Network Penetration Testing

What the engagement covers

Internal and external testing across wired and wireless infrastructure.

• External perimeter

  Internet-facing hosts, services, and remote access paths, tested from an unauthenticated position to establish what is reachable and what can be exploited from outside the network.

• Internal network

  Testing from a position inside the network, covering segmentation, host hardening, service configuration, and the paths available for lateral movement between segments.

• Active Directory and identity

  Domain configuration, privilege relationships, delegation, and credential handling, assessed for the paths that lead from a standard account to domain-level control.

• Wireless infrastructure

  Wireless networks and their authentication, covering separation between guest and corporate access, encryption configuration, and client-side exposure.

• Credential and secret exposure

  Credentials and keys recoverable from file shares, service configuration, and host artefacts, and the access each one grants once recovered.

What you receive

Written so findings can be assigned directly to the teams that will act on them.

• Technical findings report

  Every finding with its severity rating, the affected hosts, reproduction steps, and remediation guidance, written so items can be assigned directly to engineering teams.

• Attack path narrative

  The routes taken through the environment, from first access to the furthest point reached, showing which control failures combined to make each path possible.

• Remediation priority list

  Findings ordered by exploitability and impact rather than by scanner score, so the work that closes the most exposure is scheduled first.

Frequently asked questions

What is the difference between a network penetration test and a vulnerability scan?

A vulnerability scan matches hosts and services against a database of known issues and reports what it recognises. A network penetration test adds manual exploitation: an engineer confirms which findings are genuinely reachable and exploitable in your environment, chains them where they combine, and establishes how far an initial foothold extends. The result separates real exposure from scanner noise.

Do you test from inside the network as well as from outside?

Yes. Testing runs from both positions. External testing establishes what is reachable and exploitable from the internet. Internal testing starts from a position inside the network and covers segmentation, host hardening, service configuration, and the paths available for lateral movement. Either can be scoped on its own if that is what the engagement calls for.

Will penetration testing disrupt our production systems?

Testing windows, target ranges, and rules of engagement are agreed in writing before any testing begins, and techniques likely to affect availability are excluded unless you place them in scope. Engagements are delivered remotely by default, with on-site work available where the scope calls for it.