Skip to content
Invadel

Network

Network Penetration
Testing Services

External from $4,200, internal from $6,000, fixed scope, free retest. See all pricing →

Get a fixed quote

Reply in one business day

Full scoping questionnaire 
Senior certified testers, manual-first185+ years combined experienceOnboarding within 24 hoursFree retest includedOur methodology

When you need it

When you need a network penetration test

The situations that bring teams to this engagement, and where it fits alongside the rest of your program.

  • A compliance clock is running: PCI DSS 11.4, NYDFS 500.5, and SOC 2 auditors all expect a recent independent network test.
  • A cyber insurance application or renewal asks whether the network has been penetration tested in the last twelve months.
  • An acquisition, office move, or hybrid AD migration left you with a network nobody can fully describe, let alone defend.
  • The vulnerability scanner says clean and you want to know whether a person with time and skill would agree.
  • A customer security questionnaire asks for evidence that the perimeter and the internal network have been tested by an outside firm.

Two tests, one engagement

External and internal testing: what each side finds

Buyers often ask which one they need. The honest answer is usually both, because they answer different questions and are priced separately so you can start with one.

External penetration test

Starting point
The public internet, no credentials
What it answers
Can an outsider get in?
Typical findings
Exposed services, weak remote access, credential attacks, forgotten assets
Scoped by
Live internet-facing hosts
Starting price
$4,200
Compliance driver
PCI DSS 11.4, NYDFS 500.5, SOC 2, cyber insurance

Internal penetration test

Starting point
An assumed foothold inside the network, such as a compromised workstation
What it answers
How far can an attacker go once inside?
Typical findings
Active Directory paths, credential reuse, segmentation gaps, legacy hosts
Scoped by
Hosts, sites, and Active Directory domains
Starting price
$6,000
Compliance driver
PCI DSS 11.4, NYDFS 500.5, CMMC, HIPAA

Both tests are delivered remotely. Internal testing runs through a small device we ship to your office or a VPN connection you provide, so there is no travel line on the quote.

What we look for

Network vulnerabilities we hunt for

A network test is two investigations. The first asks what an outsider can reach and break. The second asks how far an insider, or an attacker who just became one, can travel. We run both and connect them.

Exposed services & forgotten assets

Hosts and services on the perimeter that nobody remembers, from staging boxes and old VPN concentrators to management interfaces that were never meant to face the internet.

We test for

  • Full port and service discovery across every range in scope
  • Subdomain and cloud-edge enumeration for assets outside the inventory
  • Version fingerprinting against known exploitable software
  • Default and weak credentials on admin interfaces
  • Certificate, DNS, and mail configuration weaknesses

Credential weaknesses & reuse

The passwords, tokens, and hashes that let an attacker walk in through a legitimate door, on the perimeter and again inside the network.

We test for

  • Password spraying against exposed portals within agreed rules
  • Breached-credential checks for accounts tied to your domains
  • NTLM relay and hash capture on the internal network
  • Credential reuse between workstations, servers, and services
  • Service accounts with Kerberoastable or AS-REP-roastable settings

Active Directory attack paths

The misconfigurations in delegation, group membership, certificate services, and trusts that turn one workstation user into Domain Admin.

We test for

  • Path mapping from an ordinary user to Tier 0 assets
  • Kerberos delegation and certificate template abuse (ADCS)
  • Group Policy, ACL, and nested-group privilege escalation
  • Trust relationships between domains and forests
  • Hybrid identity links to Entra ID and cloud resources

Segmentation failures

Zones that were supposed to be isolated, from the guest Wi-Fi to the cardholder environment, that turn out to route, resolve, or trust each other. For PCI DSS 11.4.5 evidence or an IT and plant boundary, see network segmentation testing.

We test for

  • Reachability testing between every segment in scope
  • Firewall rule review from the attacker side, not the console
  • Enclave isolation for PCI DSS and CMMC scopes
  • Management network exposure from user VLANs
  • Flat-network discovery where segmentation exists only on paper

Unpatched & legacy systems

The appliances, print servers, and line-of-business hosts that stopped receiving updates years ago and still answer on the wire.

We test for

  • Exploit validation for high-impact missing patches
  • Legacy protocol exposure such as SMBv1, LLMNR, and NetBIOS
  • End-of-life operating systems and embedded devices
  • Unsupported software with public exploit code
  • Safe verification with no denial-of-service techniques

Remote access & VPN gaps

The gateways that carry the most trust and the least scrutiny: VPNs, remote desktop, and the vendor connections that bypass everything else.

