AtlantSECURITY Let’s talk
Menu

Penetration Testing

Network Pentest: Penetration Testing That Proves How Far One Workstation Can Reach. Report in 14 Days, Free Retest.

Most networks fall through an ordinary credential. A reused local administrator password, or a service account whose Kerberos ticket cracks overnight, carries an intruder from one workstation to the whole domain.

Our network pentest is scoped around the paths an attacker actually travels: the internet-facing perimeter, lateral movement once someone is inside, the Active Directory privileged paths that end at Domain Admin, and the segmentation meant to keep your card-data and server zones apart from the rest. Every finding is a proven path with the hosts it reaches and the single change that closes it, mapped to the PCI DSS, NIST or DORA control your assessor will cite. Fixed price, report in 14 days, free retest.

  • External and internal testing, from the public internet and from a foothold inside
  • Active Directory paths walked to Domain Admin, each with the one change that closes it
  • Written rules of engagement, agreed windows and a stop condition both sides sign
Scope My Network Pentest View pricing See Client Results
PCI DSS 11.4NIST 800-53 CA-8NIST 800-171MITRE ATT&CKSOC 2DORA Art. 25
Network pentest: a network engineer patching a cable into a switch in an open cabinet - Atlant Security

Senior-led testing scoped the way a network is actually built: an exposed perimeter, a flat core, Active Directory in the middle, and the segmentation meant to hold it together.

See a sample pentest report ↗
Cover of the illustrative penetration test report

SEE THE DELIVERABLE

See what a useful
penetration test report looks like.

Review a combined engagement covering web, REST and GraphQL APIs, gRPC, SaaS tenant isolation, Android and iOS, networks, cloud, identity and CI/CD. Includes technical evidence, remediation and retest criteria.

62 pages. 24 findings. 14 charts, diagrams and matrices.
Illustrative penetration test. The organisation, systems and findings are fictional.

Get the sample report

A free PDF. Enter your email and company name, and we’ll email you a download link.

Use a company email address. Free and disposable email services are not accepted.

We’ll email you a download link and an invitation to discuss your security assessment needs. Privacy policy.

DEFINE YOUR SCOPE

Turn your testing requirements into a clear RFP.

Build one request for your applications, APIs, networks, and cloud. Review the scope, download your document, and send a copy to your inbox and our team.

Only questions relevant to your scope. Estimates and “not sure” are welcome.

200+Security Assessments
14Countries
14Days to Report
FreeRetest After Remediation
Alexander Sverdlov, founder of Atlant Security
Alexander SverdlovFounder, Atlant SecurityCISSP, CEH, CHFI, Mandiant

Leads every network engagement personally, walks the Active Directory paths by hand, runs the remediation workshop with your engineers and signs the attestation letter your assessor reads.

Connect on LinkedIn

01 / THE DETAIL

What a Network Pentest Actually Tests

A network pentest scopes by the paths an attacker travels, because that is how a foothold becomes a breach. Six boundaries cover almost every environment we assess, from a single-site office with one domain controller to a multi-site group carrying trusts from an old acquisition.

External perimeter

Every service you publish to the internet: web and mail servers, VPN and remote access gateways, DNS, and the hosts an old project left exposed and nobody retired.

Internal lateral movement

What a single foothold reaches. Local administrator reuse, cached credentials, open file shares and the management ports that let one workstation become many.

Active Directory privileged paths

The routes from a standard user to Domain Admin: Kerberoastable service accounts, AS-REP roasting, delegation, and certificate services left in an insecure default.

Segmentation between zones

Whether a user network can reach the server and card-data zones it is meant to be walled off from. PCI DSS 11.4.5 segmentation, tested by attempting the crossing.

Management and legacy protocols

Switch, firewall and hypervisor consoles, out-of-band management, and legacy protocols like LLMNR, NBT-NS and unsigned SMB that hand over credentials on a quiet network.

Wireless and remote access

Corporate and guest wireless, pre-shared keys and rogue access points, plus the VPN and split-tunnelling paths that connect a home or branch network to the core.

Each boundary becomes a question the test has to answer, and a line in the report.

02 / THE DETAIL

The Attack Paths That Repeat in Networks

These recur across the environments we assess, from a flat single-domain office to a group carrying old acquisition trusts. Most are invisible to a vulnerability scanner because every box is patched. The weakness is in who can reach what, and which credential unlocks the next host.

A service account with a crackable password

The account that runs backups, monitoring or a database job, registered with a weak password years ago and never rotated. Kerberoasting pulls the ticket and it cracks offline.

One local administrator password on every machine

A single local admin credential imaged across the whole fleet. One workstation gives up the hash and it unlocks all the others, with no exploit involved.

LLMNR and NBT-NS poisoning on a flat network

Legacy name resolution left enabled hands an attacker a credential from any workstation that mistypes a share name. Minutes of listening, a domain account captured.

Certificate services in their default state

A template that lets a standard user request a certificate for any identity. One request becomes authentication as Domain Admin, the ESC1 class of misconfiguration.

