Cyber Security Testing
Network Penetration Testing
Internal and external network exploitation, lateral movement and privilege escalation testing.
Every engagement includes manual validation, a two audience report and free re-testing.
Get a scoped quote+91 96682 00222What this actually is
Most breaches do not start with a clever zero day. They start with a forgotten server, a service account with a password from 2019, or a flat network where one compromised laptop can reach the domain controller.
We test your internal and external networks the way an attacker would work through them: get a foothold, escalate, move sideways, and see how far we get before anything notices. The interesting output is not a list of open ports, it is the attack path.
Where you have monitoring in place, we will also tell you what it caught and what it missed. That is often the more uncomfortable finding.
What we go after
- External perimeter enumeration and exposed service testing
- Internal network segmentation and lateral movement paths
- Active Directory attack paths, delegation and privilege escalation
- Credential exposure, password policy and service account hygiene
- Firewall, VPN and remote access configuration review
- Wireless network security where in scope
- Detection coverage: what your tooling saw while we worked
How we run it
- 01
Scope and authorise
Targets, testing windows, escalation contacts and safety limits, all agreed in writing before anyone touches anything.
- 02
Map the surface
We enumerate what is actually exposed, which is usually more than the asset register says.
- 03
Test by hand
Tooling gives coverage, our engineers give proof. Every finding is reproduced before it is written down.
- 04
Report
An executive narrative your board can act on, and a technical annexe with the exact request, payload and fix.
- 05
Re-test and sign off
Once you have fixed it we verify each one at no extra cost, then close the engagement properly.
What you receive
- Attack path narrative showing how a foothold becomes domain admin
- Finding-level technical detail with reproduction steps
- Network segmentation assessment against your intended architecture
- Detection gap analysis mapped to MITRE ATT&CK
- Prioritised hardening plan
- Free re-test of remediated findings
Who needs this
Organisations with an internal network worth protecting, which in practice means anyone with more than a handful of servers and a domain.
How long it takes
One to three weeks depending on the size of the estate.
Standards this satisfies
- CERT-In
- ISO 27001
- PCI DSS
- RBI
- MITRE ATT&CK
Why it matters
Most organisations have a reasonable perimeter and a flat interior. Once an attacker is inside, through a phished credential or an exposed service, the question is how far they can move and how fast. That is what this answers.
It is also the test regulators most often expect to see. RBI, SEBI and CERT-In empanelment requirements all assume periodic infrastructure testing by an independent party.
Choose the depth you actually need
Most of the price difference between quotes comes down to this one choice, and it is rarely explained. Pick one to see what it covers, what it suits and what it costs you.
You give us working accounts at each privilege level and a short walkthrough. We then test what a real attacker reaches after the first stolen password, which is where the findings that matter almost always live. This is what we recommend for most engagements.
Choose this when
- Any application with authenticated functionality
- Multi-tenant products, where tenant isolation is the real risk
- Getting the most findings for the money
Effort and cost
Moderate effort and by far the best coverage per rupee. Most of the serious findings we report come out of authenticated testing rather than unauthenticated.
Method aligned to PTES and NIST SP 800-115
Infrastructure testing follows the Penetration Testing Execution Standard and NIST SP 800-115, so the phases and the evidence are recognisable to any assessor who picks up the report, and two tests a year measure the same thing.
Scope it yourself, before you call anyone
Answer a few questions and you get an indicative number, the working behind it and what your answers tell us. It runs in your browser, so nothing you type reaches us.
What needs testing?
Pick everything in scope. Effort is driven by unique functionality, not by how many IP addresses you own.
What we look for, and keep finding
These are the classes of problem this work exists to surface. Not every engagement finds all of them, but these are the ones that turn up often enough to be worth naming.
Exposed management interfaces
Administrative panels, database ports and remote access services reachable from places they should not be. Usually the result of a firewall rule added for a project and never removed.
Weak and reused credentials
Default passwords still in place, service accounts sharing a password across systems, and credentials that survive in scripts and scheduled tasks long after the person who wrote them left.
Missing patches on reachable services
We prioritise by what is actually reachable and actually exploitable rather than by scanner severity, because a critical on an unreachable host matters less than a medium on your perimeter.
Flat internal networks
Once inside, an attacker can reach everything. We test lateral movement explicitly: from a compromised workstation, what can we get to, and how long does it take.
Active Directory weaknesses
Kerberoastable accounts, unconstrained delegation, excessive privilege and stale administrative groups. Domain escalation is usually a chain of small misconfigurations rather than one flaw.
Who runs your engagement
A senior tester, named before you sign
Testing is led by an engineer holding OSCP, CREST or equivalent, and you are told who it is before the engagement starts. They write the report themselves rather than handing notes to someone else, and they are on the call when findings are walked through. If the person changes, we tell you why.
Questions we get asked
Internal or external, which do we need?
Both, and for different reasons. External tells you what is reachable from the internet. Internal tells you what happens after somebody clicks a link, which is how most incidents actually begin.
Do you need domain credentials?
For an assumed-breach internal test, yes, a standard user account. That is deliberately how an attacker would start, and it produces far more useful findings than testing blind.
Will this trigger our SOC?
We hope so. If it does not, that is a finding in itself, and we will report it. You can choose whether to inform your SOC in advance depending on whether you want a detection test as well.
Often scoped alongside
- Web Application Security TestingOWASP-aligned manual and automated testing of web applications, with validated proof-of-concept for every finding.Read more
- Mobile Apps Security TestingAndroid and iOS binary, runtime and API-layer assessment against OWASP MASVS.Read more
- API Security TestingAuthentication, authorisation, rate-limiting and business-logic testing across REST, GraphQL and gRPC.Read more
- Cloud Penetration TestingAWS, Azure and GCP configuration review, IAM privilege analysis and cloud-native exploitation.Read more
Ready to scope your network penetration testing?
Thirty minutes with a senior engineer, and you leave with a written scope and indicative effort.