External perimeter
Every internet-facing host in scope: exposed services, remote access, edge devices, VPN concentrators and the staging environment that was never supposed to be public.
Infrastructure Security
Network testing for the estate you actually have.
Every network we test contains something nobody knew was there. A forgotten test server, a management interface exposed to the internet, a device somebody plugged in during a project three years ago. We find those first.
226,392Version-to-CVE mappings
1,662Known-exploited flaws tracked
CISBenchmark scoring
ADPrivilege path analysis
External, internal, and the gap between them
An external test asks a simple question: what can somebody reach from the internet, and what can they do with it? It is the test everybody buys first, and it is the right place to start, because the perimeter is where opportunistic attacks land. Exposed remote access, unpatched edge devices, management consoles that were never meant to be public, and services still running default credentials.
An internal test asks the harder question: assuming somebody gets in — through a phishing email, a contractor laptop, a compromised vendor — how far do they get? In most organisations the honest answer is "everywhere, in about four hours". Flat networks, shared local administrator passwords, over-permissioned service accounts and an Active Directory that has accumulated fifteen years of exceptions.
The credentialed part is what separates a useful assessment from a port scan. With read-only credentials we can audit patch state and configuration precisely rather than inferring it from banners — matching against a 226,392-row version-to-CVE index and escalating anything on the known-exploited list immediately, regardless of what its CVSS score says.
Coverage
What we test
Scoped by network range and agreed in writing. Most clients start externally and add internal testing once they have seen the first report.
Patch and configuration state
Credentialed audit of operating systems, services and firmware against vendor advisories and current vulnerability intelligence.
Authentication weaknesses
Default and reused credentials, weak protocols, missing multi-factor on remote access, and cleartext services still carrying passwords.
Active Directory
Privilege escalation paths, delegation misconfiguration, credential exposure, Kerberos weaknesses and the service accounts with domain admin nobody can explain.
Segmentation and lateral movement
Whether the boundaries you believe exist actually hold — office to server, IT to OT, production to development, guest to corporate.
Network services and infrastructure
File shares, databases, hypervisors, backup systems, printers and management interfaces, in roughly that order of how often they turn out to matter.
Wireless
Corporate and guest network separation, authentication strength and rogue access point exposure, where wireless is in scope.
Host hardening
CIS and STIG benchmark scoring per host, producing a real pass/fail figure rather than an opinion.
Approach
How a network test runs
A perimeter of under 50 hosts is usually a week. Internal engagements depend on the size of the estate and are scoped precisely before we start.
-
01 · Scope and authorise
Ranges, exclusions, testing windows and escalation contacts, with written authorisation. Anything you own but did not list, we will ask about rather than assume.
-
02 · Discover
Live host and service identification across the agreed ranges. This is where the assets nobody remembers surface.
-
03 · Assess
Version and configuration analysis against current vulnerability intelligence, with credentialed checks where credentials are provided.
-
04 · Exploit and verify
Confirmed exploitation of what is genuinely reachable, with impact established. Anything critical is escalated to you the same day.
-
05 · Move laterally
For internal engagements: how far a foothold travels, what it reaches, and where the segmentation actually stops it.
-
06 · Report and retest
Ranked findings by host and by network, with a free retest cycle.
Run against recognised standards
- NIST SP 800-115Technical assessment methodology
- PTESExecution standard
- MITRE ATT&CKTechnique mapping for internal engagements
- CIS BenchmarksHost configuration scoring
- ISO 27001 Annex AControl mapping
Deliverables
What you actually receive.
The report is the product. If it cannot be acted on by a developer and understood by a director, we have not finished.
Asset inventory
What is actually live in the ranges you gave us — frequently the most valuable page in the report.
Findings by host and network
Ranked by exploitability and business impact, with affected versions named precisely.
Benchmark scores
CIS or STIG pass/fail per host where credentialed access was available.
Attack path narrative
For internal tests: the route from foothold to domain compromise, step by step, so you can see which single change breaks the chain.
Free retest and closure summary
Verification once fixes are applied.
Is this for you?
Talk to us if any of these are true.
If none of them are, say so on the call and we will tell you honestly whether this is the right piece of work — or point you at the one that is.
Book a scoping call- You have never had an independent external test, or the last one is more than a year old.
- You are ISO 27001 certified or working towards it and need infrastructure testing evidence.
- You have acquired a company and inherited an estate you cannot describe.
- Your office and production networks are connected and nobody is quite sure how tightly.
- You run manufacturing or utilities and IT and OT share a flat network.
How we work
Six steps, and no surprises.
The same engagement model applies to every piece of work we take on, so you always know what happens next.
01
Scope
A 30-minute call, then a written scope: what is in, what is out, what we need from you and what it costs. Nothing starts before you sign it.
02
Authorise
Rules of engagement, testing windows, escalation contacts and a signed authorisation. Out-of-hours windows where production cannot take the load.
03
Test
Automated coverage first, then manual testing where judgement is required. Critical findings are reported the day we confirm them, not at the end.
04
Report
One report a developer can act on and an executive can read, with evidence, reproduction steps, business impact and a fix for every finding.
05
Remediate
A walkthrough call with your engineers. We answer questions on the fix, not just the finding.
06
Retest
A free retest cycle to confirm the fixes hold, and a clean summary you can hand to a customer, auditor or board.
Questions
Network Penetration Testing — answered.
The questions clients actually ask during scoping. If yours is not here, ask it directly.
What is the difference between external and internal network testing?
External testing is performed from the internet against your public-facing IP ranges — it answers what an attacker with no access can reach and exploit. Internal testing is performed from inside your network, usually from a device we connect or a virtual machine you host, and it answers what happens after somebody gets in through phishing, a stolen laptop or a compromised supplier. Both matter, and they find completely different things.
Do you need credentials for network testing?
Not for the external test, which is deliberately performed blind. For internal and host audits, read-only credentials make the assessment dramatically more accurate: instead of guessing patch levels from service banners, we can enumerate installed packages and hotfixes precisely and match them against vendor advisories. A credentialed audit typically finds several times more genuine issues than an uncredentialed one.
Will you attempt to exploit findings?
Yes — controlled exploitation is what separates a penetration test from a vulnerability scan, and it is the only way to prove that a theoretical finding is real. What we exclude by default is anything that risks availability or data integrity: denial of service, destructive exploits and high-volume automated activity. Those run only if you ask for them in writing.
What is an Active Directory assessment?
A focused review of your Windows domain: how privileges are delegated, which accounts can escalate to which, where credentials are exposed in memory or in group policy, and which service accounts hold far more privilege than their function requires. It is consistently the assessment that changes the most about how an internal network is administered, because the findings are usually structural rather than a list of missing patches.
Can you test OT or industrial networks?
Yes, with care and a different approach. Industrial control systems and legacy equipment often respond badly to active probing, so OT work is heavily weighted towards passive analysis, architecture review and segmentation testing at the IT/OT boundary. We agree exactly what is passive and what is active before anything runs, and we do not perform active testing on live control systems without your explicit written instruction.
How often should network testing be done?
Externally, at least annually and after any significant change to the perimeter — a new office, a migration, a new internet-facing service. Internally, annually is the norm for most organisations. Between tests, continuous external attack surface monitoring is the sensible complement, since your perimeter changes far more often than once a year.
Next step
Get a written scope and a fixed price.
A 30-minute call, then a scope document with what is in, what is out and what it costs. No obligation, and no charge for the conversation.