Network Penetration Testing

See your network from every angle


CREST-accredited assessment of your external perimeter, internal networks and wireless infrastructure. Understand which weaknesses provide a way in, what they expose and how far access could extend.

Network Security Testing

How our network penetration testing service works

Network penetration testing simulates real-world attacks against your perimeter services, servers, network devices and internal systems. External testing assesses what is reachable from the internet. Internal testing assesses what an attacker or compromised insider could access once inside.

We agree the IP ranges, network segments, testing window and rules of engagement at scoping, and confirm a fixed price before testing starts. A certified consultant then runs the assessment by hand, using automated tooling only to support discovery, and your report separates what needs fixing now from what can be scheduled into normal remediation work.

Typical network attack surface

  • Firewalls & edge devices
  • Servers & hosts
  • Active Directory & domain services
  • Remote access (VPN, RDP)
  • Wireless infrastructure

Why test your network?

Application testing looks at software flaws. Network testing looks at the layer underneath: unpatched services, weak configurations, and the trust between systems that turns a single foothold into domain access.

Scope & coverage

What network penetration testing covers

We confirm exactly what falls within your engagement during scoping. These are the areas a network assessment typically covers, and the services that cover each in more depth.

The external perimeter

Everything reachable from the internet: firewalls, gateways, exposed management interfaces, mail and DNS infrastructure, and cloud edge assets. Covered in detail by external penetration testing.

Internal networks and Active Directory

Domain configuration, credential handling, privilege escalation paths, and lateral movement from an assumed-breach position. Covered in detail by internal penetration testing.

Remote access services

VPN gateways, RDP, SSH, and similar endpoints. These sit on the boundary between external and internal, and are among the most frequently exploited entry points into a network.

Wireless infrastructure

Corporate and guest wireless, encryption configuration, network isolation, and rogue access point detection. Available as a standalone Wi-Fi security assessment.

Segmentation and trust boundaries

Whether your network segments genuinely contain an attacker. We test the controls between zones rather than assuming the documented design matches what is deployed.

Patch and configuration hygiene

Missing patches, unsupported software, default credentials, and weak service configuration across in-scope hosts.

Who Needs This

Who needs network penetration testing?

Any organisation with systems reachable from the internet, sensitive data on its network, or a compliance requirement for independent testing.
Get a Network Pentest

Organisations with internet-facing systems

If you run services that can be reached from the internet, external penetration testing is the usual starting point.

Businesses working towards ISO 27001, PCI DSS or SOC 2

PCI DSS requires penetration testing. ISO 27001 and SOC 2 don't mandate it by name, but auditors commonly ask for it as evidence. We provide reporting and methodology documentation your auditor or QSA can work from.

Teams with hybrid or distributed environments

Cloud infrastructure, VPNs and remote access extend the attack surface beyond the traditional perimeter, and testing needs to cover how they connect to your on-premise environment.

Organisations that have not tested recently

Configuration drift, new deployments and newly disclosed vulnerabilities open gaps between tests, even in well-managed environments.

Pricing

From £2,100

for network penetration testing

Not sure whether you need external, internal, or both? A 30-minute scoping call is free and gets you a fixed written quote.

No obligation · Strictly confidential · Reply within one business day

Pricing Examples

External Network Testing
2-5 days
From £2,100
Internal Network Testing
3-8 days
From £3,150
Wi-Fi Security Testing
1 day on site per location
From £1,600
Indicative starting prices only. Your exact price is confirmed after a short scoping conversation. See full service pricing.

Compare all our penetration testing services.

What's Included

  • Fixed-price proposal agreed before testing starts
  • Manual, consultant-led testing. Not automated scans
  • Report within 2 business days, with an executive summary, technical findings and, for internal testing, an attack path narrative
  • Debrief call and Exploitr platform access, plus free retesting for external engagements
  • Combined engagements are better value than booking separately

Our Pentest Methodology

How we conduct network penetration testing

A network engagement maps what is exposed, validates what is exploitable, and follows any foothold as far as it goes. We establish which hosts, services and trust relationships are actually present, confirm each weakness by hand rather than reporting scanner output, and then test how far an attacker could move and which systems and data they could reach.

The detailed steps differ between external and internal testing, so each service sets out its own methodology. Our full penetration testing methodology covers how this applies across every engagement type.

Common Questions

Network penetration testing: frequently asked questions

It depends on the size of the environment and which parts are in scope. External network testing typically takes 2-5 days, internal network testing 3-8 days, and a Wi-Fi assessment 1-2 days.

Reports are delivered within 2 business days of testing completion. If you are preparing for your first assessment, our guide to scoping a network penetration test covers what information to have ready.

External network testing assesses what an attacker outside your network could reach and exploit, covering internet-facing services, perimeter devices, and cloud assets.

Internal network testing assesses what an attacker could do once inside your network, whether through a phishing compromise, an insider threat, or initial access that was gained externally. It covers Active Directory, lateral movement paths, privilege escalation, and access to sensitive systems.

Both are complementary and are frequently scoped as a combined engagement.

If you have never tested before and have systems exposed to the internet, external testing is the usual starting point because that is where opportunistic attacks begin.

Internal testing becomes the priority once your perimeter is in reasonable shape, or if your main concern is what a phishing compromise or a malicious insider could achieve. Most organisations testing annually cover both, and combined engagements are typically better value than booking them separately.

We will give you an honest recommendation during scoping rather than quoting for everything by default.

Pricing depends on the scope and type of testing. External network penetration testing starts from £2,100, internal network testing from £3,150, and Wi-Fi assessments from £1,600. Travel is charged in addition for on-site work.

See our penetration testing pricing guide for worked examples, or request a quote for a fixed-price proposal based on your specific environment.

Several major frameworks require or recommend regular network testing:

  • PCI DSS mandates annual external and internal penetration testing, plus additional testing after significant changes.
  • ISO 27001 doesn't mandate penetration testing by name, but Annex A control 8.8 (management of technical vulnerabilities) expects you to identify and assess them, and an independent penetration test is a common way to evidence it.
  • SOC 2 doesn't mandate penetration testing, but auditors commonly ask for it as evidence against the security criteria.

We provide methodology notes and structured reporting that supports QSA and auditor evidence requirements.

You can request a network penetration testing quote using our quote form. Include the type of testing required, a rough indication of your environment size (IP ranges for external or internal testing, number of access points and locations for Wi-Fi), any compliance requirements, and your preferred timeframe.

We reply within one business day to confirm your scope, usually with a short questionnaire or a call, then send a fixed-price written proposal.

Get a fixed price for your network penetration test

Tell us about your environment and we'll reply within one business day to confirm the scope, then send a fixed-price proposal. No obligation.