Focused on internal networks, Active Directory and Azure AD (Microsoft Entra ID). We can also cover AWS/GCP identity and hybrid environments.
An internal pentest (grey-box) or internal audit starts from an authorized connection to your internal network that you provide (for example, a standard network user via VPN or a computer connected to the network).
The goal is to safely discover and validate all vulnerabilities and misconfigurations that could be chained together to compromise the internal network, starting from the initial access point. We then document exactly how each issue was found, its impact on the business, and the prioritized remediation. Only the internal network is tested; external, social engineering, and physical components are not included. Identify attack paths
We can augment manual testing with AI agents when it benefits coverage or speed. The level of AI involvement is chosen per engagement by the operator/pentester.
Tip: Click a question to expand the answer.
Internal network only. We focus on on-prem Active Directory, Microsoft Entra ID (Azure AD), and any internal services reachable from the provided access point (VPN/jump host/VDI). External perimeter, social engineering, and physical testing are out of scope.
You provide an authorized foothold (e.g., a standard AD user via VPN or a domain-joined workstation). We do not phish, spray, or brute-force to obtain access. From that foothold we emulate a post-compromise attacker operating inside your network.
Objective: identify every realistic path to impactful compromise (privilege escalation, lateral movement, sensitive data access) and safely prove exploitability. Deliverables: an executive summary and a technical report detailing how each finding was discovered, the business impact, severity, and clear remediation steps - plus a live readout and an optional retest to verify fixes.
Yes. We use non-destructive techniques by default, follow pre-agreed Rules of Engagement, schedule intrusive steps in change windows, and coordinate with your SOC/IT. We avoid DoS conditions, mass credential lockouts, and any ransomware-style actions.
As soon as scope and Rules of Engagement are signed and initial access is provisioned. Typical prerequisites: written authorization, a point of contact, VPN/jump-box details, one standard user in scope, any necessary allow-listing in EDR/IPS, and a high-level network/AD diagram.
Tell us about your internal environment. We’ll respond with scope, approach, and a fixed quote.
