Cybersecurity
Network penetration testing
We test your network from two positions: as an outsider looking for a way in, and as someone already inside looking for a way to the data that matters.
The problem this service solves
Perimeter defenses have improved, so attackers often come in through a phished credential, an exposed service or a forgotten host. What happens after that depends on the inside of the network: flat segments, shared local administrator passwords, old protocols and over-privileged service accounts.
External testing shows what the internet can reach. Internal testing shows how far a single compromised machine could go. The two answer different questions, and most organizations need both.
What is in scope
-
External perimeter
Public IP ranges, VPN, remote desktop and gateway services, mail, DNS, exposed administration panels and default credentials.
-
Internal discovery
Host and service discovery, name resolution weaknesses, legacy protocols and shared-credential exposure.
-
Active Directory
Kerberos and NTLM weaknesses, delegation, ACL abuse, certificate services misconfiguration and paths to Domain Admin.
-
Segmentation
Verify that controls between network zones work as designed, including to production, OT and payment environments.
-
Wireless (optional)
Authentication strength, guest isolation and rogue access point exposure.
-
Endpoint exposure
Local privilege escalation, credential caching and security-tool coverage from the attacker’s view.
How the work runs
External
Start with what the internet sees.
-
1
Attack surface mapping
Confirm which addresses and services are in scope and in use.
-
2
Service testing
Check authentication, patch level, configuration and known exposures. Validate by hand.
Internal
Assume a foothold.
-
3
Foothold and enumeration
Begin from a standard user workstation or network port and map what is reachable.
-
4
Privilege escalation
Seek credentials and misconfigurations leading to higher access, within the rules agreed.
-
5
Lateral movement
Demonstrate movement between systems and zones, stopping at agreed boundaries.
Report
Lead with the attack path.
-
6
Attack path narrative
A step-by-step account of how access was gained and what it exposed.
-
7
Detection review
Which actions your tools noticed, and which they did not. Useful input for detection engineering.
-
8
Retest
Confirm fixes, especially for credential and segmentation issues.
What you receive
- Executive summary of the most important attack paths
- Technical findings with evidence
- Diagram of the path from foothold to objective
- List of what security tooling detected or missed
- Prioritized remediation plan
- Retest report
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Authorized IP ranges and domains, plus exclusions
- Contacts who can approve risky actions during the window
- For internal: a workstation image or network access, and a standard user account
- Notes on fragile systems such as legacy or operational technology
What this service is not
- A vulnerability scan (that is a separate, broader service)
- A denial-of-service exercise
- Testing of systems you do not own or cannot authorize
What changes afterwards
- You know whether a stolen standard-user credential can lead to administrative control
- Segmentation is verified instead of assumed
- Quick wins such as shared local administrator passwords are fixed first
Questions people ask
Do you test with the security tools turned off?
We prefer to test with your tools on, so the result shows what is stopped and what is not. For specific exercises we can coordinate exceptions with your team.
What if you reach Domain Admin?
We stop at the agreed boundary, document the path and tell you immediately for any critical access. We do not use that access beyond the demonstrated impact.
How do you handle fragile or legacy systems?
Flag them during scoping. We either exclude them or limit testing to non-intrusive checks.
Related
-
Active Directory security
Find attack paths to domain control: delegation, ACLs, Kerberos, certificate services, legacy protocols and tiering.
-
Red teaming
Objective-based adversary simulation that tests people, process and technology together against a realistic attacker over several weeks.
-
External attack surface management
Discover and monitor the domains, services, cloud assets and exposed credentials that make up what the internet can see of your organization.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response