Network & Infrastructure
Penetration Testing
Find weaknesses in your internal or external network. We test agreed systems and show how an intruder could move between them.
Overview
From foothold to domain admin.
We test external-facing services, internal networks, and Active Directory — chaining misconfigurations, weak credentials, and privilege-escalation paths the way a real adversary would, then showing you how to break the chain. CVSS-scored, with a free retest within 60 days.
Coverage
What we test.
External perimeter and internal estate, including Active Directory attack chains.
- External perimeter & exposed services
- Internal network segmentation
- Active Directory attack chains
- Lateral movement & pivoting
- Privilege escalation
- Credential attacks & password policy
- Firewall & VPN configuration
- Patch & configuration weaknesses
FAQ
Network penetration testing FAQ
Scope, cost, and what happens next.
How much does a network penetration test cost?
Typically €2,500–6,000 depending on whether it is external or internal, the number of live hosts, and Active Directory scope. Use our estimator for a tailored figure.
What is the difference between external and internal penetration testing?
External testing assesses your internet-facing perimeter as a remote attacker. Internal testing simulates an attacker with a foothold — an insider or compromised device — focusing on lateral movement and privilege escalation.
How long does a network penetration test take?
Most take 4 to 10 working days of active testing plus reporting, depending on hosts and the size of the Active Directory environment.
Do you test Active Directory?
Yes — Kerberoasting, delegation abuse, ACL weaknesses, and lateral movement to domain compromise are a core part of internal testing.
What do we receive after the test?
A CVSS-scored report with reproduction steps and prioritised remediation, an executive summary, an attestation letter, and a free retest within 60 days.
What do you need to scope a network test?
IP ranges or hostnames in scope, whether it is external or internal, approximate host counts, and any Active Directory details for internal tests.
More questions about this service
How do you run an internal test remotely?
We ship a hardened testing device or deploy a secure virtual jump host on your network, so internal testing does not require us on-site.
Will testing disrupt our network?
We tune intensity to your environment and schedule any potentially disruptive checks; denial-of-service testing is excluded unless explicitly requested.
Do you test wireless networks?
Wireless can be added to an internal or on-site engagement; tell us during scoping and we will include it.
How does this support compliance?
Network testing helps satisfy ISO 27001, SOC 2, and PCI DSS expectations for regular technical testing.
Related services
Explore more.
Ready to test your network?
Tell us what you’re working on. We’ll help you work out the next step.
Book a short call Send an email