Internal network penetration testing security assessment services

Internal Network Penetration Testing

When a breach happens, attackers move fast. Let's find out how far they'd get.

CREST-accredited internal penetration testing that simulates an attacker who has already gained initial access, and shows how far they could get through lateral movement and privilege escalation.
Get a Pentest Quote View Pricing
CREST member company, accredited for penetration testing CREST-accredited penetration testing Cyber Essentials certified
  • CREST-accredited
  • Consultant-led testing
  • Transparent pricing

Who Needs This

Who needs internal penetration testing?

Internal penetration testing simulates an attacker who has already gained access to your internal network, whether through a phishing email, a compromised VPN credential, or physical access.
Get an Internal Pentest

Organisations with on-premise infrastructure

Active Directory environments, file servers, and internal applications present significant lateral movement and privilege escalation opportunities that are only visible from inside the network.

Businesses with hybrid Microsoft Entra ID environments

Hybrid Microsoft Entra ID (formerly Azure AD) and on-premise environments introduce unique attack paths between cloud and on-prem resources. Misconfiguration at the seam is a frequent finding.

Post-breach validation and hardening

Following a security incident, internal testing validates whether the attack path has been closed and identifies residual weaknesses that may have been overlooked during remediation.

Compliance-driven internal security reviews

PCI DSS requires internal penetration testing of in-scope systems. ISO 27001 doesn't mandate penetration testing by name, but it is a common way to evidence Annex A control 8.8 (management of technical vulnerabilities).

What We Test

What does an internal pentest include?

Internal testing covers the full attack path from initial foothold to domain compromise, including Active Directory security, lateral movement, and access to critical assets.
01

Active Directory Security

Kerberoasting, AS-REP roasting, DCSync attacks, ACL abuse, and misconfigured delegation are assessed across the AD environment to map privilege escalation paths.
02

Lateral Movement

We identify paths between network segments, assess pass-the-hash and pass-the-ticket opportunities, and evaluate whether proper network segmentation is in place.
03

Privilege Escalation

Local and domain privilege escalation via unquoted service paths, weak file permissions, token impersonation, and misconfigured services.
04

Credential Exposure

Cleartext credentials in scripts, Group Policy Preferences, shared network drives, and poorly configured applications are commonly found and exploitable. For a dedicated analysis of your Active Directory password hashes, see our password auditing service.
05

Internal Web Applications

Internal applications often receive less security scrutiny than customer-facing systems. We assess authentication, authorisation, and vulnerabilities in internal tools and admin interfaces.
06

Network Architecture Review

We assess network segmentation effectiveness, firewall rules between zones, and whether sensitive systems are appropriately isolated from less-trusted network areas.

Assumed Breach Scenarios

Choosing the starting position

Internal testing starts from the position of an attacker who already has a foothold, and the starting position changes what the test tells you. We agree it with you during scoping, based on the access an attacker would most realistically gain and the internal risks you most want to understand.

Our article on assumed breach penetration testing explains when this approach is the right choice.

  • A standard domain user account

    The access gained from a successful phishing email or a stolen password. The usual starting point for testing Active Directory and the general IT network.

  • A workstation on the internal network

    An authenticated session on a user's machine, such as one infected through a malicious download, or a contractor's laptop that has been compromised.

  • A server in a specific network segment

    Access from a system in a particular zone or subnet, to test whether that segment can reach more sensitive ones.

  • A low-privilege account near the card data environment

    A limited account with access to a protected area, to test whether it can be escalated into cardholder data or other regulated systems.

  • A compromised internet-facing server

    If your main concern is what an attacker could do with a hijacked public-facing system, we start from that server rather than a workstation.

  • Agreed objectives

    We can judge the test against objectives you choose, such as domain administrator control, a sensitive file share or a protected network segment.

