Network Penetration Testing

Know exactly how far an attacker can get inside your network.

Unpatched services, misconfigured devices, weak credentials, and inadequate segmentation – network vulnerabilities exist in every environment. AMATAS network penetration testing maps your exposure and shows exactly what an attacker could reach from the outside, and how far they could move once inside.

Your network is the environment attackers move through after they’ve gained a foothold – whether through phishing, a compromised credential, or an exposed service. Network penetration testing answers two critical questions: what can an attacker reach from outside your perimeter, and how far can they move once they’re inside?

AMATAS combines automated scanning with expert manual testing to find the vulnerabilities your infrastructure team may have missed – and to show you exactly what an adversary could do with them, from initial access through to domain compromise

Coverage types

External & internal network penetration testing

External and internal testing answer different questions. Most organizations need both – and combining them gives you the clearest picture of your end-to-end network risk.

External network penetration testing

Simulates an attacker targeting your organization from the internet – identifying exploitable vulnerabilities in your external-facing infrastructure before they’re used as an entry point.

Internet-facing servers & services
Exposed management interfaces
Perimeter firewall & DMZ testing
VPN & remote access security
Email & DNS security review

Internal network penetration testing

Simulates an attacker who has already gained internal access – through phishing, a compromised device, or a malicious insider – and is moving through your network toward critical assets.

Internal host & service enumeration
Lateral movement & privilege escalation
Active Directory attack paths
Credential theft & relay attacks
Network segmentation validation

Test coverage

What we test in every network penetration test

Host & service discovery

Full enumeration of live hosts, open ports, running services, and software versions across the in-scope network range.

Vulnerability exploitation

Active exploitation of identified vulnerabilities to demonstrate real-world impact – not just a list of CVEs from a scanner.

Credential attacks

Password spraying, default credentials, NTLM relay attacks, Kerberoasting, and credential reuse across the environment.

Lateral movement

Testing how far an attacker can move through your network after initial access – pivoting between hosts toward high-value targets.

Privilege escalation

Exploiting misconfigurations and vulnerabilities to escalate from low-privilege access to administrative or domain-level control.

Segmentation validation

Testing whether network segmentation controls actually prevent unauthorized traffic between zones – confirming isolation works as intended.

Service tiers

Choose the right level of testing

From compliance-ready assessments to continuous network security monitoring – our three tiers are designed to match your security maturity and operational needs.

Essential Testing

Fast, compliance-ready network assessment – combining automated scanning with expert validation to identify and prioritize your most critical exposures.

External and/or internal scope
Automated scanning + expert validation
Risk-ranked, audit-ready report
NIS2, ISO 27001, GDPR aligned

Elite Testing

Full manual network penetration test including Active Directory attack path simulation, lateral movement, and privilege escalation through to domain compromise.

Full manual expert-led engagement
Active Directory attack path testing
Lateral movement & domain compromise
Executive + technical reporting
DORA, PCI DSS, NIS2 aligned

Continuous

Ongoing network security testing that keeps pace with your evolving infrastructure – new hosts, services, and configuration changes tested as they appear.

Conducted throughout the year in recurring cycles
Additional testing after significant changes and deployments
Ongoing validation of security improvements
Centralized management of findings and remediation activities

What you receive

Deliverables from every engagement

Technical report

Risk-ranked findings with CVSS scores, exploitation evidence, lateral movement documentation, and step-by-step remediation guidance.

Executive summary

A non-technical overview of your network risk exposure and remediation priorities – ready for leadership and board reporting.

Attack path mapping

Visual documentation of lateral movement paths and privilege escalation chains – showing the realistic impact of a successful initial compromise.

Remediation testing included

Free retest performed that confirm the remediation of the reported vulnerabilities after all necessary fixes have been applied.

Compliance support

Regulatory frameworks this service supports

Our network penetration testing reports are structured to provide audit-ready evidence across the following frameworks and standards:

FAQ

Network penetration testing - common questions

What is the difference between external and internal network penetration testing?

External network penetration testing simulates an attacker targeting your organization from the internet – identifying vulnerabilities in your internet-facing infrastructure that could be used as an initial entry point. Internal testing simulates an attacker who already has network access – through phishing, a compromised device, or an insider threat – and is attempting to move laterally toward high-value systems. Both answer different questions, and most organizations benefit from testing both.

Will network penetration testing disrupt our production environment?

We define explicit rules of engagement before testing begins, including which systems are sensitive to active exploitation and whether any assets require exclusion. We conduct testing in a controlled manner and maintain a direct communication channel throughout – so any unexpected impact on production systems can be addressed immediately. For sensitive environments, we can schedule testing during maintenance windows.

Do you test Active Directory environments?

Yes – Active Directory testing is a core part of our internal network penetration testing methodology. We assess the full spectrum of AD attack paths – Kerberoasting, AS-REP Roasting, Pass-the-Hash, Pass-the-Ticket, DCSync, ACL abuse, and BloodHound-mapped privilege escalation paths. For organizations where domain compromise is the most critical risk scenario, AD testing is typically the highest-value part of an internal engagement.

How often should we conduct network penetration testing?

Most organizations conduct network penetration testing annually at minimum, with more frequent testing if your infrastructure changes regularly, you operate in a regulated sector, or you’ve recently experienced a security incident. DORA mandates regular threat-led testing for financial entities, and PCI DSS requires annual penetration testing alongside quarterly vulnerability scans. Our Continuous Testing tier is designed for organizations that need ongoing assurance rather than a point-in-time snapshot.

Ready to test your network?

Talk to our team – we’ll scope the right engagement for your infrastructure, compliance requirements, and threat profile.

Often combined with network penetration testing

Network Segmentation Testing

Dedicated validation that your network segmentation controls actually enforce the isolation they’re designed to provide.

Firewall & Configuration Assessment

Expert review of your firewall rules & network device configurations – identifying overly permissive rules and configuration drift.

Cloud Penetration Testing

Cloud-native penetration testing that completes the picture alongside network testing for hybrid environments.