Home
Penetration testing
Internal penetration testing

Internal testing that shows what happens after a phishing click

An assumed-breach test: we start from a compromised account and show how far an attacker moves, and the smallest changes that stop the spread.

Get a quote See a sample report

What an internal test covers

01 · What we test

What happens after a phishing click

An internal test starts where a real incident starts: an attacker already has a foothold. We test how far they get, and what stops them.

Assumed breach

We start from a standard user account or a “compromised” laptop, the usual first step in ransomware

Lateral movement

Pivoting across hosts, shares and trust relationships to spread

Privilege escalation

Harvesting credentials and abusing Active Directory to reach domain admin

Impact

What an attacker reaches: file shares, databases, backups and your monitoring

Scope your internal test

02 · How it plays out

From a single laptop to the whole domain

This is the path ransomware follows. We walk it, document each step, and show the control that breaks it.

Step 1

Assumed breach

One phished user account, the realistic starting point.

Step 2

Enumerate

Map Active Directory, shares and trust from inside.

Step 3

Escalate

Harvest credentials, abuse delegation and ACLs.

Step 4

Spread

Move laterally to servers and admin workstations.

Step 5

Reach the goal

Backups, databases and the systems ransomware encrypts first.

The report shows how far we reached and the smallest set of changes that would have stopped us — tiering, credential hygiene, and segmentation.

Map your lateral movement

03 · A sample finding

What an internal finding looks like

Redacted from a real engagement. Proof, business impact and a fix.

Lateral-movement mapThe exact path we took from foothold to domain admin.
Two-layer reportBoard summary plus technical proof for each finding.
Free retestWe re-test the fixes and attest to closure, included.

Want the full sample report? Ask for it in the form and we’ll send it.

INT-05Sample finding · redacted

Local admin password reused across every workstation

SeverityCritical

CVSS8.4

StandardMITRE T1078

Evidence

dumped local hash from host-A →
pass-the-hash → host-B, host-C … domain-wide

Business impact

One shared local-admin password let us move from a single laptop to every workstation in minutes — the classic ransomware spread.

Fix

Deploy LAPS so every machine has a unique local-admin password, and tier administrative accounts so one host can’t reach the domain.

Reproduced across three subnets.Retest: fixed

See what you’d get

Starting from€4,000

Priced on network size and Active Directory

Internal testing starts here and scales with hosts, sites and the size of your Active Directory. Often combined with an external test. See penetration testing pricing.

Get a fixed quote

05 · Questions

Internal penetration testing FAQ

Get a quote

What is internal penetration testing?

It’s an assumed-breach test: we start with the access an attacker would have after a phishing click or a stolen laptop, then see how far we can move and what we can reach.

Why assume a breach instead of testing the perimeter?

Because perimeters fail. Phishing, stolen credentials and a lost laptop all put an attacker inside. An internal test answers the question that actually decides the damage: what happens next?

Do you test Active Directory?

Yes — it’s usually the centre of an internal test. We check for credential reuse, Kerberoasting, delegation abuse and dangerous ACLs, because they’re the fastest routes to domain admin.

How do you run the test safely?

We agree the scope and rules of engagement up front, run within windows, and keep exploitation non-destructive. If we confirm a path to domain admin, we tell your contact immediately.

How is this different from an external test?

An external test asks what an outsider can reach. An internal test assumes they’re already in. Together they cover the full picture, which is why they’re often scoped as one engagement.