Internal / External Network Penetration Testing
Adversary emulation of your network perimeter (external) and your lateral-movement exposure (internal).
- Outcome
- Prove what a real attacker could reach.
- Timeline
- 4 phases1–2 weeks · 2 weeks · 2–3 weeks · 1–2 weeks
- Mapped to
- MITRENIST · OSSTMM
- Includes
- Readout + retestFixed criticals and highs re-verified.
Know before you book.
We test how far an attacker gets from the internet, and from inside your network, to the systems that matter most.
- You run offices, a data centre or an on-prem Active Directory
- You want to know what a compromised laptop could reach
- Your internet-facing estate has grown without a recent review
- An insurer or framework requires internal and external testing
- You just need a list of exposed weaknesses, not proven pathsVulnerability Assessment
- Your crown jewels live in a web applicationWeb Application Pen Testing
- External IP ranges and domains
- An internal foothold: VPN, test laptop or VM
- Systems that must not be disrupted, and testing windows
Still not sure? Take the 2-minute check
What you walk away with.
- Confirmed initial-access vectors from the open internet
- Full internal lateral-movement + privilege-escalation paths
- Domain-compromise / kingdom-key access paths, quantified
- Detection-engineering guidance for every TTP we used
What we cover
Agreed in writing before testing starts.
- External: every internet-facing IP, VPN, mail, remote-access, RDP/SSH exposure
- Internal: assumed-breach lateral movement from a starter foothold host
- Active Directory / Entra ID enumeration + escalation paths
- Kerberos / NTLM / LLMNR / mDNS abuse
- Cloud-hybrid scenarios (AWS/GCP/Azure identity boundaries)
- Payload delivery + evasion against your EDR
- Physical-security testing (available separately)
- Social engineering of employees (available separately)
- DoS testing of production infrastructure
How we run it.
- 01
External reconnaissance
Passive OSINT, TLS-fingerprint enumeration, exposed-service inventory. What's reachable from the internet right now?
- 02
Enumeration
Services, versions, and trust relationships across the perimeter and, on assumed breach, the internal estate.
- 03
Vulnerability Analysis
Exposure confirmed and prioritized; AI triage focuses operator time on what actually yields a foothold.
- 04
Exploitation — initial access
Public-facing exploitation, credential attacks, exposed-panel abuse. A foothold on documented evidence, never speculation.
- 05
Post-exploitation — lateral + domain
Assumed-breach from a starter host: enumerate the AD/Entra estate, escalate, pivot, and quantify kingdom-key access.
- 06
Report + detection guidance
Every TTP mapped to detections your SOC can build in Splunk, Sentinel, Datadog, or Elastic. Purple-team debrief included.
Technical detail.
The depth behind the engagement, for the engineer or CISO evaluating us.
- Perimeter and exposed-service discovery
- VPN, mail and remote-access testing
- Credential-based attack surface
- Assumed-breach from a standard user
- Active Directory attack paths
- Lateral movement and privilege escalation
- LLMNR/NBT-NS poisoning and relaying
- Kerberoasting and delegation abuse
- Mapped to MITRE ATT&CK
- Attack path from foothold to impact
- Hardening steps ranked by effort
- Detection guidance for each step
What lands in your inbox.
- External + Internal Pen Test Report (executive + technical)
- MITRE ATT&CK matrix mapping
- Attack-path graph (external → foothold → domain)
- Detection-engineering guide for your SIEM
- Purple-team debrief session with your SOC
Defensible under audit.
- MITRE
- NIST
- OSSTMM
From call to report.
- 01Scoping + ROE
1–2 weeks
- 02External testing
2 weeks
- 03Internal / assumed-breach
2–3 weeks
- 04Reporting
1–2 weeks
Asked before every engagement.
Can you do assumed-breach without a real employee?
Yes. We ship a hardened jump host that you place on your internal network, and we test from there. No employee credentials required.
Will you set off our EDR?
Some tests intentionally will (to measure detection). Some tests intentionally won't (to measure evasion). Both are documented in the ROE and reported.
Do you test hybrid cloud identity boundaries?
Yes. AD ↔ Entra ID sync abuse, cross-tenant guest paths, cloud-role escalation — all in scope for modern engagements.
Know your real perimeter.
60-minute scoping, engagement letter within a week, kickoff within two. Full report inside 8–10 weeks.