Question: We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?

Answer: 
[McAfee Secure](http://www.mcafeesecure.com/us/) offers a pretty decent scanning service that will look at the web server, network, and the web site itself in an automated, on-demand way. Their scanner is certified for PCI scans, so it's pretty comprehensive.
Regardless of the technology you need to know the threats. You need to know what is the data that you are trying to protect? You need to know how your website works. Do a threat model first forgetting about these magical security bullet technology methods. You need to figure out where you are at before you spend wasteless money on a penetration test.

Matt Parsons
CISSP
mparsons1980 [at] gmail.com