We test for

  • VPN and remote-desktop gateway exposure and hardening
  • Multi-factor coverage and bypass testing on remote access
  • Vendor and third-party connection review
  • Split tunneling and client configuration weaknesses
  • Exposed remote-management tooling

Fixed prices, published

How network penetration testing is priced

Network tests are sized by what is live, not by the hour. The tiers below are the published prices; the exact number is agreed in writing before any work starts.

External network

Small perimeter of a handful of live hosts: $4,200. Several dozen hosts across multiple ranges: $6,800. A broad estate of many hosts, ranges, and cloud regions: $8,400.

Internal network

One site or one Active Directory domain of up to a few hundred hosts: $6,000. A few sites or VLANs with more hosts: $9,200. Multiple domains or forests and thousands of hosts: from $14,500.

Both together

The two prices add; there is no bundle markup and no discount that hides a thinner scope. Recurring programs that repeat the tests each year or quarter are priced once as a testing program.

Why the scanner is not enough

Network penetration testing versus vulnerability scanning

A vulnerability scan matches versions and banners against a database. It is fast, it is worth running monthly, and we sell it as a validated scan from $1,500. What it cannot do is chain a weak password on a forgotten VPN to a delegation misconfiguration in Active Directory and prove that the combination leads to every server in the building.

That chain is what a network penetration test produces, and it is why auditors, examiners, and insurers ask for a test rather than a scan. Our scanning program between tests keeps the inventory honest; the manual test is where the findings that change budgets come from. Our network security assessment and audit guide sets out where the scan, the assessment, and the test each fit.

Methodology

How we test

Full methodology →

Every engagement follows the Penetration Testing Execution Standard and the relevant OWASP guides.

These are the phases your network penetration testing runs through.

  1. 01

    Discovery

    OSINT and enumeration of every reachable host, service, and identity in scope.

  2. 02

    Enumeration

    Versions, configurations, trust relationships, and credentials mapped in detail.

  3. 03

    Exploitation

    Manual exploitation of the weaknesses that give a real attacker a foothold.

  4. 04

    Post-exploitation

    Privilege escalation and lateral movement to show how far one foothold reaches.

  5. 05

    Report & retest

    Attack narrative, prioritized fixes, and a free retest of remediated findings.

How it works

How your engagement runs

From scope through the final retest, your team stays in the loop at every step, with findings tracked live in our platform.

  1. 01

    Scope both sides

    We count the live external hosts and size the internal estate by hosts and domains, then fix one price in writing for the whole engagement.

  2. 02

    External phase

    Discovery and manual testing of everything internet-facing, from exposed services to credential attacks within agreed rules, with anything exploitable proven safely.

  3. 03

    Internal phase

    From an assumed foothold, delivered remotely through a shipped device or VPN, we work toward Domain Admin and the systems that matter most, testing segmentation on the way.

  4. 04

    Chain and verify

    Findings from both phases are linked into the attack paths an adversary would actually use, each with evidence, so the report reads as a story rather than a list.

  5. 05

    Report and retest

    Executive and technical reports, a remediation plan in priority order, findings tracked in the platform, and a free retest once you have fixed them.

Compliance

Frameworks a network test satisfies

Reports map each finding to the requirement it affects, so the same engagement serves the auditor, the examiner, and the insurer.

PCI DSSRequirement 11.4 external and internal testing plus segmentation checks for the cardholder data environment.NYDFS 23 NYCRR 500The annual penetration testing that section 500.5 requires of covered financial entities.SOC 2Evidence for the Security criteria that auditors and enterprise customers look for.CMMC Level 2Validation of the boundary around CUI and the NIST SP 800-171 controls that protect it.HIPAATechnical evaluation evidence for the Security Rule where ePHI crosses the network.

Proof

Proof in the field

Every engagement is confidential, so the work below is anonymized to sector and engagement type.

All case studies →

Free

Retest on every penetration test

185+

Years combined experience

14

Senior in-house specialists

24h

Onboarding after signing

Fintech · Payments

Web Application Penetration Test

High risk

Critical: a remote code execution flaw in the application’s web framework that could have given an attacker full control of the server. We escalated it to the development team while the test was still running.

Outcome. The critical RCE was reported and remediated during the engagement via an emergency framework upgrade, which also closed the server-side request forgery, and the remaining findings were retested to confirmation.

1

Critical (RCE)

Mid-test

Critical remediated

2

High

Read the case study

Fintech · Payments

Post-Incident Web App Assessment

Medium risk

Excessive data exposure: API responses leaked transaction metadata, including precise geolocation, enabling real-world tracking of users.

Outcome. Surfaced the exposure and hardening gaps, prioritized by how readily an attacker could chain them, and delivered fixes plus a retest to confirm closure.

