Network Penetration Testing
Internal and external network testing — where an attacker can get, what they can reach, and how to cut the paths off.
What we cover
- External perimeter: exposed services, panels, and management interfaces
- Segmentation validation: VLANs, zones, and what actually crosses them
- Lateral movement paths from a standard workstation or server
- Active Directory review: privilege paths, kerberoasting, stale accounts
- Legacy protocols and services (SMB, RDP exposure, VPN concentrators)
- Wireless network configuration review (where in scope)
How we test
We chart exposed services and agreed internal starting points, and set rules of engagement for safe testing.
Manual testing of realistic attacker routes: perimeter flaws, credential abuse, pivoting, and privilege escalation.
We demonstrate how far access extends — which systems, which data — with reversible steps.
Attack paths drawn clearly, remediation guidance per finding, and a retest of everything you fix.
What you get
- Attack-path report: how an intruder would actually move
- Prioritized fixes mapped to segments and systems
- Segmentation and hardening guidance
- Free retest of fixed findings
The engagement at a glance
A short conversation about your environment. You receive a written scope, timeline, and fixed quote — no obligation.
Testing begins only with your written permission and agreed rules of engagement. Always.
A calendar agreed before we start, with an agreed communication plan while testing runs.
A verification pass over everything you fix — included in the price, not an add-on.
See the full engagement process → and how pricing is scoped in our public pricing guide.
Related research from Hmmnm
Common questions
Do you test our production network or a lab?
Production with written authorization and safe techniques is normal for external testing; internal testing often runs from a controlled jump host in scope. We agree the exact rules before starting.
Can you test Active Directory?
Yes — privilege paths, delegation mistakes, kerberoastable services, and stale accounts are usually where the real risk lives.
Will testing disrupt operations?
No destructive techniques, agreed windows for anything sensitive, and a communication plan throughout. Safe and reversible is the rule.
Want this assessed for your environment?
A short scoping conversation is enough to get a fixed quote. No obligation — a researcher replies.
Start the conversation →