An outside-in assessment at SHELL-AFFECT is CASP: a passive view of the externally visible attack surface, only after domain authorisation, with analyst accountability and a signed report. Orientation for leaders and IT before budget flows into active testing or unclear tool waves.
Scope: 1 primary domain + 2 subdomains, goal “board-ready outside-in clarity in 12 days”. DNS-TXT on day 0, 45-minute kickoff, CASP Lite, report review with IT and leadership. Deliverable: prioritised list of what should be fixed before a planned app pentest in Q3. Pentest remains a separate offer. Figures and names are anonymised; the flow matches typical engagements. Decision criteria stay explicit.
Outside-in assessment here is CASP: authorised, passive, reported. It prepares active tests or deliberately replaces them when the goal is exposure clarity only — never as a silent pentest.
This page’s job: Owns engagement and kickoff (how outside-in CASP runs). Surface picture lives on attack-surface; comparisons on vs-pentest/vs-scan.
What you can roughly expect (Lite-oriented):
DNS-TXT, final scope, contacts.
Passive outside-in work in scope.
Business context + visibility + actionability.
Signed deliverable, not raw-dump-only handoff.
Walkthrough and next steps.
Internal hardening, audit, or pentest — new scopes.
Teams jump into pentests or tool waves without knowing which assets are even in the outside-in picture. That creates scope creep, surprises, and reports nobody can prioritise with confidence.
Before the first or next pentest, after M&A domain chaos, or when scanner output overwhelms the organisation.
Outside-in should create orientation before expensive active tests. Many offers are relabelled scans. We deliver authorised CASP with a report and clearly state it does not automatically replace a pentest.
Outside-in sharpens scope — it does not automatically replace RoE and active validation.
No start without authorisation — not even “informally”.
A map and priority, not only raw technical dumps.
Lite/Full and optional follow-ons — no forced maximum package.
Typical boundaries:
Authorised outside-in assessment (CASP) with signed report
Advice on whether a later pentest makes sense
Clear domain and goal definition before start
Active attacks in the outside-in scope
Unauthorised OSINT against third parties
Blanket “you are secure after this” claims
If you want orientation before a large test budget: scope meeting. If you want a mixed do-everything scan without limits, we are not the fit.
Method boundaries first — no mixed CASP/pentest theatre.
Shared outside-in map before active investment.
DNS-TXT, passive method, report, clear limits.
Weeks, not quarters of tool rollout.
Approval and review sessions.
Better targets for later active tests.
One language for tech and leadership.
Audit/pentest only when useful.
Lite or Full depending on domain breadth.
Authorisation before work.
Handoff with priority.
Link to active path when needed.
What decision should this enable?
Prove authorisation.
Passive profiling.
Priority and next steps.
No. Structured authorised profiling with a report — not arbitrary doxxing.
No. Often prioritisation and hardening are enough; active testing is optional.
CASP Lite € 7,500, Full € 19,900 as public orientation.
Contact with goal and domains.
At SHELL-AFFECT yes: CASP is our outside-in assessment product. Others often mean only a scan.
Lite for focused primary-domain baseline; Full for more domains/depth. Price orientation: Lite € 7,500, Full € 19,900.
External attack surface is what attackers and scanners can see without insider access. SHELL-AFFECT analyses it as CASP: passive, only with domain authorisation, with a signed report and prioritisation — so you know what matters first.
Open topic →Without verifiable domain authorisation, SHELL-AFFECT does not start CASP. DNS-TXT verification ensures only owned or written-approved domains are viewed outside-in — for trust, scope, and clear responsibility before any passive security analysis begins in a DACH context.
Open topic →CASP and penetration testing are often mixed — that wastes budget. We separate them: CASP is passive outside-in profiling with authorisation; a pentest is active, approved scope with RoE and PoCs. So you know what is worth doing first.
Open topic →Share goal and domains briefly — we reply with a scope proposal.