Network Penetration Testing
Internal and external network security assessments that uncover what automated scanners miss
What this engagement covers
The service
Our network penetration testing services thoroughly evaluate both your internet-facing perimeter and internal network infrastructure. We simulate sophisticated real-world adversaries to uncover vulnerable network services, Active Directory domain escalation paths, protocol poisoning flaws, segmentation bypasses, and lateral movement routes before attackers exploit them.
What we test
We test internet-facing perimeters (firewalls, VPN gateways, mail servers, DNS, exposed services) and internal corporate networks (Active Directory, domain controllers, member servers, workstation fleets, VLAN segmentation, OT/IoT subnets, and wireless networks).
Scoping & Assessment Depth
Internal Network & AD Pentest (Recommended)
Most PopularSimulates an attacker or rogue insider with access to an internal switch port or workstation, testing lateral movement, credential theft, and domain compromise.
External Perimeter Pentest
Perimeter DefenseEvaluates internet-facing firewalls, routers, VPN endpoints, cloud gateways, and remote access services from an external adversary perspective.
Segmentation & VLAN Validation
Compliance FocusedProbes firewall and VLAN boundary enforcement between corporate networks, PCI cardholder data zones (CDE), guest networks, and production servers.
Attack Surface & Vulnerability Vectors
Active Directory & Domain Compromise
Kerberoasting, AS-REP roasting, DCSync, unconstrained delegation, and ACL misconfigurations targeting Domain Admin takeover.
Protocol Poisoning & NTLM Relaying
LLMNR/NBT-NS spoofing, WPAD abuse, SMB signing omission, and LDAP relay attacks yielding domain credentials and session takeovers.
Perimeter Gateway & VPN Exposures
Testing SSL VPN appliances, remote access portals, exposed SSH/RDP interfaces, and unpatched perimeter services for initial compromise.
Network Segmentation & VLAN Hopping
Probing firewall rules, dual-homed hosts, and routing misconfigurations to pivot from non-sensitive networks into restricted CDE/PHI zones.
Cleartext Protocols & Credential Sniffing
Detecting unencrypted Telnet, FTP, SNMP community strings, HTTP basic auth, and legacy network management traffic across broadcast domains.
Default Credentials & Misconfigurations
Password spraying across internal services, default manufacturer passwords on network gear, and weak service account password policies.
How we run it
Aligned with PTES and NIST SP 800-115, we perform non-destructive exploitation targeting weak credentials, missing protocol signing, relay vulnerabilities, and network protocol abuse (LLMNR, NBT-NS, mDNS, IPv6 DHCP). Every finding includes network topology diagrams, reproduction evidence, and prioritized patch guidance.
Host Discovery & Surface Footprinting
Network sweeping, port scanning, and service version fingerprinting across IP ranges to identify all responsive internal or external hosts.
Vulnerability Identification & Filtering
Automated scanning coupled with manual inspection to detect missing security patches, outdated protocol stacks, and insecure service configurations.
Protocol Poisoning & Credential Harvesting
Safely listening for and responding to multicast/broadcast name resolution requests (LLMNR, NBT-NS, mDNS) to capture password hashes.
Active Directory & Domain Escalation
Extracting Service Principal Names (Kerberoasting), auditing user privileges, and analyzing domain trust relationships using BloodHound.
Lateral Movement & Pivoting
Using compromised credentials to authenticate across network tiers, test pass-the-hash/ticket attacks, and access sensitive internal file shares.
Network Segmentation & Firewall Validation
Probing egress filtering, inter-VLAN access control lists, and attempting to reach isolated database or payment environments.
Data Access Proof & Impact Demonstration
Validating whether sensitive databases, source code repositories, or customer data stores can be read without causing operational disruption.
Remediation Review & Retest Validation
Delivering prioritized remediation steps, Active Directory hardening guidance, and retesting fixes at no additional cost.
What you receive
Findings land in your tracker as you go, not only in a PDF at the end. Retest is in scope, not a change order.
- Executive summary with business impact and infrastructure risk posture
- External perimeter penetration testing report with CVSS scoring
- Internal network & Active Directory attack path documentation
- Proof-of-concept evidence, credential audit findings, and relay maps
- Auditor-ready compliance crosswalk (PCI-DSS 4.0, SOC 2, HIPAA, CMMC)
- Talon real-time portal access with bi-directional Jira/GitHub ticket sync
- Post-remediation retest report validating fixes before attestation
- Formal, signed Letter of Attestation for compliance and customer assurance
What we usually find
The issues this engagement surfaces most often. Yours will differ, but this is the shape of it.
Who this is for
Auditor-Ready Compliance Crosswalk
| Framework | Control Section | Testing Evidence & Report Deliverable |
|---|---|---|
| PCI DSS v4.0 | Requirement 11.4.1 & 11.4.2 | External and internal penetration testing of the network perimeter and cardholder data environment at least once every 12 months. |
| SOC 2 Type II | CC6.1, CC6.6, CC7.1 | Evaluation of network logical perimeter controls, transmission safeguards, and intrusion detection resilience for CPA audit workpapers. |
| HIPAA Security Rule | 45 CFR § 164.312 | Technical evaluation of internal network controls, access boundaries, and transmission security protecting ePHI. |
| ISO/IEC 27001:2022 | Control A.8.20, A.8.21, A.8.22 | Network security controls, network segregation, and web filtering validation through periodic technical testing. |
| NIST SP 800-171 / CMMC | 3.11.1, 3.11.2 (CA-8) | Periodic technical penetration testing of network boundaries holding Controlled Unclassified Information (CUI). |
Findings are mapped to PCI-DSS, SOC 2, HIPAA, NIST CSF, ISO 27001, so the report drops into an audit package rather than needing to be translated first. If you need the readiness work behind one of those, that is a separate engagement.
Frequently Asked Questions
Direct answers on scoping, methodology, compliance validation, and deliverables.
We deploy a lightweight, hardened drop-box virtual appliance (OVF/OVA, Docker, or ISO) inside your network, or leverage our secure Talon Lory connector. Once connected over an encrypted reverse tunnel, our testers perform all testing remotely as if physically plugged into an internal network port.
No. All testing is conducted using controlled, non-destructive methodologies. We avoid high-impact denial-of-service testing and coordinate testing windows for sensitive network segments. Exploitation is conducted carefully to demonstrate proof without taking down services.
Yes. Our network penetration testing satisfies all PCI DSS v4.0 Requirement 11.4.1 (external) and 11.4.2 (internal) mandates, including segmentation validation testing between the Cardholder Data Environment (CDE) and corporate networks.
Yes. All network penetration testing engagements include free retesting within 30 to 60 days. After your system administrators patch services or reconfigure Active Directory, we re-verify that the vulnerabilities and attack paths are completely closed.
A typical network assessment takes 1 to 2 weeks for active testing depending on the number of external IP addresses, internal subnets, and Active Directory domain scale. Preliminary critical findings are reported live via your Talon portal.
Scope it in one call
Tell us what is in scope and we come back with a fixed price and a start date. No discovery-call maze, no hourly estimate that moves.
