Penetration testing
Internal Network Penetration Testing
We assume the perimeter already failed, then find out how far that gets someone inside your network.
Engagements from $5,000 CAD. Free scoping, a fixed price in writing before any work begins, and a written closeout. A retest is scoped separately when required.
At a glance
Is this the right test?
- Best when
- You want to know what one phished credential or one compromised laptop is worth to an attacker.
- Covers
- Active Directory attack paths, credential harvesting, lateral movement, segmentation and host configuration.
- You learn
- Whether a route from an ordinary foothold to domain privilege exists, how far it was demonstrated, and the changes that break it.
Before we start
What we need from you
Scoping settles the details. These are the things that usually decide whether testing can start on the agreed date.
- The starting position: a domain-joined laptop, a standard user account, a VPN account, or a network drop.
- The sensitive systems and the stopping conditions, such as "do not authenticate to the finance share".
- Remote or on-site access arrangements.
- Where detection observations are wanted, access to the logs or a session with whoever runs them.
Deliverables
What lands in your inbox
- Executive summary
A plain-language account of how far an intruder gets and what that would mean for the business, written for a non-technical reader.
- Overall security grade
A single grade derived from the most severe confirmed finding, using the thresholds set out in the report.
- Attack path narrative
The route from starting position to highest access reached, step by step, with the break points marked.
- Detailed technical findings
Every finding with CVSS vector, CWE classification, affected hosts and reproduction steps.
- Detection observations
Which actions should have generated alerts and, where you give us access to the logs, which ones did, so gaps in visibility are addressed alongside the findings.
- Remediation recommendations
The changes that break each attack path, ranked by how much of the path each one removes, written for the people who run the domain.
A retest is not included as standard for this service. When required, it is scoped separately, with timing and any fees agreed in advance. In a combined engagement, the included round covers the other services' findings.
See a redacted excerpt from a real finding, and what the full report adds.
Why it matters
What this protects you from
-
Plan for the perimeter failing
One phished credential or one unpatched host can be enough to get inside. The question that matters is what happens next.
-
Flat networks turn incidents into disasters
Segmentation that exists on a diagram but not in the firewall rules is how one workstation becomes every workstation.
-
Active Directory is the real prize
Domain privilege is what an intruder works toward. The paths there are usually configuration, not exploits.
-
Insider risk is the same attack surface
A contractor with ordinary access and a compromised laptop look identical from the network's point of view.
Coverage
What we test
-
Active Directory attack paths
Kerberos abuse, delegation misconfiguration, ACL weaknesses and privilege relationships that lead toward domain compromise.
-
Credential exposure and harvesting
Credentials in shares, scripts and Group Policy, plus in-memory credential exposure on reachable hosts.
-
Lateral movement
How far a single compromised account or host reaches, and which controls actually stop it rather than log it.
-
Network segmentation
Whether declared boundaries between user, server, management and sensitive environments hold when tested directly.
-
Host and service configuration
Patch levels, weak service configuration, legacy protocols and unnecessary local privilege on reachable systems.
-
Detection and response opportunities
Which of our actions generated telemetry, so you learn where visibility exists and where it does not.
Approach
Three ways to run it
-
Assumed breach
We start with standard user credentials on a domain-joined host. The most realistic and most common starting point.
-
Unauthenticated internal
We start with network access only and no credentials, mirroring an unmanaged device plugged into your network.
-
White box
Credentials plus network documentation and Group Policy, so intended design can be compared against enforced reality.
Process
How the engagement runs
-
Scoping and authorisation
We agree environments, host ranges, credential starting points, exclusions and testing windows in writing before anything begins.
-
Internal discovery
Enumeration of reachable hosts, services, domains, shares and trust relationships from the agreed starting position.
-
Credential and privilege analysis
Identification of credential exposure, privilege relationships and misconfiguration that create paths toward higher access.
-
Lateral movement and escalation
Controlled movement along confirmed paths to establish genuine reach, stopping at the boundaries agreed during scoping.
-
Reporting and remediation
Findings written as attack paths rather than isolated issues and ranked by exploitability and business impact, so you can see which single fix breaks the whole chain.
-
Closeout
Access is revoked, temporary accounts and files are removed, evidence disposition is recorded, and findings are handed over with remediation owners. A retest is not included as standard; when required, it is scoped separately, with timing and any fees agreed in advance.
Standards
What we test against
- NIST SP 800-115
- The assessment structure follows the NIST technical guide, which is what procurement and audit teams expect referenced.
- OSSTMM
- Methodology discipline and scope control, which matters more internally, where the blast radius of a mistake is larger.
- MITRE ATT&CK
- Every technique used is mapped, so your defensive team can compare our activity against what their tooling detected.
- PTES
- Execution standard for post-exploitation and lateral movement, keeping the work systematic rather than opportunistic.