Home
Penetration testing
Network penetration testing

Network penetration testing that maps the path to domain admin

We test your perimeter, internal network and Active Directory the way an attacker would, then show you the one control that breaks each path.

Get a quote See a sample report

What a network test covers

01 · What we test

Infrastructure, Active Directory and segmentation

A network penetration test looks for the paths an attacker takes once they reach your network, from the perimeter through to domain admin.

External perimeter

Internet-facing hosts, VPNs, exposed admin interfaces and firewall rules

Internal network

Hosts, services, shares and trust relationships an attacker pivots through

Active Directory

Kerberoasting, credential reuse, misconfigured delegation and ACLs

Segmentation

Whether a breach in one zone can reach the next; PCI DSS segmentation testing

Scope your network test

02 · How an attack unfolds

From one foothold to domain admin

We don’t stop at a list of open ports. We show the chain an attacker would follow and where to break it.

Step 1

Foothold

A phished account, an exposed service or a weak password.

Step 2

Enumerate

Map users, hosts and Active Directory from inside.

Step 3

Escalate

Harvest credentials and abuse delegation or ACLs.

Step 4

Move laterally

Pivot across segments to reach high-value systems.

Step 5

Reach the goal

Domain admin, backups or the data that matters.

Each step is evidenced in the report, with the one control that would have stopped it. That is what turns a test into a remediation plan.

Map your attack paths

03 · A sample finding

What a network finding looks like

Redacted from a real engagement. Every finding carries proof, business impact and a fix in priority order.

Two-layer reportAn executive summary for the board and a technical section with proof for every finding.
Attack-path diagramsThe exact routes we took, so your team knows what to break first.
Free retestWe re-test the fixed findings and attest to the closure, included in the price.

Want the full sample report? Ask for it in the form and we’ll send it.

NET-07Sample finding · redacted

Kerberoasting yields a service account with domain admin rights

SeverityCritical

CVSS9.1

StandardMITRE T1558

Evidence

$ GetUserSPNs.py -request
[*] cracked: svc-sql:
$ whoami /groups → Domain Admins

Business impact

A single crackable service-account password gave full control of the domain, including backups and the SIEM.

Fix

Move to group-managed service accounts (gMSA), enforce 25+ character passwords on remaining SPNs, and alert on TGS requests.

Validated by hand, not a scanner guess.Retest: fixed

See what you’d get

Starting from€3,000

Priced on IP ranges, hosts and segments

An external network test for a mid-sized estate typically starts here. Internal, Active Directory and segmentation testing are scoped on top. See penetration testing pricing.

Get a fixed quote

05 · Questions

Network penetration testing FAQ

Get a quote

Deeper reading in our network testing guide.

How long does a network penetration test take?

A focused external test usually runs about one to two weeks of testing; a combined external, internal and Active Directory engagement runs two to four weeks. We confirm the window once we’ve scoped your IP ranges and hosts.

What’s the difference between external and internal network testing?

An external test works from the internet, like an outside attacker. An internal test assumes a breach has already happened and looks at how far an attacker spreads from inside. Most organisations need both.

Do you test Active Directory?

Yes. Active Directory is where most internal engagements end up, because it’s the fastest route to domain admin. We test for Kerberoasting, credential reuse, delegation abuse and dangerous ACLs, and map each path we find.

Will the test disrupt our network?

Testing runs within agreed windows and exploitation is safe and non-destructive. If we confirm a critical issue, such as a path to domain admin, we tell your contact straight away rather than waiting for the report.

Does PCI DSS require network penetration testing?

Yes. Requirement 11.4 calls for internal and external network tests at least every 12 months and after significant change, plus segmentation testing. See our PCI DSS penetration testing page.