A forgotten internet-facing host

An old VPN appliance, test server or management portal still published, still running a version with a public exploit, outside the patch programme nobody mapped it to.

A flat path between office and card-data

Firewall rules meant to isolate the cardholder environment that still allow a management port or a dual-homed host to bridge in from an ordinary user network.

A phished workstation to Domain Admin without a single exploit against an unpatched system.

03 / THE DETAIL

What the Report Has to Prove, and to Whom

A network pentest report answers to two readers. Your engineers want reproduction steps and a fix. Your assessor wants proof that you tested inside and outside, understood the exposure and closed it. We write both into one document.

Every finding carries the control it bears on. For card environments the external, internal and segmentation checks are scoped to PCI DSS requirement 11.4. For US public-sector and defence suppliers the test supports the NIST SP 800-171 assessment that CMMC Level 2 relies on.

For EU financial entities it feeds DORA Article 25 testing, and designated entities move on to threat-led testing under DORA TLPT. A full configuration review of the directory is the Active Directory security assessment.

What each regime expects of a network test, and the part of the deliverable that answers it.
An office corridor at night with the communications room door ajar, where internal network testing takes place

04 / THE DETAIL

Rules of Engagement for Live Network Infrastructure

Testing a live network is a safety exercise as much as a security one. Before a single packet is sent in anger, both sides sign rules that a change-advisory board can read.

  • Destructive techniques excluded. We avoid denial-of-service, we do not run exploits that risk corrupting a service, and fragile legacy hosts are agreed as read-only before testing starts.
  • Agreed windows. Anything that touches production routing, authentication or the core switch fabric runs inside a window you set, with rollback steps written down before use.
  • A named contact and a stop condition. One escalation contact on each side, reachable throughout, and a written condition under which testing halts within minutes.
  • Evidence handling. Any credentials or data we capture are held encrypted for the engagement only and destroyed on a documented date. Captured hashes are wiped at the end.
  • Platform and vendor boundary. Hosted and managed infrastructure is tested at the access surface you control, inside the rules of engagement each cloud provider publishes for AWS, Azure and GCP.

05 / THE DETAIL

How the Engagement Runs

Five steps, the price fixed at the first one, the report inside fourteen days of the third.

1

Scoping call

Which ranges are external, which are internal, whether Active Directory and segmentation are in scope, and where the card-data environment sits. Fixed price and timeline in writing.

2

Rules of engagement

Test windows, escalation contacts on both sides, the no-destructive-technique rule, the legacy hosts held read-only, and a written stop condition.

3

Manual testing

Senior-led. Authenticated scanning for breadth, then the path work by hand: lateral movement, Active Directory escalation and the segmentation crossings that matter.

4

Report and workshop

Findings register with reproduction steps, executive summary with control mapping, network diagrams of each path, and a live remediation session with your engineers.

5

Retest and attestation

Free retest after you remediate, then an attestation letter signed by a named qualified individual, addressed to your board or your assessor.

06 / PRICING

Network Pentest Pricing

Each scope is a fixed price. A combined external and internal engagement goes into one proposal with volume pricing, and you approve the total before anything starts.

ScopeWhat is coveredTestingPrice
External perimeterInternet-facing IP ranges, VPN and remote access, mail, DNS, forgotten hosts5-7 daysFrom $4,000
Internal network and Active DirectoryInternal ranges, lateral movement, AD privileged paths, segmentation checks7-10 daysFrom $5,000

Every scope includes the findings register, the executive summary with control mapping, network diagrams of the attack paths, the remediation workshop, a free retest and the attestation letter. A deeper configuration review of Active Directory with examiner-ready evidence is scoped on the AD security assessment page.

For small projects and ad-hoc work outside our pre-agreed packages or retainers, our standard hourly rate is $460.

07 / THE DETAIL

Network Pentest or Vulnerability Scan

Two controls that get bought as if they were one. Assessors know the difference, and the report has to show you do too.

A scan measures the software you run. A network pentest measures how far an intruder travels across it.

PCI DSS requirement 11.4 and NIST SP 800-53 expect both controls. We run authenticated scanning for coverage, then spend the engagement on the paths only a person walking the network will find. A standalone vulnerability assessment is available when scanning is all the scope calls for.

08 / THE DETAIL

Who Commissions a Network Pentest

Enterprises with a large internal estate and Active Directory managing identity and access
Organisations preparing for a PCI DSS assessment that includes segmentation testing (11.4.5)
Defence and public-sector suppliers meeting NIST SP 800-171 and CMMC Level 2 assessment
Companies with VPN, remote access and a distributed workforce to validate
Manufacturing and OT sites that need user, server and control networks proven to be isolated
EU and UK financial entities meeting DORA Article 25 testing across their infrastructure

09 / THE DETAIL

Find Out How Far One Workstation Can Reach

One scoping call. Bring your last pentest report, your PCI scope, your network diagram, or nothing at all. You will leave with a scope written as the questions an attacker would ask, a fixed price, and a date for the report.

