1
Scope and authorize
We agree the starting position — standard user, unauthenticated device or both — and what is off limits.
Network
Internal network pentest
An assumed-breach test: we start where a phished employee or a stolen laptop would, and work out how far that gets — usually measured by how quickly it becomes domain-wide control.
9
areas covered
5
stages, scoping to retest
In-house
testers, never subcontracted
portal.cyberlysecure.com/acme-health/coverage
Acme Health — Test coverage4 practices · 16 services · one team
In-houseWeb app
API
SaaS
Mobile
Client-side
External
Internal
Segment test
Wireless
Vuln. assessment
Cloud config
Hardware & IoT
AI & LLM
Social eng.
Physical
Red team
ApplicationsNetworkCloud & devicesPeople & premises
6 in scope · one team · one report
In-house testers 0 subcontracted
Every surface one team
What this is
What the test covers.
The question is not whether someone can get inside. It is what happens next. Most internal networks are built for people to work in, and the same convenience that makes work possible makes lateral movement easy.
We start from a standard user on a standard device, and we document the path — every step, every credential, every misconfiguration that made the next step possible — so you can break the chain wherever it is cheapest.
PTES NIST SP 800-115 MITRE ATT&CK
What we test
- Active Directory enumeration, trust relationships and privilege paths
- Kerberos attacks: Kerberoasting, AS-REP roasting and delegation abuse
- NTLM relay, coercion and authentication downgrade
- Active Directory Certificate Services misconfiguration
- Credential harvesting from memory, shares, scripts and group policy
- Lateral movement and local administrator reuse across the estate
- Sensitive data discovery on open file shares
- Segmentation between user, server and management networks
- What your endpoint protection and logging actually noticed
How it runs
From scoping call to retest, here’s what happens.
Typically one to two weeks, depending on the size of the estate.
2
Start where an attacker starts
On-site or through a connected device, we begin with exactly the access a new employee would have.
3
Follow the paths
We enumerate the domain, collect what is reachable and escalate along real, evidenced paths rather than theoretical ones.
4
Note what was seen
We record which actions your tooling detected and which it did not — useful whether or not detection was in scope.
5
Report, readout and retest
The report shows the full attack path with the cheapest place to break it, followed by a readout and a retest.
What it surfaces
The kind of thing this test tends to find.
Real examples of what this engagement uncovers — anonymized, and never every time. What matters is that you find out before somebody else does.
A path from a standard user account to full domain control
Service accounts with weak passwords and far more rights than the service needs
Local administrator passwords shared across hundreds of machines
Certificate templates that let any user request a certificate as anyone else
File shares holding credentials, exports and backups readable by everyone
Frameworks this test supports
Testing that counts toward your framework.
These programs call for this test, or their assessors and your customers expect it. If one of them is on your desk, readiness and testing come from the same team.
ISO 27001
Network security, security of network services and segregation of networks (controls 8.20 to 8.22) are easier to defend in audit when an internal test has checked them.
ISO 27001 readinessPCI DSS
Requirement 11.4.2 calls for internal penetration testing on the same basis, covering the cardholder data environment perimeter and critical systems.
PCI DSS readinessHITRUST
Internal testing gives evidence that controls on the in-scope network hold against an attacker who is already inside.
HITRUST readinessCMMC
An internal test shows whether a compromised workstation can reach CUI, which is direct evidence for access control and boundary requirements. Level 3 adds a penetration testing requirement from NIST SP 800-172 (CA.L3-3.12.1e).
CMMC readinessNIST SP 800-171
Requirement 3.12.1 asks you to periodically assess whether your controls are effective. An internal test answers that directly for access control and least privilege around CUI.
NIST SP 800-171 readinessHIPAA
The risk analysis must cover vulnerabilities, not just policies; an internal test shows how far an attacker on your network could get toward systems holding ePHI.
HIPAA readinessNIST CSF
Tests identity, access control and segmentation outcomes from the inside, where profiles are often scored more generously than reality.
NIST CSF readinessRisk assessment
Shows how far an attacker or a compromised account can move once inside, informing impact ratings and the real value of segmentation and identity controls.
Risk assessment readinessBusiness continuity & DR
An internal penetration test shows whether an attacker who lands on a workstation can reach backup servers, hypervisors and domain controllers — the systems your recovery depends on.
Business continuity & DR readinessZero Trust
Shows how far an attacker can move laterally today, the clearest measure of how much implicit trust remains inside your network.
Zero Trust readiness Getting started
What you get, and what we need from you.
What you get
- Technical report — Every finding, the evidence behind it and clear guidance your engineers can act on.
- Executive summary — Your risk explained in plain language for leadership and the board.
- Attestation letter — Signed confirmation of testing to hand your auditors.
- Readout call — A walkthrough with the people who tested your systems.
- Retest — Confirmation your fixes worked, documented for whoever needs to see it.
What we need from you
- A network drop, a VPN account or a shipped testing device
- One standard domain user account (and optionally an unauthenticated start)
- Confirmation of any systems that must not be touched
- An escalation contact available during the test window
Missing something on this list? Bring it to the call — we scope around what you have.
Others in Network
Network
External network pentest
See everything you expose to the internet the way an attacker sees it.
Read moreNetwork
Network segmentation test
Prove your sensitive environments are truly isolated.
Read moreNetwork
Wireless network pentest
Keep Wi-Fi and wireless from becoming the way in, at every site you operate.
Read moreNetwork
Vulnerability assessment
Know every weakness across your estate, confirmed by a person and ranked by the risk it really carries.
Read more