Can you do an external vulnerability assessment without giving my team logins?
Key takeaways
- A full external vulnerability assessment with no logins takes 5 to 10 working days and is delivered as a fixed-price engagement.
- Black-box testing covers your public perimeter, web applications, APIs, cloud storage and any credentials already exposed on the internet.
- No-credential testing finds internet-facing weaknesses; broken access control inside authenticated areas still needs a second, credentialed phase.
- Written authorisation and a signed rules-of-engagement document are required before any testing begins, under the Information Technology Act, 2000.
- An unauthenticated assessment is a genuine first engagement, not a reduced one, and it is priced separately from the authenticated phase.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What can a tester find without any credentials?
More than most people expect. From outside the perimeter, a tester can map every host and service on your public IP ranges, enumerate your domains and subdomains, review the security headers and TLS configuration on every web property, find exposed cloud storage buckets and backup files, test every public API endpoint for unauthenticated access and broken authorisation, look for default and leaked credentials including committed API keys, and test the login pages themselves for credential stuffing, enumeration and injection. In practice, a good share of real breaches in Indian SMEs start exactly here, because the attacker also starts from outside.
What will a no-login test not find?
Three specific classes of weakness. Broken access control between user roles, which is where a customer sees another customer's invoice. Business logic flaws, such as applying a coupon twice or skipping a payment step in a checkout flow. And anything behind the login that only appears once you hold real data. These need a second phase with test accounts and a written authorisation letter naming the systems, the window and the permitted techniques. The honest framing for a buyer is that the first phase maps your exposed surface and the second phase proves what an insider or an ordinary customer can do with it, and they are quoted and scheduled separately.
Is black-box testing actually a real security assessment?
Yes, and it is where almost every engagement should begin, because it answers the question that matters most first: what can an attacker reach from the internet without any help from you. The first phase of a typical Indian SME engagement is external perimeter, web application, API and cloud exposure, with an unauthenticated application test run against the public interface. The findings are ranked by real exploitability rather than scanner severity, with reproduction steps included. Retest after your remediation is included as standard, so the engagement ends with evidence of closure rather than an open list.
What do you need from us to start?
Four things, and none of them are credentials. A list of your domains, IP ranges, applications and APIs, including staging environments if they are reachable. The dates and daily window in which testing is permitted, ideally outside business hours. A named technical contact who can confirm scope and authorise out-of-hours decisions. And a signed rules-of-engagement document that names the exact systems in scope, the techniques permitted, the ones prohibited, and who owns the results. A single page of written authorisation is enough to start; a verbal agreement is not, because without it the work is unlawful under sections 43 and 66 of the Information Technology Act, 2000.
| Phase | Credentials required | Typical duration | Cost band (ex-GST) |
|---|---|---|---|
| External perimeter and asset mapping | None | 2-4 working days | Rs 40,000 - 80,000 |
| Unauthenticated web application test | None | 3-5 working days | Rs 45,000 - 1,00,000 |
| API and cloud exposure review | None | 3-5 working days | Rs 50,000 - 1,20,000 |
| Leaked credential and takeover review | None | 1-2 working days | Included in above |
| Authenticated testing with test roles | Test accounts only | 5-8 working days | Rs 1,20,000 - 3,50,000 |
| Retest after remediation | None, or test accounts | 2-4 working days | Included as standard |
What are the frequently asked questions?
Get a straight answer on this
Email hello@aavetech.com with your domains, IP ranges and application list, and we will return a no-credentials external scope, a fixed price and a start date within one working day.
Send us the details See pricing