Network Penetration Testing

External testing works from the internet against the addresses you publish; internal testing starts from a position inside the network and asks how far that position travels. They answer different questions. External work tells you what an attacker reaches with no help: exposed services, forgotten hosts on a range nobody reviews, weak edge configuration, a login portal that gives away more than it should. Internal work assumes the edge has already failed, through a phished user or a device somebody plugged in, and measures blast radius instead: privilege escalation, lateral movement between hosts, and the routes through Active Directory that lead from an ordinary account toward domain control. If you are buying one, buy the one that matches the worry that brought you here. If the driver is an audit or a customer questionnaire, the honest answer is usually both, because a hard perimeter wrapped around a flat interior is the pattern that hurts most in a real incident.

For external work we need the address ranges and hostnames you own, written down and confirmed, plus somebody with authority to say yes to testing them. For internal work we need a foothold that matches the scenario: a VPN account reaching the segments in scope, or time on site with a network port and a desk, or a jump host we can connect to. We also ask which segments you want reached, which systems are excluded, the testing windows that suit your change calendar, and escalation contacts on both sides. That material becomes the Rules of Engagement, signed before anything is touched. What we do not need is your production data or a standing administrative account handed over informally. Where credentials are required they are created for the test, scoped to the test, and disabled at the end of it. The scoping call, usually 30 to 45 minutes, is where this list gets settled.

Run both where the scope allows it, and where it does not, run credentialed. Uncredentialed testing shows what an attacker sees before they own anything: services answering on the network, weak protocols, hosts exposing their age at the surface. It is the more dramatic exercise and the thinner one, because a host that refuses to talk anonymously looks safe and may not be. Credentialed testing gives us a low-privilege domain account, the kind a phished employee has, and from there we can see what is actually installed, which patches are missing behind the service banner, and which relationships in the directory turn that ordinary account into something dangerous. Those findings read as duller and are far more useful to fix. In practice the credentialed pass produces the attack paths, and the uncredentialed pass tells you which of those paths an outsider could start on without any help from your staff.

We name those devices during scoping and treat them differently, rather than promising nothing will ever wobble. Ageing gateways, old printers, manufacturing and medical equipment and unsupported appliances can fall over on an ordinary port scan, so in Phase 1 you tell us what is fragile and we agree in writing whether each one is excluded, examined passively, or tested in a window with somebody who owns it watching. Where a device stays in scope we slow the scanning down, drop the aggressive checks, and confirm the finding by inspection rather than by exploiting it. We avoid denial-of-service and destructive actions as a matter of policy, and we stay reachable on an agreed escalation contact for the duration, so a problem becomes a phone call rather than a paragraph in a report weeks later. A system you exclude stays excluded.

A scan lists what might be wrong; this engagement proves what is wrong and shows what it would cost you. Your scanner is doing useful work, and we scan too, in the discovery phase, as a way of widening coverage. The difference is what happens next. Scanner output is a list of candidates ranked by a generic severity score, with false positives left in and no sense of what chains together. Our engineers take that list, discard what does not hold, exploit what does, and then keep going: credentials captured on the wire, one host reused to reach another, a directory relationship that turns a helpdesk account into domain control. Each finding is reproduced by hand before it is written down, carries a proof of concept, and is ranked by the damage it does rather than by a number. Critical findings reach you within three hours of discovery, and a retest is part of the engagement.