Penetration Testing

Infrastructure Penetration Testing: Internal and External Network

An infrastructure penetration test covers the external perimeter, the internal network, Active Directory and, when in scope, the wireless network; the report follows within 5 business days.

What is tested and why it matters

From perimeter exposure to internal lateral movement, mapped and validated.

Network infrastructure changes constantly. New services are deployed, firewall rules accumulate, and Active Directory configurations drift from their intended state. Each change introduces potential weaknesses that automated vulnerability scanners alone cannot evaluate in context. An infrastructure penetration test applies the same techniques a real attacker would use, confirming which weaknesses are exploitable and how far a compromise can reach across network boundaries.

Standards PTES, NIST SP 800-115, MITRE ATT&CK

Attack surface External perimeter, internal network, Active Directory, VPN, firewall rules, wireless network

Approach Automated scanning with Nessus combined with manual exploitation and lateral movement

Who needs this assessment

Organisations that depend on network infrastructure for critical operations.

This assessment is designed for organisations with corporate networks, data centres, or remote access infrastructure where a compromise could enable lateral movement to critical systems.

Organisations with corporate networks, data centres, or co-located infrastructure

Organisations operating Active Directory or Azure AD environments

Companies with VPN gateways, remote access infrastructure, or perimeter-facing services

Organisations in regulated sectors requiring periodic network security validation

Companies preparing for ISO 27001, NIS2, or PCI-DSS compliance audits

Healthcare organisations, government agencies, and critical infrastructure operators required to demonstrate NIS2-compliant network security validation

Where these assessments are relevant

Financial services: customer portals, payment processing, and cloud-hosted transaction infrastructure.
SaaS and technology: application validation before production deployment or enterprise procurement.
Healthcare: digital systems handling patient data, clinical records, and connected medical devices.
Retail and e-commerce: web applications processing transactions, customer accounts, and payment data.

What the assessment produces

The insight and evidence delivered at the conclusion of the assessment.

Every assessment concludes with a structured report covering technical findings, severity ratings, evidence, and remediation guidance. Reports are delivered through the Pentrox Portal and are available for download at any time.

A clear view of exploitable weaknesses across external and internal network infrastructure
Documented privilege escalation and lateral movement paths with evidence
Validation of network segmentation effectiveness between trust zones
Prioritised remediation guidance structured for both technical teams and management
Portal access with real-time findings, retest workflow, and report downloads for the lifetime of the client account

How an assessment runs

Scope and Intake
Planning
Assessment
Reporting
Findings & Retest

Retesting of remediated findings is included as standard with every assessment.

Assessment methodology

Five phases from reconnaissance through verified remediation.

Each phase builds on the previous one. Reconnaissance informs targeted exploitation, manual validation confirms scanner output, and quality review ensures every reported vulnerability is reproducible.

Reconnaissance and enumeration

Port discovery with Nmap and service fingerprinting map the attack surface. Nessus scans identify known vulnerabilities across all reachable hosts.

NIST SP 800-115 (Discovery), PTES (Intelligence Gathering)

Vulnerability analysis and validation

Scanner output is manually verified to remove false positives. Configurations, TLS settings, and management interfaces are reviewed against hardening baselines.

NIST SP 800-115 (Technical Testing), PTES (Vulnerability Analysis)

Exploitation and privilege escalation

Confirmed vulnerabilities are exploited in a controlled manner. Active Directory abuse (Kerberoasting, Pass-the-Hash) is tested with BloodHound and Responder.

PTES (Exploitation), MITRE ATT&CK (Credential Access, Lateral Movement)

Lateral movement and segmentation testing

From each compromised position, lateral movement is attempted across network segments. Group policy, share permissions, and service accounts are analysed.

PTES (Post-Exploitation), NIST SP 800-115 (Network Mapping)

Reporting and quality review

Findings are documented with evidence, severity rating, and remediation steps. Reports undergo internal quality review by a senior tester before delivery.

OWASP Risk Rating Methodology (severity rating), PTES (Reporting)

Scope and deliverables

What is included, what is excluded, and what is delivered.

The statement of work defines the exact hosts, network segments, and testing approach before the assessment begins. The lists below reflect the standard scope for an infrastructure penetration test.

In scope

External network perimeter (public-facing services, DNS, mail servers)
Internal network infrastructure (servers, workstations, network devices)
Active Directory and identity services (domain controllers, group policy, trust relationships)
Firewall, VPN, and perimeter device configuration review
Network segmentation validation between defined trust zones
Service account and shared credential analysis
Privilege escalation and lateral movement assessment
Automated vulnerability scanning combined with manual validation
Wireless network (WiFi) assessment, when in scope: WPA2 or WPA3-Enterprise configuration, guest network separation and rogue access point detection

Out of scope

Denial-of-service testing unless explicitly agreed in the statement of work
Physical access testing (covered under Mystery Guest)
Application-layer testing of web interfaces (covered under Web and API Penetration Testing)
Social engineering of employees (covered under Phishing Simulation)

What you receive

Executive summary Severity distribution, risk overview, and remediation priorities written for leadership.
Detailed findings Each vulnerability documented with evidence, reproduction steps, OWASP risk rating, and remediation guidance.
Technical conclusion Network-wide patterns, segmentation gaps, and structural recommendations beyond individual fixes.
Scope and strategy description Goals, test approach, and scope boundaries for audit traceability.
Portal access Real-time findings, report downloads, retest workflow, and team management through a dedicated platform.
Findings meeting A scheduled session to align on risks, priorities, and the remediation approach.
Retest report Verification results after remediation, documenting each finding with its updated status.

