Internal & external network pentest
Find what is exposed on the internet and how far an attacker gets once inside, including Active Directory attack paths.
- Typical length
- 3–10 testing days
- Approach
- Remote, via VPN or a test device
- Price
- Quoted after scoping
What we test
- Exposed services and vulnerable versions
- Active Directory privilege escalation
- Credential reuse and weak passwords
- Network segmentation testing
- Lateral movement
Standards we follow
- NIST SP 800-115
- PTES (Penetration Testing Execution Standard)
- MITRE ATT&CK
- CVSS 3.1 scoring
Issues we often find
Typical findings from this kind of test, written the way they appear in our reports.
- Outdated services exposed to the internet with public exploits
- A normal domain user can become Domain Admin
- The same local admin password is reused on many machines
- Guest Wi-Fi or office network can reach production servers
What we need from you
We send this checklist at kickoff so testing starts on day one.
- External IP ranges and domains in scope
- For internal tests: VPN access or a place to plug in a test device
- A standard domain user account for assumed-breach tests
- Systems that must not be touched
How the engagement runs
Scope
We agree on targets, test accounts, rules of engagement and testing windows. You get a fixed quote.
Recon
We map your attack surface: hosts, routes, roles, third-party services and data flows.
Exploit
Testers chain weaknesses the way a real attacker would and confirm impact without harming production.
Report
Findings are rated with CVSS 3.1, with proof, business impact and a clear fix for each one.
Retest
Once you have fixed an issue, we verify it and update its status in the report.
Attest
We issue a signed letter of attestation you can share with customers and auditors.
Get a fixed quote
Tell us what is in scope and we send a fixed quote, usually within one business day.