8

Findings

3

Medium

Post-incident

Engagement

Read the case study
LatentPerygeeCity National BankAubaDesteiaDTCC
Request a reference 

Resources

Field notes from the offensive side

All articles →

Network Penetration Testing: The Complete Guide

What network penetration testing is, how external and internal tests differ, the methodology testers follow, what it costs, and how to buy it well.

Network Penetration Testing Checklist: Internal and External

A network penetration testing checklist for internal and external tests: scoping, perimeter, Active Directory, segmentation, reporting and the retest.

Infrastructure Penetration Testing: What It Covers and How It Is Scoped

What infrastructure penetration testing covers, how external and internal scope is counted, how it maps to PCI, SOC 2 and NYDFS, and fixed prices from $4,200.

Want to see a report first?

Read a sample report for a fictional client, or request a redacted one from a real engagement. Our guide explains what a penetration testing report should contain.

See the sample report

FAQ

Frequently asked questions

What teams most often ask before scoping network penetration testing services.

Still have questions? 
01What is network penetration testing?

A manual, authorized attack on the network layer of your environment: the internet-facing perimeter, the internal hosts and services behind it, and the identity system, usually Active Directory, that ties them together. Testers use the same techniques a real intruder would, prove what is exploitable with evidence, and stop short of anything destructive. The output is a prioritized report and, at Invadel, a free retest once the findings are fixed. Our network penetration testing checklist lists what each phase covers.

02Do we need an external test, an internal test, or both?

They answer different questions. External testing tells you whether an outsider can get in. Internal testing tells you how far an attacker travels once they have a foothold, which is the phase most real breaches spend their time in. Regulations such as PCI DSS 11.4 and NYDFS 500.5 expect both. If budget forces a choice, start external if you have never tested, and internal if your perimeter is already mature and you run Active Directory.

03How much does a network penetration test cost?

External network testing starts at $4,200 and internal network testing at $6,000, each fixed in writing before work begins and each including a free retest. Larger perimeters and estates move up published tiers based on live hosts, sites, and domains. There is no hourly billing and no travel charge, because internal testing is delivered remotely.

04How long does a network penetration test take?

Scoping takes about a day and onboarding begins within 24 hours of a signed proposal. The testing itself depends on the size of the perimeter and the internal estate; most engagements run between one and three weeks from kickoff to report, with the internal phase taking the larger share. Tell us your audit or renewal date and we plan the engagement around it.

05Is the internal test done on-site?

It does not have to be. We ship a small testing device to your office or connect over a VPN you provide, then work from that foothold exactly as an attacker who had compromised a workstation would. On-site work is available in the New York metro when a scope genuinely needs a person in the building, such as wireless penetration testing of the office Wi-Fi or a physical penetration test of badge access.

06Will testing disrupt production?

No. Rules of engagement are agreed in writing before we begin, including testing windows, systems to handle with care, and an emergency stop contact. We do not run denial-of-service techniques, and exploitation is verified in the least invasive way that still proves the finding.

07Does this satisfy PCI DSS Requirement 11.4?

Yes, when scoped to the cardholder data environment. Requirement 11.4 calls for external and internal penetration testing at least annually and after significant changes, plus testing of segmentation controls. We scope to your actual PCI boundary, test the segmentation between it and the rest of the network, and deliver evidence your assessor can use directly.

08How often should we test the network?

Annually at a minimum, which is what PCI DSS, NYDFS 500.5, and most cyber insurers expect, and again after significant changes such as a migration, a merger, or a new remote-access platform. Teams that change often run a recurring program with validated scanning between the manual tests.

09Is network penetration testing the same as infrastructure penetration testing?

In practice, yes. Both names cover the external perimeter, the internal network, and the identity layer that ties them together, and buyers use them interchangeably. “Infrastructure” sometimes also takes in cloud accounts, which we test as a separate cloud penetration test from $6,800. Our infrastructure penetration testing guide shows how scope is counted and priced.

10Do you test firewalls?

Yes, from the attacker’s side, as part of the network test: what the firewall exposes to the internet, what its management and VPN interfaces accept, and whether the rules between internal zones actually stop traffic. The test proves what gets through, rather than reading the rule base in the console. Our firewall penetration testing guide explains the difference.

Ready to test your defenses?

Talk to our team about scoping network penetration testing services.

Prefer the full scoping questionnaire? 
RelatedExternal Network Internal Network Active Directory Segmentation Testing Ransomware Readiness Wireless OT & ICS VAPT

Get a Fixed-Scope Quote

Tell us what you need tested. We reply within one business day.