Network Penetration Testing
Quoted on scope, fixed price. Includes the Vexil platform and a hand-verified retest.
Teams who have had us test their systems
- Selip & Stylianou, LLP
What this covers
Your network perimeter is bigger than you think. Forgotten dev servers, exposed RDP, unpatched VPN appliances, and misconfigured cloud security groups create an attack surface that grows with every sprint. One exposed service is all an attacker needs. We test from outside-in (external pen test) and inside-out (internal/assumed-breach). External testing maps every exposed service, tests for known exploits, and validates your firewall and WAF rules. Internal testing simulates an attacker who has already gained a foothold - we enumerate the network, map Active Directory attack paths, test segmentation controls, and find the shortest path to Domain Admin. Our testers are OSCP-certified and use the same tools and techniques as real threat actors - but with careful scoping, rate limiting, and a commitment to zero production impact.
- Know every exposed service on your external perimeter - not what you think is there
- Close the paths attackers use to move from initial access to Domain Admin
- Pass network security requirements in enterprise vendor assessments
- Sleep better knowing your internal network would survive a real intrusion attempt
Scope
What gets tested
Ten areas, agreed on the scoping call and written into the rules of engagement before anything starts.
External Penetration Testing
Full-port scan, service enumeration, vulnerability exploitation, firewall/WAF bypass, exposed cloud services.
Internal Penetration Testing
Network enumeration, service discovery, vulnerability scanning, privilege escalation, lateral movement.
Active Directory Assessment
BloodHound analysis, Kerberoasting, AS-REP roasting, GPO abuse, AD CS attack paths, credential harvesting.
Network Segmentation Testing
Cross-VLAN access, firewall rule validation, jump host bypass, production/development isolation.
VPN & Remote Access
VPN configuration audit, MFA bypass testing, split-tunneling validation, client-side attack surface.
Wireless Security
Wi-Fi encryption audit, evil twin detection, WPA3 validation, guest network isolation, rogue AP hunting.
Network Device Config Review
Router, switch, firewall configuration - ACL evaluation, SNMP security, management plane exposure.
Known CVE Exploitation
Unpatched services, default credentials, exposed management interfaces, vulnerable firmware.
PTES & OSSTMM Aligned
Penetration Testing Execution Standard and Open Source Security Testing Methodology Manual.
MITRE ATT&CK Mapped
All findings mapped to adversary tactics and techniques for SOC and detection engineering.
Why a scan is not a test
What a scanner misses here
For part of it. But a scanner reports what is exposed, not what an attacker does next with it - a reused password, an account nobody reviewed, a route from one host to the next.
Vulnerability scanner
Finds what is there
- Open ports and running services
- Missing patches and known CVEs
- Default credentials
- Weak TLS and unsigned SMB
- Operating systems past end of support
Fast, and worth running.
Tester
Finds what is broken
- One weak password reused across the estate
- A service account with rights nobody reviewed
- A file share holding credentials for another host
- Kerberos delegation that ends at Domain Admin
- A flat network where a laptop reaches the database
This is where the real risk is.
We run both, in that order. Tool output is kept separate from what a tester wrote, so you always know which is which.
Book a Free ConsultationMethodology
How the work is done
Repeatable, documented, and tracked as coverage inside the platform so you can see what has been looked at.
- 01
Scope & Rules
Define IP ranges, excluded hosts, testing windows, and escalation contacts. Typically a 30-minute call to align expectations.
- 02
External Recon
Map every exposed service, version-fingerprint everything, check for known exploits, and validate firewall/WAF effectiveness.
- 03
Internal Exploit
Start with a standard user account, enumerate the network, map AD attack paths, exploit weaknesses, and find the path to Domain Admin.
- 04
Report & Debrief
Prioritized findings with exploitation evidence, network diagrams of attack paths, and a remediation roadmap. Live debrief included.
Why it matters
What you get out of it
External Perimeter Testing
Full port scan of your entire IP range, service fingerprinting, vulnerability scanning, and manual exploitation of every exposed service.
Internal / Assumed-Breach Testing
We start with a standard user account and find every privilege escalation path, unpatched internal service, and lateral movement opportunity.
Active Directory Attack Paths
BloodHound analysis, Kerberoasting, AS-REP roasting, GPO abuse, AD CS misconfigurations, and credential harvesting - the full attacker playbook.
Segmentation Validation
We test whether your network segments actually isolate critical systems - or whether a compromise in the dev VLAN gives access to production.
Cloud Network Review
AWS security groups, Azure NSGs, GCP firewall rules - we find the gaps between what you think is restricted and what actually is.
