Question: We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?

Answer: 
Top l0 list of Vulnerability scanners: http:// sectools.org/vuln-scanners.html

There's also Microsoft's Baseline Security Analyzer which should be part of your base setup if its not already before you deploy a server to prod: http:// www.microsoft.com/downloads/details.aspx?familyid=F32921AF-9DBE-4DCE-889E-ECF997EB18E9&displaylang=en
Regardless of the technology you need to know the threats. You need to know what is the data that you are trying to protect? You need to know how your website works. Do a threat model first forgetting about these magical security bullet technology methods. You need to figure out where you are at before you spend wasteless money on a penetration test.

Matt Parsons
CISSP
mparsons1980 [at] gmail.com