Pentrox Portal report library showing the four report types available for download

See what a Pentrox report looks like before you decide

Vulnerability scan or penetration test

A scan finds known weaknesses automatically; a penetration test proves what an attacker can do with them.

Wireless network assessment in 2026

WPA3, 6 GHz and what a wireless assessment checks today.

How to prepare for a penetration test

What to decide before scoping, what to deliver before the start, and who should know.

When independent assessment is the right step

An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.

Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.

Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.

Request a scoping call

Timeline

Illustrative durations to support planning. Confirmed in the statement of work.

The duration of an infrastructure penetration test depends on the number of hosts, network segments, and whether internal testing is combined with external testing. The calibration bands below are indicative. Exact duration is confirmed in the statement of work.

Small scope 4 to 5 testing days External perimeter only, limited host count, no Active Directory in scope

Core scope 5 to 10 testing days Combined external and internal testing with Active Directory and segmentation validation

Complex scope 10+ testing days Large enterprise network with multiple domains, forest trusts, and geographically distributed segments

Report delivery 5 business days Initial report and management report are delivered shortly after testing is completed.

Retest Included as standard Retesting within 90 days after report delivery is included at no additional cost.

What determines duration

Number of in-scope hosts and network segments
Whether external and internal testing are combined in a single assessment
Complexity of the Active Directory environment and trust relationships
Number of VPN gateways, remote access systems, and perimeter devices
Whether testing is performed in a production or non-production environment

Actual duration is confirmed during scoping and depends on host count and network complexity. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after completion of testing.

Why Pentrox

The operational standards behind every infrastructure assessment.

These operational standards apply to every infrastructure penetration test Pentrox delivers, regardless of scope or network size.

External and internal coverage

Both sides of the perimeter, one assessment.

The assessment covers both the external attack surface and the internal network. Segmentation between trust zones is explicitly validated during lateral movement testing.

Active Directory abuse testing

The techniques real attackers use against identity services.

Kerberoasting, Pass-the-Hash, and group policy abuse are tested using BloodHound and Responder where Active Directory is in scope.

Senior-led, manually validated

Every finding confirmed by an experienced ethical hacker.

Automated scanner output is manually verified to eliminate false positives. The assessment is performed or supervised by ethical hackers with recognised certifications.

Direct access to the tester

No account managers between the client and the security expert.

Critical or blocking findings are escalated immediately through the channel agreed at kickoff. Remediation can begin before the final report is delivered.

Portal-delivered results

Findings visible in real time through the Pentrox Portal.

The Pentrox Portal provides remediation tracking, retest requests, report downloads, and team access management. Two-factor authentication and role-based access control are enforced on every account.

Frequently asked questions

Practical answers for security teams and procurement officers.

Is the methodology aligned with recognised standards?

The assessment follows PTES, NIST SP 800-115, and MITRE ATT&CK. These frameworks define the phases, techniques, and reporting structure used throughout the assessment.

Is retesting included, and at what cost?

Retesting of remediated findings is included as standard with every assessment. There are no additional charges. The client flags remediated findings through the Pentrox Portal and submits a retest request. Results are published through the Portal once the verification is complete.

What clearances do the testers hold?

All Pentrox employees undergo PES (Personnel Screening) background checks upon commencement of employment. Team members hold one or more industry-standard certifications such as OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES and BSCP. Every assessment is performed or supervised by senior penetration testers.

Can this report be used as audit evidence for ISO 27001 or NIS2?

The report is structured for audit traceability, with a clear scope description, named standards, severity ratings, and remediation status per finding. Penetration test reports structured in this format are routinely used as supporting evidence for ISO 27001 and NIS2 assessments. It is worth noting that the report documents the technical assessment; it does not replace the audit itself.

How is production impact managed during internal testing?

All testing is performed in a controlled, non-destructive manner. Pentrox recommends testing in a non-production environment where possible. Where production systems are in scope, testing windows, excluded operations, and escalation contacts are agreed in the statement of work before the assessment begins.

Is reporting available in Dutch?

Reports are delivered in English by default. Dutch-language reporting can be arranged when required. The statement of work confirms the reporting language before the assessment begins.

How is assessment data handled and who has access to findings?

Findings, reports, and project data are stored in the Pentrox Portal, hosted on a dedicated VPS in a datacenter in the European Union. Access is controlled through mandatory two-factor authentication and role-based permissions. The client manages team membership. Data remains accessible for the lifetime of the client account and is removed only on explicit request.

What happens when a critical vulnerability is found during testing?

Critical or blocking vulnerabilities are communicated immediately through the channel agreed at kickoff. Findings are published in the Pentrox Portal as they are confirmed, so remediation can begin before the final report is delivered. The escalation path is documented in the statement of work.

Is a WiFi pentest part of an infrastructure penetration test?

Yes, when the wireless network is in scope. The tester checks the WPA2 or WPA3-Enterprise configuration, verifies that the guest network is separated from the corporate network, and tests whether a rogue access point or a captured handshake leads into the internal network. The WiFi part is usually planned on site, together with the internal test.

Is an internal test needed if the external perimeter is already tested every year?

In most breaches the attacker is already inside, through phishing, a stolen laptop or a compromised supplier account. The internal test shows how far such an attacker gets: which shares are readable, which service accounts can be abused and whether segmentation stops movement between zones. Combining external and internal testing in one assessment is the most common scope.