Network Penetration Testing Services

External network penetration testing

The agents start where an attacker does: with your domains and public address ranges. They map every exposed host and service, then go after what matters.

• Remote access: VPN gateways, SSH, RDP, and admin panels exposed to the internet, including known exploited vulnerabilities in their versions.
• Forgotten hosts: old environments, staging servers, and services that no longer appear in your inventory.
• Mail and DNS: open relays, spoofing protections, subdomain takeover, and zone transfer.
• TLS and authentication: weak protocols, default and leaked credentials, and login endpoints without rate limits.
• Web services found on the way get the same testing as a web application pentest when they are in scope.

Internal network penetration testing

An internal test answers a different question: if an attacker gets one foothold, through a phished laptop, a stolen VPN account, or a compromised server, how far can they go? You give the agents that foothold, a VM, a VPN account, or a host in a named segment, and they work outward from it.

• Lateral movement: which hosts and services the foothold can reach, and which credentials found on the way work elsewhere.
• Credentials and secrets: exposed shares, configuration files, tokens, and keys, recorded by fingerprint, never copied verbatim.
• Identity: directory services, weak authentication between hosts, and paths to administrative accounts.
• Management planes: hypervisors, orchestration, backups, and monitoring systems an attacker could use to control everything else.

The report shows the chains, not only the single findings. A readable database, then a certificate in it, then access to every tenant is one finding with three steps, and it is rated by where it ends.

Segmentation testing

If you rely on network segmentation to keep a sensitive zone apart, such as a PCI cardholder data environment, a production network, or tenant networks, the test checks that the separation holds. Probes run from each named position toward each protected range, and the result for every pair is recorded as reached or blocked.

If you use segmentation to reduce PCI scope, PCI DSS requires testing it at least every 12 months, and every six months for service providers. See the PCI DSS penetration testing guide.

Paths proved, not port lists

A port list is not a finding. For every path the report claims, the agents record evidence that tells a delivered packet from a dropped one. A refused connection shows something on the path answered, so the agents check whether it was the target host or a firewall rejecting the packet. A timeout shows it was dropped or went unanswered. Each check runs in a pair from the same position, one expected to pass and one expected to be blocked, so the two readings can be told apart and a misread firewall rule shows up straight away.

Illustrative example of how paired-check results appear in a report.

A second agent, which did not find the issue, then has to reproduce it. If it cannot, the finding stays out of your report.

What's in the report

• Methodology and the signed rules of engagement, so an auditor or customer can see how the test was run.
• Scope: every host, range, and segment tested, and the position each test ran from.
• Findings rated by what an attacker reaches, each with the evidence captured for it and a fix.
• The reproduction result for each finding from the second agent.
• Retest results for every fix, free and unlimited.

Findings also arrive in the portal as tickets your engineers can work from. Technical, executive, and compliance-mapped versions of the report are available, with an attestation letter.

What to provide

• For external tests, the domains and public address ranges in scope. Each one is checked for ownership before testing.
• For internal tests, the position to test from (a VM, VPN account, or host) and the address ranges it may reach.
• Any hosts or services to exclude, and the hours testing may run.
• For white box, firewall rules, network diagrams, or infrastructure code. Everything you upload in the portal is pinned by SHA-256 to the signed scope.

Safe on production networks

Testing is detect-only by default. There is no denial of service and no unbounded brute force, and sweeps run at the rate you agree. Every request passes a scope guard that blocks hosts outside the signed ranges. Anything that would change state needs explicit permission in the rules of engagement and a rollback plan written first. Agents run on private inference, so your network data is not sent to a third-party model provider.

Pricing and retesting

The final price depends on the number of hosts and address ranges and is confirmed before testing starts. Retesting is free and unlimited. Running in the cloud? The cloud penetration test adds a review of IAM and account configuration.

Frequently asked questions