Internal Network Penetration Testing

When a breach happens, attackers move fast. Let's find out how far they'd get.

Get assurance of your security posture, and identify risks to privilege escalation and lateral movement by simulating an attacker who has already gained initial access.
Get a Pentest Quote View Pricing

Accreditations and memberships

Cyber Essentials certified Our organisation supports the CREST AI Charter and CREST AI Principles, helping shape responsible AI adoption across the cybersecurity profession. UK Cyber Security Council member
Internal network penetration testing security assessment services

Who Needs This

Who needs internal penetration testing?

Internal penetration testing simulates an attacker who has already gained access to your internal network. Whether through a phishing email, a compromised VPN credential, or physical access.
Get an Internal Pentest

Organisations with on-premise infrastructure

Active Directory environments, file servers, and internal applications present significant lateral movement and privilege escalation opportunities that are only visible from inside the network.

Businesses with hybrid AD environments

Hybrid Azure AD and on-premise environments introduce unique attack paths between cloud and on-prem resources. Misconfiguration at the seam is a frequent finding.

Post-breach validation and hardening

Following a security incident, internal testing validates whether the attack path has been closed and identifies residual weaknesses that may have been overlooked during remediation.

Compliance-driven internal security reviews

PCI DSS Requirement 11.4 explicitly requires internal penetration testing for all organisations with in-scope systems. ISO 27001 and similar frameworks also expect evidence of internal security assurance.

What We Test

What does an internal pentest include?

Internal testing covers the full attack path from initial foothold to domain compromise, including Active Directory security, lateral movement, and access to critical assets.
01

Active Directory Security

Kerberoasting, AS-REP roasting, DCSync attacks, ACL abuse, and misconfigured delegation are assessed across the AD environment to map privilege escalation paths.
02

Lateral Movement

We identify paths between network segments, assess pass-the-hash and pass-the-ticket opportunities, and evaluate whether proper network segmentation is in place.
03

Privilege Escalation

Local and domain privilege escalation via unquoted service paths, weak file permissions, token impersonation, and misconfigured services.
04

Credential Exposure

Cleartext credentials in scripts, Group Policy Preferences, shared network drives, and poorly configured applications are commonly found and exploitable. For a dedicated analysis of your Active Directory password hashes, see our password auditing service.
05

Internal Web Applications

Internal applications often receive less security scrutiny than customer-facing systems. We assess authentication, authorisation, and vulnerabilities in internal tools and admin interfaces.
06

Network Architecture Review

We assess network segmentation effectiveness, firewall rules between zones, and whether sensitive systems are appropriately isolated from less-trusted network areas.

Our Pentest Methodology

How we approach internal penetration testing

01

Scoping & Rules of Engagement

We work with you to define the scope of testing, including assets, network segments, and rules of engagement. Clear scoping ensures we focus on the most critical areas while respecting operational constraints.
02

Reconnaissance & Mapping

Our testers perform active and passive reconnaissance to map the internal network, identify hosts, services, and potential attack paths. This includes AD enumeration, network scanning, and service fingerprinting.
03

Vulnerability Identification

We identify vulnerabilities through manual testing techniques including password spraying, Kerberoasting, misconfiguration analysis, and exploitation of known weaknesses in internal applications and services.
04

Exploitation & Post-Exploitation

Where safe and agreed in advance, we exploit vulnerabilities to demonstrate real-world risk. This includes lateral movement, privilege escalation, and access to sensitive data to validate the impact of findings.
05

Reporting & Debrief

Findings are documented in a clear report with technical details for remediation and an executive summary for decision-makers. We offer a debrief session to walk through findings and discuss next steps.

Pricing

From £2,850

for internal network penetration testing

Not sure where your network fits? A 30-minute scoping call is free and gets you a fixed written quote.

Book scoping call Request a quote

No obligation · Strictly confidential · Quote within one business day

Pricing Examples

Small office network (1-2 subnets, local servers)£2,850 - £3,300
Medium enterprise network (multiple subnets)£3,800 - £4,200
Large network (multiple subnets/zones)£4,750 - £6,600
Complex multi-site enterprise£7,500+
Indicative ranges only. Your exact price is confirmed after a short scoping conversation - see full service pricing.

What's Included

  • Fixed-price proposal within one business day
  • Manual, consultant-led testing. Not automated scans
  • Report within 2 business days of testing completion
  • Debrief call with your team to talk through findings and risk
  • No obligation quote, all enquiries are fully confidential

Key Deliverables

What's included in the assessment

Every internal network penetration test is delivered as a defined set of outputs supporting both technical remediation and executive decision-making.

  • Executive Report

    A non-technical summary of findings with risk ratings and recommendations suitable for board and senior management stakeholders.

  • Technical Report

    Detailed findings with reproduction steps, severity scoring, remediation guidance, and mappings to CVE, CVSS, and MITRE ATT&CK where applicable.

  • Debrief Session

    An offer of a debrief call to walk through findings, discuss remediation priorities, and answer questions from both technical and executive stakeholders.

  • Attack Path Narrative

    A walkthrough of the attack chain from initial access to maximum privilege, showing precisely how findings chain together to produce real-world risk.

  • Attack Surface Center Access

    Complimentary access to our Attack Surface Center ASM platform for live finding visibility, collaborative tracking, and remediation management.

  • Consultant-led Testing

    All testing is consultant-led by in-house staff. Your consultant works with you from scoping through to debrief - nothing is outsourced or subcontracted.

Ready to test your internal network security?

Our team will review your environment and provide a tailored testing proposal that fits your timeline and budget.
Book a Scoping Call Get a Pentest Quote

Common Questions

Internal network penetration testing - frequently asked questions

Internal network penetration testing simulates an attack from inside your network perimeter. This could represent a malicious insider, a compromised employee account, or an attacker who has gained initial access through phishing or other means. We assess what an attacker could achieve once inside, including lateral movement, privilege escalation, and access to sensitive data.

To request an internal penetration testing quote, tell us about the size of your network and we'll respond with a fixed-price proposal within one business day.

Yes, PCI DSS Requirement 11.4 explicitly requires internal penetration testing for all organisations with in-scope systems. It must be conducted at least annually and after significant changes to the environment.

External testing simulates an attack from the internet, testing your perimeter defences. Internal testing assumes the attacker is already inside your network. Internal testing typically uncovers different vulnerabilities: weak domain credentials, misconfigured Active Directory, unpatched internal systems, and excessive file share permissions.

Most organisations benefit from running both network penetration testing engagements.

Not necessarily. Internal testing can be conducted remotely via a VPN connection or a small testing appliance we ship to your site. On-site testing is also available where preferred.

Assumed breach testing starts from the position that an attacker already has a foothold - a low-privilege domain account, for example - and focuses on what they can do from there. Rather than spending testing time on initial access, the assessment concentrates on post-compromise activity: privilege escalation, lateral movement, Active Directory abuse, and whether a limited starting position can lead to domain compromise or access to sensitive data.

This makes assumed breach a more efficient model for organisations that already have confidence in their external perimeter and want to understand what happens if an attacker gets through anyway. It is also well-suited to post-incident validation, where the goal is confirming that an attack path has been closed. See our article on assumed breach penetration testing for a full explanation of when it is the right choice and what to expect from the process.