Network
Starts at $6,000, fixed scope, free retest. See all pricing →
Reply in one business day
Thanks, we've received your message.
We'll be in touch shortly.
When you need it
The situations that bring teams to this engagement, and where it fits alongside the rest of your program.
Definition
Internal penetration testing starts where an attacker lands after the first click: inside your network. It is an assumed breach assessment: we begin from a standard user account on one workstation, as if a phishing email had just worked. From there we test how far that access spreads through Active Directory, shared credentials, and flat network segments, and whether it reaches Domain Admin or the systems you care about most.
The price is fixed from $6,000, testing runs remotely, and the retest is free. It is the inside half of a network penetration testing service, and our infrastructure penetration testing guide shows how the two halves fit.
What we look for
Most breaches do not stop at the perimeter. They spread. Mapping our findings to MITRE ATT&CK, we test how far a single foothold can reach through your network, your segmentation, and your Active Directory.
Abuse of Active Directory to escalate from a standard user to domain admin.
We test for
Techniques that spread a single foothold across the whole network.
We test for
Flat networks that let one compromised host reach everything. When you need the boundary proven for PCI DSS 11.4.5 or 11.4.6, see network segmentation testing.
We test for
Weak secrets and insecure services waiting on the internal network.
We test for
The newer escalation paths: certificate services misconfigurations and the bridge between on-premises Active Directory and the cloud identity it syncs to.
We test for
By the numbers
The perimeter is where attacks start. The internal network is where they become incidents. Figures from the 2025 Verizon Data Breach Investigations Report, collected in our penetration testing statistics roundup:
of breaches began with stolen or abused credentials, the same starting point an assumed-breach internal test models.
of breaches involved ransomware, which depends on lateral movement and privilege escalation succeeding after the first foothold.
of breaches began with exploitation of a vulnerability, up 34% year over year, and internal systems are patched last.
of breaches involved a third party, which is how partner and vendor access ends up inside your network.
Approach
The test starts where a real intrusion starts: a standard user account and a foothold on the internal network, provided through a small appliance or virtual machine we ship or you host, or from a tester on-site where you prefer. From there we enumerate the domain, harvest and relay credentials, escalate privileges, and move laterally toward the objectives agreed during scoping, usually Domain Admin plus the specific systems that matter most to you.
We use the same tooling attackers do, and we have written about most of it: BloodHound for attack-path mapping, Impacket and NetExec for lateral movement, Responder for poisoning and relay, Kerbrute for Kerberos enumeration, and Evil-WinRM for remote execution. Every step is mapped to MITRE ATT&CK so your defenders can see what should have been detected and when.
What happens
What you get
Methodology
Every engagement follows the Penetration Testing Execution Standard and the relevant OWASP guides.
These are the phases your internal network penetration testing runs through.
OSINT and enumeration of every reachable host, service, and identity in scope.
Versions, configurations, trust relationships, and credentials mapped in detail.
Manual exploitation of the weaknesses that give a real attacker a foothold.
Privilege escalation and lateral movement to show how far one foothold reaches.
Attack narrative, prioritized fixes, and a free retest of remediated findings.
How it works
From scope through the final retest, your team stays in the loop at every step, with findings tracked live in our platform.
Scope & kickoff
Targets, roles, and rules of engagement defined in writing, with a fixed scope and timeline.
Testing goes live
Findings post to your live platform dashboard the moment our testers confirm them.
Track remediation
Follow every finding from open to fixed, with severity, evidence, and status in one place.
Report & retest
Executive and technical reports land, then request a free retest in one click.
Compliance
Findings are mapped to the requirement or control they evidence, so the same report serves your auditor, your customers, and your engineers.
Proof
Every engagement is confidential, so the work below is anonymized to sector and engagement type.
Free
Retest on every penetration test
185+
Years combined experience
14
Senior in-house specialists
24h
Onboarding after signing
Insurance
Email + Voice Social Engineering
A targeted credential-phishing email impersonating the company SSO password-reset flow led 19 employees to submit their credentials.
Outcome. Gave the security team a realistic multi-channel picture of susceptibility and a roadmap for help-desk identity-verification procedures and targeted training for high-exposure roles.
200
Email targets
19
Credential entries
2-channel
Attack simulated
Fintech · Payments
Web Application Penetration Test
Critical: a remote code execution flaw in the application’s web framework that could have given an attacker full control of the server. We escalated it to the development team while the test was still running.
