Internal Network Penetration Testing
When a breach happens, attackers move fast. Let's find out how far they'd get.
Who Needs This
Who needs internal penetration testing?
Internal penetration testing simulates an attacker who has already gained access to your internal network - whether through a phishing email, a compromised VPN credential, or physical access. It answers the question: if they get in, what can they do?
Organisations with on-premise infrastructure
Active Directory environments, file servers, and internal applications present significant lateral movement and privilege escalation opportunities that are only visible from inside the network.
Businesses with hybrid AD environments
Hybrid Azure AD and on-premise environments introduce unique attack paths between cloud and on-prem resources. Misconfiguration at the seam is a frequent finding.
Post-breach validation and hardening
Following a security incident, internal testing validates whether the attack path has been closed and identifies residual weaknesses that may have been overlooked during remediation.
Compliance-driven internal security reviews
PCI DSS Requirement 11.4 explicitly requires internal penetration testing for all organisations with in-scope systems. ISO 27001 and similar frameworks also expect evidence of internal security assurance.
What We Test
What does an internal pentest include?
Internal testing covers the full attack path from initial foothold to domain compromise, including Active Directory security, lateral movement, and access to critical assets.
Active Directory Security
Kerberoasting, AS-REP roasting, DCSync attacks, ACL abuse, and misconfigured delegation are assessed across the AD environment to map privilege escalation paths.
Lateral Movement
We identify paths between network segments, assess pass-the-hash and pass-the-ticket opportunities, and evaluate whether proper network segmentation is in place.
Privilege Escalation
Local and domain privilege escalation via unquoted service paths, weak file permissions, token impersonation, and misconfigured services.
Credential Exposure
Cleartext credentials in scripts, Group Policy Preferences, shared network drives, and poorly configured applications are commonly found and exploitable.
Internal Web Applications
Internal applications often receive less security scrutiny than customer-facing systems. We assess authentication, authorisation, and vulnerabilities in internal tools and admin interfaces.
Network Architecture Review
We assess network segmentation effectiveness, firewall rules between zones, and whether sensitive systems are appropriately isolated from less-trusted network areas.
Pricing
From £2,850
for internal network penetration testing
Not sure where your network fits? A 30-minute scoping call is free and gets you a fixed written quote.
No obligation · Strictly confidential · Quote within one business day
Pricing Examples
| Small office network (1-2 subnets, local servers) | £2,850 - £3,300 |
| Medium enterprise network (multiple subnets) | £3,800 - £4,200 |
| Large network (multiple subnets/zones) | £4,750 - £6,600 |
| Complex multi-site enterprise | £7,500+ |
What's Included
- Fixed-price proposal within one business day
- Manual, consultant-led testing. Not automated scans
- Report within 2 business days of testing completion
- Debrief call with your team to talk through findings and risk
- No obligation quote, all enquiries are fully confidential
Indicative ranges only. Your exact price is confirmed after a short scoping conversation - see full service pricing .
Our Pentest Methodology
How we approach internal penetration testing
Scoping & Rules of Engagement
We work with you to define the scope of testing, including assets, network segments, and rules of engagement . Clear scoping ensures we focus on the most critical areas while respecting operational constraints.
Reconnaissance & Mapping
Our testers perform active and passive reconnaissance to map the internal network, identify hosts, services, and potential attack paths. This includes AD enumeration, network scanning, and service fingerprinting.
Vulnerability Identification
We identify vulnerabilities through manual testing techniques including password spraying, Kerberoasting, misconfiguration analysis, and exploitation of known weaknesses in internal applications and services.
Exploitation & Post-Exploitation
Where safe and agreed in advance, we exploit vulnerabilities to demonstrate real-world risk. This includes lateral movement, privilege escalation, and access to sensitive data to validate the impact of findings.
Reporting & Debrief
Findings are documented in a clear report with technical details for remediation and an executive summary for decision-makers. We offer a debrief session to walk through findings and discuss next steps.
Key Deliverables
What's included in the assessment?
Every internal network penetration test is delivered as a defined set of outputs supporting both technical remediation and executive decision-making.
Executive Report
A non-technical summary of findings with risk ratings and recommendations suitable for board and senior management stakeholders.
Technical Report
Detailed findings with reproduction steps, severity scoring, remediation guidance, and mappings to CVE, CVSS, and MITRE ATT&CK where applicable.
Debrief Session
An offer of a debrief call to walk through findings, discuss remediation priorities, and answer questions from both technical and executive stakeholders.
Attack Path Narrative
A walkthrough of the attack chain from initial access to maximum privilege, showing precisely how findings chain together to produce real-world risk.
Attack Surface Center Access
Complimentary access to our Attack Surface Center ASM platform for live finding visibility, collaborative tracking, and remediation management.
Consultant-led Testing
All testing is consultant-led by in-house staff. Your consultant works with you from scoping through to debrief - nothing is outsourced or subcontracted.
Common Questions
Internal network penetration testing - frequently asked questions
Internal network penetration testing simulates an attack from inside your network perimeter. This could represent a malicious insider, a compromised employee account, or an attacker who has gained initial access through phishing or other means. We assess what an attacker could achieve once inside, including lateral movement, privilege escalation, and access to sensitive data.
Yes, PCI DSS Requirement 11.4 explicitly requires internal penetration testing for all organisations with in-scope systems. It must be conducted at least annually and after significant changes to the environment.
External testing simulates an attack from the internet, testing your perimeter defences. Internal testing assumes the attacker is already inside your network. Internal testing typically uncovers different vulnerabilities: weak domain credentials, misconfigured Active Directory, unpatched internal systems, and excessive file share permissions.
Not necessarily. Internal testing can be conducted remotely via a VPN connection or a small testing appliance we ship to your site. On-site testing is also available where preferred.
Assumed breach testing starts from the position that an attacker already has a foothold - a low-privilege domain account, for example - and focuses on what they can do from there. Rather than spending testing time on initial access, the assessment concentrates on post-compromise activity: privilege escalation, lateral movement, Active Directory abuse, and whether a limited starting position can lead to domain compromise or access to sensitive data.
This makes assumed breach a more efficient model for organisations that already have confidence in their external perimeter and want to understand what happens if an attacker gets through anyway. It is also well-suited to post-incident validation, where the goal is confirming that an attack path has been closed. See our article on assumed breach penetration testing for a full explanation of when it is the right choice and what to expect from the process.
Ready to test your internal network security?
Get a fixed-price quote within 24 hours. Our team will review your environment and provide a tailored testing proposal that fits your timeline and budget.