Internal Network Penetration Testing
What Could an Attacker Reach From Inside?
An internal penetration test assumes someone already has a foothold, such as a phished laptop or an unknown device plugged into your network, and shows how far they could get. Testing is delivered by qualified specialists, subject to specialist availability and approval, and coordinated by Pulsar IT.
What is Internal Network Penetration Testing?
Firewalls and email filtering keep many threats out, but not all of them. A member of staff opens a convincing phishing email, a visitor plugs into a spare network socket, or a supplier's laptop is already infected. Once inside, an attacker's aim is to move from that first device to the systems and data that matter.
An internal network penetration test recreates that situation with your written permission. Qualified testers start from an agreed position inside your network, such as an ordinary network connection or a standard staff account, and try to discover systems, gain higher privileges and move between parts of the network, within agreed rules.
Pulsar IT agrees the scope and starting point with you, coordinates the testers, subject to specialist availability and approval, and helps you prioritise and fix what they find.
Key benefits
- A realistic view of how far one compromised device could lead
- Weaknesses in accounts, permissions and Active Directory brought to light
- Evidence of whether your network segmentation actually works
- Risk-prioritised findings with practical recommendations
- Fixes planned and delivered alongside your managed IT
How does it work?
The test begins from an agreed point inside your network. How the testers get there, for example a test device placed on your network on-site or remote access to a device on your network, is agreed during scoping.
Scope and authorise
We agree the sites, networks and systems in scope, the starting point, anything that must not be touched and the testing window. The system owner authorises the test in writing, and permission is confirmed for any third-party or cloud-hosted systems included.
Arrange access
The agreed delivery method is put in place, with clear arrangements for when the testers' access is active and how it is removed when testing ends.
Test
Qualified specialist testers explore what can be reached from the starting point, looking at identity and Active Directory weaknesses, gaps in segmentation, weak protocols and unpatched systems, and whether these can be combined to move further.
Report, fix and retest
You receive a risk-prioritised report with recommendations. Pulsar IT helps you plan and make the fixes, and an optional retest confirms they worked.
- Scope and authoriseWritten permission, starting point and exclusions
- Agreed starting pointA device or staff account inside your network
- TestAccounts, segmentation, protocols and lateral movement
- ReportAttack paths and findings rated by risk
- Remediate and retestFixes with Pulsar IT, then an optional retest
Typical areas tested
- Active Directory and identity: weak passwords, excessive privileges and misconfigured or forgotten accounts
- Network segmentation: whether guest, phone, CCTV, smart-device and server networks are properly separated
- Lateral movement: whether access to one device can be used to reach others
- Weak or legacy network protocols that can expose passwords or allow traffic to be intercepted
- Unpatched internal servers and systems
- File shares and permissions that expose sensitive data more widely than intended
- Management interfaces of switches, printers and other networked devices
- Separation between wireless and wired networks, where included in scope
Internal scanning or an internal penetration test?
Internal vulnerability scanning, through endpoint scanning or a network vulnerability assessment, lists known weaknesses on individual devices. It is essential housekeeping, but it looks at each device on its own.
An internal penetration test looks at the connections between them. Testers chain together issues a scanner might rate as minor, such as a weak service account password, an old file-sharing protocol and a network with no internal separation, to show a realistic path from one laptop to your most important systems. That needs human judgement, written authorisation and agreed rules.
Rules of engagement for testing inside your network
Testing inside a live network needs more care than testing from outside, because the testers are working alongside your staff and business systems. These points are agreed in writing before testing begins.
Starting point
Whether testers begin as an unknown device on the network, or with an ordinary staff account to simulate someone whose password has been stolen.
Systems to avoid or handle carefully
Fragile or business-critical systems can be excluded, or tested only in agreed windows.
Accounts and data
How passwords and information uncovered during testing are handled, stored and deleted, and what testers must not open or copy.
Stop conditions and clean-up
Who is contacted immediately if a critical issue or sign of a real intrusion is found, and how test accounts, tools and devices are removed afterwards.
Problems solved
A flat network
When every device can reach every other device, one infection can spread everywhere. Testing shows whether separation between networks really works.
Too many administrators
Excessive admin rights and old service accounts give attackers shortcuts to control of your systems.
Legacy systems and protocols
Older servers and network protocols can leak passwords or be easy to take over. Testing shows whether they are a real route for an attacker.
Not knowing the impact of a phishing incident
If a member of staff were phished tomorrow, what could the attacker reach? An internal test answers that question with evidence.
What's included
Included as standard
- Scoping of the internal networks, sites, starting point and exclusions
- Coordination of written authorisation and rules of engagement
- Internal testing from the agreed starting point by qualified specialist testers, subject to their availability and approval
- A risk-prioritised report describing attack paths, findings and remediation recommendations
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- A retest once remediation is complete
- Remediation by Pulsar IT, such as account clean-up or segmentation through Secure Your Network, scoped separately
- External Network Penetration Testing
What's not included
- Testing of systems without written authorisation from their owner
- Phishing and physical security testing; for staff phishing tests see Phishing Simulations
- Remediation work, unless scoped separately
- Cloud services and web applications, which need separate assessments
An internal test shows what could be reached within the agreed scope and time. It won't find every weakness, and new devices, accounts and vulnerabilities change the picture over time.
Testing inside a live network carries some risk of disruption. Fragile systems can be excluded or tested in agreed windows, and emergency contacts are agreed before testing starts.
Delivery depends on specialist availability and approval. The delivery method, on-site or remote, and the dates are confirmed during scoping.
Who it's suitable for
- Businesses with on-premises servers, file shares or Active Directory
- Organisations that have grown quickly, merged networks or added sites
- Businesses that have recently segmented their network and want it checked
- Organisations that want to understand the likely impact of a phishing or ransomware incident
Pricing
Internal tests are scoped around your sites, networks and the starting point you want simulated, so the price is confirmed after we have reviewed your requirements.
Use the quote builder to add Internal Network Penetration Testing to an indicative quote, or book a free security review and we'll recommend what fits.
Price
Price Based on Scope
Price to be confirmed following a review of your requirements.
What affects the price
- Number of sites, networks and segments in scope
- Approximate number of servers, devices and user accounts
- Starting point: an unknown device or an ordinary staff account
- Delivery method: on-site test device or remote access
- Systems that need special handling or restricted testing windows
- Whether a retest is included
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
Why test inside the network if we have a firewall?
A firewall controls traffic at the edge of your network. Many attacks start with something already inside, such as a phished laptop, so an internal test checks what happens after the perimeter has been passed.
How do the testers get onto our network?
The delivery method is agreed during scoping. It might be a test device connected on-site, or remote access to a device on your network. Either way, access is controlled, time-limited to the testing window and removed afterwards.
Will the testers see our confidential data?
They may come across sensitive information while demonstrating access. The rules of engagement set out what they can and can't open, and how anything they handle is protected and deleted after the test.
Does the test include Microsoft 365 or other cloud services?
An internal test focuses on your own networks and systems. Cloud services are reviewed separately, for example through a Cloud Security Assessment or Microsoft 365 Security Assessment.
What happens if the testers find a serious problem mid-test?
The rules of engagement include stop conditions. If testers find a critical issue or signs that someone else is already in your network, they contact the agreed people straight away so it can be dealt with.
Do we need an external test as well?
They answer different questions. An external test asks whether someone on the internet can get in; an internal test asks how far they could get once inside. Which to start with depends on your setup, and we can advise during scoping.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.