Question: We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?

Answer: 
[McAfee Secure](http://www.mcafeesecure.com/us/) offers a pretty decent scanning service that will look at the web server, network, and the web site itself in an automated, on-demand way. Their scanner is certified for PCI scans, so it's pretty comprehensive.
There is a variety of public license tools out there at your disposal, however, where I operate, we use Firefox and Paros Proxy to manipulate posts and gets, WebInspect for application vulnerablity reporting, and QualysGuard Enterprise for a good old fashioned hosts scan. Depending on what the results are, we make adjustments to the configuration and security posture of the box, create risk acceptance forms for things we cannot change, or engage other tools to decide whether or not a finding is actually something to be worried about.