Network penetration testing
An external test shows how someone on the internet gets in. An internal test shows how far they get once inside. We test your perimeter, your internal network and Active Directory, and the cloud hosts in between, so you know which weaknesses matter and in what order to fix them.
What we test
Every engagement is scoped to your environment. These are the areas a network testing engagement covers as standard.
External perimeter
Everything you expose to the internet: websites, VPNs, mail, remote access and forgotten services.
Internal network
What an attacker could reach from a single compromised laptop or office connection.
Active Directory
Weak settings, excessive permissions and paths from an ordinary account to domain admin.
Credentials and patching
Default and reused passwords, and unpatched systems with known vulnerabilities.
Segmentation
Whether sensitive networks, such as payment or production zones, are really separated from the rest.
Cloud hosts
Internet-facing cloud servers, storage and management interfaces within the agreed scope.
How deep we go
Choose how much access we start with. We will recommend one on the scoping call, based on what you want to learn.
External
We start from the internet with no access, the way most attacks begin.
Internal
We start inside your network, as an insider or an attacker with a foothold.
Assumed breach
We start from an ordinary user account and show what it can be turned into.
From first call to clean exit
Every engagement follows the same five steps. Our penetration testing process page explains each one in detail.
- Day 0
Scoping call
A free call to understand what you want tested and why: the applications, networks or APIs, your deadlines and any compliance requirement behind the test. You get a written quote with the scope, timeline and deliverables set out.
- Before testing
NDA and rules of engagement
We sign a mutual NDA, or work under yours, then agree the rules of engagement: targets, testing windows, contacts, and anything that must not be touched. Testing can start within 48 hours of the scope being signed.
- Testing
Hands-on testing
Our testers combine tools with manual testing, following OWASP, PTES and NIST SP 800-115. If we confirm a critical issue, we tell you straight away instead of waiting for the report.
- Report
Report and walkthrough
Every finding is reproduced by a tester before it goes in the report, with severity, evidence and a fix written for your stack. We walk your team through the results and answer questions.
- After
Retest and clean exit
When you have fixed the issues, we can retest and issue an updated report. When the engagement ends, we remove test accounts, credentials and working files, and confirm it in writing on request.
Findings your developers can act on
Each finding explains what is wrong, what an attacker could do with it, and how to fix it in your stack. No raw scanner output, and nothing we have not reproduced ourselves.
A help desk account could take over the whole domain
- Affected area
- Active Directory permissions
- Impact
- An account with routine help desk rights could be used to gain full control of every computer and account in the company.
- Fix
- Remove the inherited permission from the help desk group, and review who can change membership of privileged groups.
An illustrative example. Client names, systems and data are always kept confidential.
What we need from you
- The IP ranges, domains and hosts in scope
- For an internal test, remote access or a device we can connect to your network
- A standard user account, if you want an assumed-breach test
- Testing windows and systems that must be avoided
What you receive
- External and internal findings in one report
- Attack paths showing how issues chain together
- Hardening steps in priority order
- Segmentation results for PCI DSS, if required
Questions about network penetration testing
What is the difference between external and internal testing?
External testing starts from the internet and shows how someone gets in. Internal testing starts inside your network and shows how far they get. Most organisations need both. Our blog post on external vs internal penetration testing explains the difference in detail.
Will testing disrupt our network?
We plan the test to avoid disruption: agreed windows, no denial-of-service testing unless you ask for it, and care around fragile systems. We tell you immediately if anything behaves unexpectedly.
How do you test our internal network remotely?
Usually through a VPN account or a small virtual machine you run inside your network. We can also test on site if you prefer.
Do you test segmentation for PCI DSS?
Yes. We test whether your cardholder data environment is properly separated from other networks, and report the results in the form your assessor needs.
How often should we run a network penetration test?
At least once a year, and after significant changes such as a new office, a cloud migration or a firewall replacement.
Further reading
Guides from the Krylo Security blog.
External vs internal penetration testing
Read the guide ↗Zero trust security explained
Read the guide ↗Asset security: preventing data breaches
Read the guide ↗Other penetration tests
Web application penetration testing
Customer portals, SaaS platforms, dashboards and online stores, tested by hand against the OWASP Top 10 and your business logic.
API penetration testing
REST, GraphQL and partner APIs tested for broken authorization, data exposure and abuse, against the OWASP API Security Top 10.
Mobile app penetration testing
iOS and Android apps tested on real devices against OWASP MASVS, together with the APIs and backend they depend on.
Start your security assessment.
Tell us about your application, architecture or compliance requirements. Our team will scope a penetration test around them.