Identify exploitable weaknesses in your network.

The duration depends on the environment being tested. Factors such as the number of offices, networks, machines, servers, and employees in your organisation are all considered during scoping. A small office network will require fewer days than a large enterprise with multiple sites and complex Active Directory environments. We agree the exact duration during scoping so you receive a fixed-price proposal before any work begins.

External testing assesses your internet-facing infrastructure, including firewalls, VPN gateways, and public-facing services, simulating an attacker with no prior access. Internal testing simulates a threat actor who has already gained a foothold inside your network, such as a compromised employee device or a malicious insider, and attempts to escalate privileges and move laterally. Most organisations benefit from both.

Internal penetration testing can be performed remotely, either by shipping a preconfigured testing device to your office which plugs directly into your network, or by deploying a virtual machine on your existing infrastructure that our testers connect to securely. Both options provide the same depth of assessment as an on-site engagement. If you would prefer our testers to attend your premises in person, on-site testing can also be arranged on request.

Industry best practice is to conduct a network penetration test at least annually, and after any significant infrastructure changes such as new office locations, cloud migrations, or major network reconfigurations. However, as new vulnerabilities and attack techniques are discovered at an increasing rate, many organisations choose to test more frequently. Regular internal testing in particular helps identify emerging risks such as newly exploitable services, credential weaknesses, and changes to Active Directory that may have introduced unintended exposure.