Internal Infrastructure Testing
Internal infrastructure penetration testing that starts where most breaches do: one device on your network and no credentials. We find out how far that gets an attacker and what it would take to stop them.
What the Test Covers
An internal test assumes someone is already inside. A phishing email that landed, a compromised laptop, a contractor with more access than they need. The tester starts as an unauthenticated device on your network and works out what can be reached from there: servers, file shares, management interfaces, printers, the domain itself. Getting a foothold is the part you control least, because it usually comes down to one person clicking one link. What happens next is decided by your internal posture.
Active Directory Is Usually the Story
If you run Windows, an internal test is largely an Active Directory test, because that is where the path to everything else runs. The chain is depressingly consistent. Name resolution protocols that answer questions nobody asked. Those answers relayed to services that do not require signing. Credentials collected, then used to read the directory, which any user can do by design. Somewhere in it is the service account with a weak password, the nested group that quietly grants admin rights or the certificate template that lets any user request a certificate as anyone else. None of it needs an exploit. Every step uses the system as it was designed.
Configuration Beats Patching
Most organisations patch reasonably well now. The findings come from decisions nobody revisited. The account created for a migration years ago that still has domain admin. The share opened for one team and never closed. The same local administrator password on four hundred machines, which turns one compromised laptop into all of them. A flat network where reception can reach the finance servers. Segmentation is unglamorous work and it is the control that most reliably turns a total compromise into a contained incident.
What You Get From the Test
The Real Attack Path
Each step from an unauthenticated foothold to the domain shown in order, so you can see where a single fix breaks the chain.
Findings That Are Real
Every issue is confirmed by hand and rated on what it means in your environment rather than on a score from a database.
Fixes in Priority Order
Clear advice on what to change first. Most of it is configuration you already own rather than new products.
How the Test Runs
We agree the scope in writing first: the sites, the internal ranges and anything that must not be touched. The test runs on site or through a testing device we post to you, whichever you prefer. Travel is always included in the price. The tester starts with no credentials, maps the live hosts and services on each range and listens to what the network gives away. Every host is checked for weak configuration, missing patches and exposed management interfaces. Any credentials captured along the way are used to enumerate Active Directory and look for routes to higher privileges and other systems. Testing is designed not to disrupt your systems. Anything critical is reported the moment it is confirmed. Most internal tests take two to five days per site, depending on how many internal ranges are in scope.
At a Glance
Environment Survey
Live hosts, services and network traffic mapped across each internal range.
Vulnerability Identification
Insecure configuration, missing patches, weak credentials and exposed management interfaces.
Privilege Escalation
Captured credentials used to look for a route to higher privileges in the domain.
Lateral Movement
How far an attacker could pivot from one compromised machine to the rest.
Report & Retest
Risk rated findings with detailed remediation steps. Free retest included.
Findings appear in your client portal as we find them. Our day rate is published on the pricing page.
You May Also Be Interested In
Frequently Asked Questions
What does internal infrastructure penetration testing involve?
Internal infrastructure testing simulates an attacker who already has a foothold inside your network through a phishing email, a compromised device or a malicious insider. The tester starts with no credentials and looks for weak configuration, unpatched systems, exposed credentials and privilege escalation paths. On a Windows network most of the work centres on Active Directory, because that is where the route to everything else runs.
Do you need to be on site to perform the test?
Either works. On site testing pairs well with wireless testing, which usually adds a day while we are there. Travel is always included in the price. If you would rather not have a consultant on site, we post you a ready to use testing device that plugs into your network and gives the same coverage.
What is lateral movement and why does it matter?
Lateral movement is how an attacker gets from the first machine they compromise to the ones they want: domain controllers, file shares holding sensitive data, systems with higher privileges. Reused local administrator passwords, flat networks and credentials left behind on machines make it easy. Internal testing maps those routes so you can close them.
Is internal testing required for Cyber Essentials Plus?
No. The Cyber Essentials Plus assessor checks a sample of your devices for missing patches and insecure settings as part of their own audit. A penetration test is not part of it. An internal test goes much further, showing how an attacker on your network could move between systems. It also helps you fix problems before the assessor finds them. Clients, partners and cyber insurers increasingly ask for it in its own right.