Internal Network Penetration Testing
Most breaches don’t start with a zero-day. They start with a misconfigured service account, an unpatched domain controller, or a flat network that lets attackers walk from one VLAN to another without friction. Our internal network penetration test puts a certified ethical hacker inside your environment, before a real attacker gets there.
We simulate the full attack chain: initial foothold to Domain Admin, with documented evidence at every step.
Engagements start from $7,500. Scope depends on host count, AD complexity, segmentation model, and testing windows.
What We Test: Active Directory, Lateral Movement, and Segmentation
Internal network testing isn’t running a vulnerability scanner against your hosts. We focus on the attack paths that matter most, the ones that lead from a compromised user account to your domain controllers, backup systems, and sensitive data stores.
Active Directory attack surface
- Kerberoastable service accounts; accounts with SPNs set on standard user objects, where the Kerberos ticket can be extracted and cracked offline without any interaction with the target
- AS-REP roastable accounts; accounts with pre-authentication disabled, exposing their hash without valid credentials on the attacker’s side
- Pass-the-Hash and Pass-the-Ticket opportunities, including NTLM relay across SMB and LDAP
- Unconstrained and constrained Kerberos delegation misconfigurations
- AD CS (Active Directory Certificate Services) template abuse, including ESC1 and ESC8 attack paths
- ACL abuse; GenericAll, WriteDACL, and GenericWrite permissions on high-value objects
- GPO misconfigurations that allow low-privileged users to modify Group Policy Objects
- Trust relationship exploitation across domains and forests
Lateral movement and privilege escalation
- Local administrator credential reuse across workstations and servers
- LLMNR and NBT-NS poisoning to capture credentials passively
- SMB relay attacks on networks where signing is not enforced
- WMI, PSExec, and WinRM-based pivot attempts after credential capture
- Identification of over-privileged service accounts and shadow admin paths
Segmentation and insider-threat simulation
- VLAN-to-VLAN reachability testing to verify firewall and ACL policies hold under attack
- Workstation-to-server communication paths that bypass intended segmentation
- Simulation of a malicious insider with standard domain user credentials: how far can they go?
Attack Scenarios We Simulate in Real Engagements
Scenario 1: Service Account to Domain Admin via Kerberoasting
A low-privileged domain user requests a Kerberos ticket for a SQL service account with a weak password. The ticket is captured and cracked offline in minutes. That service account has local admin rights on 14 servers. One of those servers has a cached Domain Admin token in memory. From standard user to Domain Admin, no exploits required.
Scenario 2: NTLM Relay on an Unsigned Network
SMB signing is disabled on 60% of workstations. Our tester poisons LLMNR broadcasts, captures NTLMv2 hashes from an IT admin’s machine, and relays the authentication directly to a file server, gaining access without ever cracking a password.
Scenario 3: Flat Network, Ransomware-Ready
Finance, HR, and engineering workstations share the same subnet. Once one machine is compromised, there’s nothing stopping lateral spread. We map every reachable host, document the blast radius, and show exactly what a ransomware operator’s first 30 minutes would look like inside your environment.
Scenario 4: AS-REP Roasting Without Credentials
Pre-authentication is disabled on three user accounts. Without a single valid credential, our tester requests encrypted AS-REP responses and cracks them offline. One of those accounts belongs to a help desk admin with write access to OU objects, a clear path to domain escalation.
These aren’t hypothetical. They’re attack chains we find, and document, in real engagements.
Our Methodology
We operate from an assume-breach model: starting from the position of a threat actor already inside your network, either with a domain user account (grey-box) or from a raw internal IP (black-box). Reconnaissance is manual and tool-assisted, using BloodHound to map privilege paths, CrackMapExec to enumerate accessible hosts, and Impacket for credential attacks. Exploitation is controlled and non-destructive, we validate a finding once, document it with evidence, and move on rather than running automated scanners that flood your network or destabilize hosts. Every technique is pre-approved in a signed rules-of-engagement document before testing begins.
Compliance: What This Engagement Satisfies
Internal network penetration testing is a direct requirement, not a recommendation, across major compliance frameworks.
SOC 2 Type II
CC6.1 and CC7.1 require testing of logical access controls and network security. An internal pentest with documented attack paths and evidence provides the auditor artifacts your trust report needs. See our SOC 2 Risk Assessment services for readiness support.
ISO 27001 (Annex A.12.6, A.9.4)
Requires technical vulnerability management and access control testing. Our report maps findings directly to Annex A controls. We hold the ISO/IEC 27001 Information Security Associate™ certification and work within the framework on every applicable engagement. Details on our ISO 27001 Risk Assessment services.
PCI DSS v4.0 (Req. 11.4)
Internal penetration testing is mandatory for any organization storing or processing cardholder data. Segmentation testing — verifying that CDE and non-CDE environments cannot communicate — is included in our standard scope. See our PCI DSS Readiness services for context on what auditors expect.
HIPAA
The Security Rule requires covered entities to evaluate access controls and transmission security. An internal pentest covering AD, credential exposure, and segmentation directly supports your Risk Analysis documentation.
View our transparent pricing structure to understand which package aligns with your compliance deadline and environment size.
Deliverables
Every engagement produces a report built for two audiences: your security team and your board.
Technical report includes:
- Executive summary with business-impact risk ratings — not just CVSS scores
- Detailed attack narratives for every exploited path, with screenshots and proof-of-concept evidence
- AD-specific findings: misconfigured accounts, dangerous ACL edges, delegation flaws, and GPO weaknesses
- Network segmentation validation results with host-to-host reachability documentation
- Prioritized remediation steps, ordered by exploitability and blast radius
Supporting deliverables:
- Raw BloodHound data export (on request) so your team can explore the attack graph independently
- Risk register-ready findings in tabular format
- Remediation verification checklist for your IT team
Download a sample report to see the format and depth before you commit.
Retest Included
Once your team has addressed the findings, we retest every vulnerability we documented. We don’t just take your word for it, we run the same attack paths again and confirm the fix held. The retest is included within an agreed window (one cycle for Professional engagements, two for Enterprise). You receive a retest attestation letter suitable for auditor submission.
Frequently Asked Questions (FAQs)
Find Out Exactly How Far an Attacker Would Get in Your Network
Share your internal network scope — host count, AD presence, segmentation model, and we’ll return a fixed-price quote and proposed timeline within 24 hours. No vague estimates. No sales cycle.