for known vulnerabilities and misconfigurations, without exploiting them or disrupting your site.
- Verification. Findings are confirmed by hand to remove false positives.
- Report. You receive ranked findings with plain-language explanations and specific fixes.
- Retest (often optional). After your developer or host applies the fixes, a follow-up check confirms they worked.
What you should receive
A useful report is short enough to act on and specific enough that your developer does not have to guess. Look for:
- An executive summary in plain English with an overall risk rating
- Each finding ranked by severity, with evidence and why it matters
- Exactly where each issue is fixed and by whom: developer, host or whoever manages your domain
- A short “fix this first” list
- For compliance purposes, the date, the scope and the method, so you can file it with your records
You can see the format we use in our sample External Website Security Review, prepared for a fictional client.
How to prepare
- List every domain and subdomain you know about, including old ones you think are unused.
- Tell your host or IT provider the assessment is happening, so nobody mistakes it for an attack.
- Decide who will receive the report and who will fix the findings.
- Keep last year’s report, if you have one, so progress can be compared.
External vulnerability assessments at Nyorsoft
External assessment is all we do. We need no access to your systems and have no calls or meetings: you send us your website, and we send back the report by email, with follow-up questions answered by email too. Prices are fixed:
- Public Website Security Check — $790 for a quick, prioritised check of one website
- External Website Security Review — $1,900 for a deeper manual review of forms, logins and your attack surface
- Website & Data Exposure Assessment — $3,900 adding subdomains, data exposure, domain and email security and a remediation roadmap
- FTC Safeguards Rule External Assessment — $2,900 per year: two assessments, six months apart, with a Safeguards Rule mapping and a dated assessment letter
Not sure which one fits? See what a website security audit costs or send us your website URL.
Frequently asked questions
What is an external vulnerability assessment?
It is a review of everything your business exposes to the public internet, such as your website, subdomains and email domain, to find known weaknesses and misconfigurations. It is done from the outside, without access to your internal systems, and ends with a ranked list of fixes.
Is an external vulnerability assessment the same as a penetration test?
No. An assessment finds and ranks weaknesses without exploiting them. A penetration test actively tries to break in to show what an attacker could achieve. The FTC Safeguards Rule, for example, lists them as separate requirements.
Will an external assessment slow down or break my website?
A properly run assessment is non-intrusive: it does not exploit vulnerabilities or attempt to overload your site. Let your host know it is happening so they do not mistake it for an attack.
Do you need passwords or access to my systems?
No. An external assessment only looks at what is publicly reachable. You only need to confirm the scope and that you are authorised to request it.
How long does an external vulnerability assessment take?
For a single small business website, typically one to three weeks from scope confirmation to the final report, depending on the depth of the review. Our fixed-price packages take 5 to 14 business days.
Sources
- 16 CFR Part 314 – Standards for Safeguarding Customer Information (eCFR)
- FTC: Safeguards Rule – What Your Business Needs to Know
Not sure what your website exposes?
Our Public Website Security Check looks at your site the way an attacker does — TLS, security headers, email authentication and exposed services — and gives you a short, ranked list of what to fix.
Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team