Our Pentest Methodology

How we approach internal penetration testing

01

Scoping & Rules of Engagement

We work with you to define the scope of testing, including assets, network segments, and rules of engagement. Clear scoping ensures we focus on the most critical areas while respecting operational constraints.
02

Reconnaissance & Mapping

Our testers perform active and passive reconnaissance to map the internal network, identify hosts, services, and potential attack paths. This includes AD enumeration, network scanning, and service fingerprinting.
03

Vulnerability Identification

We identify vulnerabilities through manual testing techniques including password spraying, Kerberoasting, misconfiguration analysis, and exploitation of known weaknesses in internal applications and services.
04

Exploitation & Post-Exploitation

Where safe and agreed in advance, we exploit vulnerabilities to demonstrate real-world risk. This includes lateral movement, privilege escalation, and access to sensitive data to validate the impact of findings.
05

Reporting & Debrief

Findings are documented in a clear report with technical details for remediation and an executive summary for decision-makers. We offer a debrief session to walk through findings and discuss next steps.

Pricing

From £3,150

for internal network penetration testing

Not sure where your network fits? A 30-minute scoping call is free and gets you a fixed written quote.

Book scoping call Request a quote

No obligation · Strictly confidential · Reply within one business day

Pricing Examples

Small office network
1 to 2 subnets, fewer than 20 servers, a single Active Directory domain, about 3 to 4 days
£3,150 - £4,200
Medium network
Several subnets and 20 to 50 servers in one Active Directory domain, about 4 to 5 days
£4,200 - £5,250
Large network
More than 50 servers, or a segmented network with a CDE or regulated zone in scope, about 5 to 8 days
£5,250 - £8,300
Complex multi-site enterprise
Several sites, or multiple Active Directory domains or forests
£8,300 - £13,100+

Indicative ranges only. Retesting is not included as standard and can be added as an option in your proposal.

Your exact price is confirmed after a short scoping conversation. See full service pricing.

Compare all our penetration testing services.

What's Included

  • Fixed-price proposal agreed before testing starts, excluding VAT
  • Typical testing time: 3 to 8 days, depending on hosts, network segments and the size of your Active Directory estate
  • Manual, consultant-led testing. Not automated scans
  • Delivered remotely over VPN or a testing appliance we ship to your site, or on-site where preferred, with travel charged in addition for on-site work
  • Report within 2 business days, with an executive summary, technical findings and an attack path narrative from initial access to maximum privilege
  • Debrief call with your team to talk through findings and risk
  • Exploitr platform access to track remediation, at no extra cost

Common Questions

Internal network penetration testing: frequently asked questions

Internal network penetration testing starts from £3,150 for a small office network, rising to £13,100+ for complex multi-site enterprise environments. The number of hosts, network segments and the size of your Active Directory estate are the main cost drivers.

Our penetration testing pricing guide compares costs across every service.

Internal network penetration testing simulates an attack from inside your network perimeter. We assess what an attacker could achieve once inside, including lateral movement, privilege escalation, and access to sensitive data.

To request an internal penetration testing quote, tell us about the size of your network and we'll reply within one business day to confirm your scope, then send a fixed-price proposal.

Yes, PCI DSS Requirement 11.4 explicitly requires internal penetration testing for all organisations with in-scope systems. It must be conducted at least annually and after significant changes to the environment.

External penetration testing simulates an attack from the internet, while internal testing assumes the attacker is already inside your network. See network penetration testing for the full comparison and how to choose.

Not necessarily. Internal testing can be conducted remotely via a VPN connection or a small testing appliance we ship to your site. On-site testing is also available where preferred, or where remote access isn't possible, with travel charged in addition to the fixed price and confirmed in your proposal.

Assumed breach (also known as "assumed compromise") testing starts from the position that an attacker already has a foothold, such as a low-privilege domain account, and focuses on what they can do from there: privilege escalation, lateral movement and Active Directory abuse.

It suits organisations that already have confidence in their external perimeter, and post-incident validation. See our article on assumed breach penetration testing for when it is the right choice and what to expect.

Not as standard. Focused retesting is included for remotely delivered web application, SaaS, API and external network engagements, but internal tests depend on network access and the size of the estate, so we quote retesting as an option in your proposal.

Findings can still be tracked in the Exploitr platform as you remediate them.

Internal network testing typically takes 3 to 8 days, depending on the size of the environment and what is in scope (for example, whether Wi-Fi testing or CIS build reviews are included). Reports are delivered within 2 business days of testing completion.

Ready to test your internal network security?

Our team will review your environment and provide a tailored testing proposal that fits your timeline and budget.
Get a Pentest Quote