> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/changelog/q4-2026/external-network-pentesting-test-your-perimeter-before-someone-else-does.md). # External Network Pentesting: test your perimeter before someone else does 28 Oct 2026 External network pentesting puts AI agents on everything you expose to the internet. All you need to start is a list of your domains. Agents map the subdomains, open ports and running services behind it, then try to break in the way an outside attacker would, with no code access or login credentials. As with every pentest in Aikido, only findings the agents manage to exploit make the report. {% embed url="" %} ### What it does * **Maps your perimeter.** Add one or more top-level domains, and Aikido finds the subdomains, IP addresses, open ports and services behind them. Review the list and remove anything you'd rather keep out of scope. * **Puts agents on every host.** Attacker agents start from what discovery found and try to get in using known CVEs, misconfigurations and exposed secrets. * **Chains findings like a real attacker.** Agents use what they find on one system, like credentials, to reach the next. The report shows the full path from entry point to impact. * **Lets you watch the agents work live.** The Agents tab shows what each agent is thinking, which tools it's using and what it has found so far. * **Retests your fixes.** Retest agents check whether a patch works and whether it can be bypassed. Retests are included for 6 months. * **Runs continuously if you want it to.** In continuous mode, new subdomains get tested shortly after they go live. ### What it finds * **Known vulnerabilities on exposed services**, like outdated frameworks and server software * **Misconfigurations** on internet-facing systems * **Exposed files and secrets**, like a public .git folder or credentials left on a server Every finding comes with an attack analysis, exact steps to reproduce it, the root cause and remediation guidance. ### Safe to run on production * All agent traffic goes through a proxy that blocks connections to out-of-scope systems. * Supervisor agents review each action and block anything that could harm your environment before it runs. * A scoping agent checks how much of each subdomain you own, and limits testing to the parts you control. * You set the maximum requests per second per target, or limit testing to inside or outside business hours. ### How it fits into Aikido * Runs next to your web app and mobile pentests, with the same report format. * Covers your apps from the outside, up to the login page. For what happens after login, pair it with a[ web app pentest](https://www.aikido.dev/attack/aipentest) on your most important application. * Produces a report you can hand to auditors and customers. ### How much does it cost? External network pentests run on credits from your Aikido Wallet. Pricing is based on the number of publicly accessible assets we find, and you see the exact quote before anything runs. Continuous pentesting is priced yearly, based on the number of assets found in your first pentest. → Read more about [External Network Pentesting](https://www.aikido.dev/attack/external-network-pentesting) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.aikido.dev/changelog/q4-2026/external-network-pentesting-test-your-perimeter-before-someone-else-does.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.