Outcome. The critical RCE was reported and remediated during the engagement via an emergency framework upgrade, which also closed the server-side request forgery, and the remaining findings were retested to confirmation.
1
Critical (RCE)
Mid-test
Critical remediated
2
High
Resources
External vs Internal Penetration Testing: What's the Difference?
External penetration testing attacks your perimeter from outside; internal testing starts from a foothold inside. What each finds, and when you need both.
BloodHound: Mapping Active Directory Attack Paths
BloodHound explained: how it maps Active Directory attack paths to Domain Admin, what Community Edition changed, and how defenders use it to cut paths.
Impacket: The Windows Network Attack Toolkit
Impacket explained: the Python toolkit for Windows network protocols, what its best-known scripts reveal in a pentest report, and the fixes.
Want to see a report first?
Read a sample report for a fictional client, or request a redacted one from a real engagement. Our guide explains what a penetration testing report should contain.
FAQ
What teams most often ask before scoping
internal network penetration testing.
Internal penetration testing is a security assessment run from inside your network, modeling an attacker who has already gotten past the perimeter or a malicious insider. Instead of asking whether someone can get in, it answers what they could reach once they are in: how far lateral movement spreads, whether segmentation holds, and whether Active Directory can be escalated to domain admin.
It simulates an attacker who already has a foothold inside your network, whether from a phishing email, a rogue device, or a compromised host, and tests how far they can move, whether segmentation holds, and whether Active Directory can be abused.
Yes. Active Directory is central to most internal networks and a primary target, so we test for the common escalation and lateral-movement techniques attackers use to reach domain admin.
We test from a device or foothold inside your network, either on-site or through a provided appliance or virtual machine. We agree the exact approach during scoping.
Usually not. Most internal network tests run remotely through a small appliance or virtual machine we provide, which keeps the cost and logistics down. On-site testing is available where a client requires it or where physical-layer access is in scope, such as wireless penetration testing of the office Wi-Fi, and we agree the approach during scoping. Remote delivery is also how we run internal network penetration testing in Chicago and other cities outside New York.
Internal network penetration tests start at $6,000, fixed before work begins, with a free retest of remediated findings. Larger environments with more hosts or Active Directory forests are quoted after scoping. Starting prices for every service are on our pricing page.
Yes, unless you tell us not to. Reaching Domain Admin, or the equivalent tier-zero control in your environment, is the clearest proof that a foothold becomes a full compromise, and the path we took is the most valuable part of the report. If certain systems must stay untouched, we agree that in the rules of engagement and stop at the boundary, documenting the path we would have taken.
PCI DSS Requirement 11.4.2 requires an internal penetration test at least annually and after significant change, and NYDFS §500.5(a)(1) requires annual testing from inside the information systems’ boundaries. SOC 2 and ISO 27001 do not mandate one, but auditors routinely expect it for the Security criteria and Annex A 8.8, and HIPAA’s required evaluation of safeguards is best evidenced by one. Our report maps findings to whichever framework applies.
Internal testing runs under written rules of engagement: no denial-of-service techniques, no destructive actions, no changes to production data, and agreed handling for fragile systems such as OT equipment or legacy servers. Credential attacks stay under lockout thresholds, and anything critical is escalated to your contact immediately rather than waiting for the report. Manufacturers testing the IT and plant boundary get plant-safe methods: passive discovery first, and active steps only in agreed maintenance windows. Controllers and SCADA systems themselves are covered by our OT and ICS penetration testing.
Active Directory testing is the core of most internal network pentesting, because the domain is how one foothold becomes every server. The internal test covers it in full, along with the hosts, services, shares, segmentation, and hybrid identity links around it. If you want the domain on its own, our Active Directory security assessment starts at the same $6,000 and walks the paths from an ordinary user to Domain Admin, with the fixes that close them.
Both can start from access you give us. They answer different questions. This internal test is the assumed breach assessment: from $6,000, we start from a standard user account, your IT team knows the test is running, and we look for every path from that account to Domain Admin and your sensitive systems. You get the full list of findings and a free retest. A red team, from $12,500, can also start from an assumed breach, but it is covert, pursues one agreed objective, and measures whether your security team detects and stops it. Choose the internal test for breadth and the red team for detection.
Talk to our team about scoping internal network penetration testing.
Prefer the full scoping questionnaire?Tell us what you need tested. We reply within one business day.
Thanks, we've received your message.
We'll be in touch shortly.