Scope My Network Pentest

10 / THE DETAIL

Book the Scoping Call

Choose a time for your scoping call.

Or visit our contact page ↗

11 / FAQ

Network Pentest FAQ

What is a network penetration test?
A network penetration test is a manual security test of the paths an attacker would travel across your infrastructure: the internet-facing perimeter, the internal network once someone has a foothold, the Active Directory privileged paths that lead from an ordinary workstation to Domain Admin, and the segmentation that is meant to keep a user network away from your card-data and server zones. We walk each path by hand, chain weaknesses together and stop at the agreed boundary. The output is a set of proven attack paths, each with the systems it reaches and the single change that closes it.
What is the difference between an external and an internal network pentest?
The external test works from the public internet with no credentials and answers one question: what can an outsider reach and use to gain a foothold. It covers exposed services, VPN and remote access gateways, mail, DNS and the hosts a past project left published. The internal test begins from a foothold someone already has, a phished workstation or a live port in a meeting room, and measures how far it travels through lateral movement, Active Directory escalation and segmentation. Most organisations buy both, priced as two scopes in one proposal.
How is a network pentest different from a vulnerability scan?
A scan lists software with known weaknesses by version and tells you what to patch. A network pentest starts from a question an assessor would ask, such as whether a standard workstation can reach a domain controller, and answers it by walking the path: capturing a credential on the LAN, cracking a service ticket offline, reusing a local administrator password across hosts and escalating to Domain Admin. PCI DSS requirement 11.4 treats penetration testing and vulnerability scanning as two separate controls and expects both. We run authenticated scanning for breadth and spend the engagement on the findings only a person walking the path will surface.
Do you test Active Directory?
Yes. Active Directory is where most internal engagements are decided. We test for Kerberoasting (T1558.003) and AS-REP roasting (T1558.004), certificate services templates left in an insecure default, unconstrained and resource-based delegation, local administrator password reuse across the fleet, and the group memberships that grant a quiet route to Domain Admin. We map each path the way an attacker would walk it and show the one change that breaks it. A deeper configuration review with examiner-ready evidence is scoped on our Active Directory security assessment.
Will the test disrupt production?
Testing runs under written rules of engagement agreed before anything starts: defined windows for anything that touches production routing, authentication or the core switch fabric, a named contact on each side who is reachable throughout, and a written stop condition. We avoid denial-of-service techniques and destructive exploits, and agree in advance which fragile legacy hosts are read-only. The engagement proves the path, documents it and leaves your network running.
How long does a network pentest take, and when do we get the report?
The external perimeter runs five to seven days of testing. The internal network with Active Directory runs seven to ten days. The report is delivered within fourteen days of the start. A combined external and internal engagement usually runs about three weeks end to end, including the remediation workshop with your engineers. The scoping call fixes the timeline in writing before work begins.
How much does a network penetration test cost?
The external perimeter starts at $4,000 for five to seven days of testing. The internal network with Active Directory privileged-path analysis starts at $5,000 for seven to ten days. Both prices include the findings register, the executive summary, network diagrams of every attack path, the remediation workshop, one free retest after you fix, and an attestation letter signed by a named qualified individual. A combined scope is priced in one proposal with volume pricing, and you approve the total before anything starts.
Do you test network segmentation for PCI DSS?
Yes. PCI DSS requirement 11.4.5 asks you to confirm that segmentation controls isolate the cardholder data environment from networks that are out of scope. We attempt to cross from a user or general-server network into the card-data environment through firewall rules, routing, shared management interfaces and dual-homed hosts, and we document every path that works and every control that holds. The result is the segmentation test evidence your QSA expects, with the method and scope written down.
Can you test wireless and remote access?
Wireless is included where it is in scope. We review WPA2 and WPA3 configuration, look for pre-shared keys that unlock the corporate network, test guest isolation, and check whether a rogue or cloned access point can collect credentials. On remote access we test VPN and gateway authentication, multi-factor enforcement, and split-tunnelling that lets a home network reach internal systems. Wireless location and timing are set in the rules of engagement.
What is in the report, and will it satisfy an auditor?
You receive an executive summary for leadership, a technical findings register with reproduction steps and CVSS ratings, network diagrams that show each attack path, and remediation guidance ordered by risk. Every finding is mapped to the control it bears on: PCI DSS requirement 11.4, NIST SP 800-53 CA-8, SOC 2 CC7.1, ISO 27001 Annex A 8.8 or DORA Article 25. Independent testing with documented scope, findings, remediation and a free retest is the evidence auditors and assessors accept.

12 / THE DETAIL

Related Services

Penetration testing - Web app pentest - API pentest - Cloud pentest - SaaS pentest - Mobile app pentest - Active Directory security assessment - Vulnerability assessment - PCI DSS compliance - Cloud security consulting - DORA compliance - Bank pentest - continuous AI penetration testing