Wireless & Physical (Optional)
Wi-Fi security testing, rogue access point detection, and physical social engineering for organizations that need full-scope testing.
What you receive
Delivered in the platform as the work happens, and exportable as a document whenever you need one.
- External findings report - every exposed service, vulnerability, and exploitation result
- Internal findings report - privilege escalation paths, AD weaknesses, and lateral movement chains
- BloodHound/AD attack path map - visual diagram of every path to Domain Admin
- Segmentation test results - which VLANs can reach which, and where the gaps are
- Executive summary - 2-page risk overview for leadership and board
- Remediation roadmap - prioritized fix list with effort estimates
Standards we test against
Coverage is tracked against these inside the platform, so “what did you actually check” has an answer.
- PTES
- OSSTMM
- NIST SP 800-115
- CIS Controls
- MITRE ATT&CK
- ISO 27001
The anatomy of a finding
This is one finding.
Not a report. One finding, with every field it carries and why each field is there. Yours will look like this.
Vexil · Finding
Published- Titlewhat it is, in your engineers’ words
A service account password cracked offline gives Domain Admin.
- Affected assetthe account and the host, not “the network”
The account holds a service principal name and never rotates.
- [email protected]
- DC01.corp.local
- Severitycomputed from the vector, never chosen by hand
- high
- CVSS 3.1 · 8.8
- AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE-522
- Evidencethe request, the response and screenshots, attached to the finding
A standard domain user requested the ticket. The password recovered offline in four minutes.
- kerberos · RC4-HMAC ticket
- members of Domain Admins: svc_backup
- Impactwhat it costs you, not what the CVE says
One ordinary user account reaches every file, mailbox and database in the estate, without touching a single exploit.
- Remediationfor your stack, not “apply vendor patches”
Move it to a Group Managed Service Account so Windows rotates a long password automatically, and remove the service principal name if the account no longer needs one.
- Retesta tester’s verdict, not your self-assessment
Retest passed. Verified by hand, recorded with the date and the tester.
This is the format, not a client’s work - it is written against the demonstration environment we run for the purpose, and a real finding also carries screenshots of the issue alongside the request and response. We don’t publish client findings, redacted or otherwise. If you want to see a real one, email us and we’ll send a redacted sample.
Pricing
What changes the price
Every engagement is quoted on scope rather than hours. These are the four things that move it, and they are what we work through on the call.
Live hosts
How many actually respond
Position
External, internal or both
Active Directory
Domains and forests
Segmentation
How many zones to prove
Delivered on the Vexil platform
Every host and service we found is listed with the findings against it, so you get an inventory of what is exposed as well as what is wrong with it.
See the platformFAQ
Questions about network penetration testing
What's the difference between external and internal network testing?
External testing simulates an attacker on the internet trying to break in - we scan your public IPs, find exposed services, and try to exploit them. Internal testing simulates an attacker who already has a foothold (e.g., a compromised employee laptop or a phishing victim). We start with standard user access and try to escalate to Domain Admin. Both are usually needed for a complete picture, because they answer different questions.
Do you need to be on-site, or can you test remotely?
External testing is always remote. Internal testing can be done remotely via a VPN appliance or jump host we provide, or we can ship a pre-configured testing device you plug into your network. On-site testing is available for organizations that need physical/wireless testing or have air-gapped networks.
Will network testing cause downtime or trigger our IDS/IPS?
We use rate-limited, non-destructive techniques and schedule tests during agreed windows. We may trigger your IDS/IPS (which is actually a useful finding - it tells you whether your detection works), but we brief your SOC team beforehand so an alert is recognised rather than escalated.
We're mostly cloud-native - do we still need network testing?
Yes. Cloud environments have networks too - security groups, VPC peering, load balancer configurations, and exposed cloud services. Our cloud network review covers all of these. We also test whether your cloud-to-on-premise connections (VPN, Direct Connect) create bridges an attacker could exploit. Cloud-native doesn't mean network-risk-free.
What if we don't use Active Directory?
We still test your internal network - just without the AD-specific attack paths. We focus on network segmentation, exposed internal services, default credentials on appliances, unpatched systems, and the paths an attacker could use to move laterally. If you use Okta, JumpCloud, or another IdP, we test those integrations too.
How often should we have a network penetration test?
At least annually for compliance (PCI-DSS, SOC 2, ISO 27001). Quarterly or after major infrastructure changes for security-conscious teams. If you're going through a fundraise, enterprise sales cycle, or compliance audit, get one before - the report is one of the most-requested documents in due diligence.
Scope your network penetration testing engagement.
Thirty minutes on a call and you have a fixed price, a testing date and a walkthrough of the platform against your own scope.