Penetration Testing/Network Penetration Testing

Network Penetration Testing

Network penetration testing that shows how far an attacker gets

Internal and external network penetration testing that goes past the scan: we exploit what we find, chain it, and show where an attacker ends up. Every finding comes with a reproducible proof of concept and a fix your team can apply.

External perimeter, VPN and remote access testing
Internal network and Active Directory attack paths
Segmentation testing for PCI DSS v4.0.1 Requirement 11.4.5
Network devices, firewalls and exposed services

Scope my network test See a sample report Talk to an expert →

The credentials behind every engagement

2026 CyberSecurity Breakthrough Awards winner

Penetration Testing Solution of the Year2026 CyberSecurity Breakthrough Awards

Reviewed by Omair Manzoor, Founder & CEO, ioSENTRIX · Updated November 2026

Key terms: What is lateral movement?

Trusted by security teams at

See it in action

One VPN login. Domain admin by day six.

We test from the internet and from inside, chain what we find into the path an attacker would take, then retest each link until it holds.

Scope · Day 1External test · Day 2Internal test · Day 4Report · Day 10Retest · Day 24

ScopeExternalInternalReportRetest

01One path, tested from outside and in

02The attack path, mapped to MITRE ATT&CK

03The result

EXTERNAL TEST · FROM THE INTERNET

INTERNAL TEST · FROM A FOOTHOLD

INTERNET

PERIMETER

CORPORATE LAN

SERVERS · TIER 0

START

Internet

PERIMETER

VPN gateway

WORKSTATION

Laptop · WS-14

WORKSTATION

Laptop · WS-22

WORKSTATION

Laptop · WS-37

SERVICE ACCOUNT

svc_sql

CROWN JEWEL

Domain controller

SERVERS

App servers

1✓2✓3✓4✓

REPORT AND WALKTHROUGH · DAY 10VPN MFA, LAPS for local admin, managed service accounts, DC-only replication rights.

RETEST · DAY 24Each link retested on its own, from an assumed-breach start. The path is closed.

Password spray finds a weak VPN login

T1110.003External · no MFA on the VPNFix · MFA on the VPN

ExploitedClosed

One local admin password on every laptop

T1078.003Internal · same password, 38 laptopsFix · unique per host (LAPS)

ExploitedClosed

Kerberoasting cracks svc_sql

T1558.003Identity · short service passwordFix · managed service account

ExploitedClosed

DCSync pulls every password hash

T1003.006Crown jewel · domain adminFix · replication for DCs only

ExploitedClosed

OBJECTIVE AGREED WITH YOU

Domain admin, starting from the internetNot reachedReached · Day 6RetestingPath closed

PRIVILEGE HELD BY THE TESTERPRIVILEGE HELD ON RETEST

None · on the internetVPN userLocal admin · 38 laptopsService accountDomain adminNone · MFA stopped it

Mapped toMITRE ATT&CKPTESNIST SP 800-115Retest of every fix

Swipe to see the full exhibit →

Small gaps chain

Weak VPN password, shared admin password, weak service account. None critical alone.

Outside and inside

External testing shows what the internet can reach. Internal testing shows how far one foothold goes.

Every link retested

We retest each fix on its own, so the path stays closed even if one control slips.

Read this exhibit as text

We agree one objective with you: domain admin, starting from the internet.
External test: a password spray finds a weak VPN login with no MFA (MITRE ATT&CK T1110.003, password spraying). Exploited.
Internal test: the same local admin password works on 38 laptops (T1078.003, local accounts). Exploited.
Kerberoasting cracks the short password of the svc_sql service account (T1558.003). Exploited.
DCSync pulls every password hash from the domain controller (T1003.006). The objective, domain admin, is reached on day 6.
Report and walkthrough, day 10: MFA on the VPN, unique local admin passwords per host (LAPS), a managed service account, and replication rights for domain controllers only.
Retest, day 24: each link is retested on its own from an assumed-breach start. MFA stops the first step and every later link is closed. The path is closed.

Source: ioSENTRIX network testing methodology; PTES; NIST SP 800-115; MITRE ATT&CK Enterprise. Illustrative attack path at a fictional company, not client data.

The short answer

What is network penetration testing?

Network penetration testing is a hands-on security test of an organization’s network infrastructure, carried out the way a real attacker would. Testers attack the external perimeter from the internet and the internal network from inside, exploit weaknesses in hosts, services and identity systems, and prove how far an attacker could get.

A vulnerability scan lists what might be wrong. An internal and external penetration test proves what is exploitable: testers chain a weak password, a misconfigured service and an Active Directory flaw into a path to your critical systems, and show the evidence. Findings are mapped to MITRE ATT&CK, and testing follows PTES and NIST SP 800-115.

At ioSENTRIX, internal and external network penetration testing is carried out by hand by certified testers at a CREST-accredited firm, and every fix gets a free retest.

You need a network pentest if

PCI DSS Requirement 11.4 applies to your cardholder data environment
An auditor, customer or insurer asked for a recent network pentest report
You changed firewalls, VPN, segmentation or your Active Directory design
You want to know what an attacker on one laptop could reach

What we test

Four areas, tested by hand

Scope follows your network. Most network penetration tests cover these four areas.

External

External perimeter

What an attacker on the internet can see and reach.

Exposed services and management interfaces
VPN, remote access and email gateways
Password spraying against internet-facing logins
Known vulnerabilities, verified by hand

Internal

Internal network

What an attacker with a foothold inside can do next.

Name resolution poisoning and relay attacks
Weak and default credentials on hosts and devices
Unpatched services and lateral movement
Sensitive data on file shares

Identity

Active Directory

The paths from any user account to domain admin.

Kerberoasting and weak service accounts
Certificate services misconfiguration
Delegation and permission abuse
Privilege escalation paths

Segmentation

Segmentation and isolation

Whether the walls between networks actually hold.

Cardholder data environment isolation
Firewall and access rule testing
Production, corporate and guest separation
Evidence for PCI DSS Requirement 11.4.5

Methodology

How we test: example test cases

A sample of the manual test cases in a typical network penetration test. Your scope decides the full list.

T1133

Remote access exposure

We test VPN, remote desktop and other remote access services for weak authentication, missing MFA and known exploitable flaws.

T1110.003

Password spraying

We try a small set of common passwords across many accounts on internet-facing logins, within the lockout limits you approve.

T1557.001

Name resolution poisoning and relay

From an internal foothold, we answer broadcast name lookups and relay the captured authentication to other hosts.

T1558.003

Kerberoasting

We request service tickets for accounts with service principal names and try to crack their passwords offline.

T1649

Certificate abuse

We look for certificate templates and enrollment settings that let a normal user obtain a certificate for a privileged account.

PCI 11.4.5

Segmentation test

From each out-of-scope network, we scan and probe for any path into the cardholder data environment.

Sample finding

What a finding looks like in our report

An illustrative example in our report format. Not client data.

Finding 01 · IllustrativeCritical

A poisoned name lookup and an SMB relay lead from a meeting room network port to domain admin

MITRE ATT&CK T1557.001 Name Resolution Poisoning and SMB Relay · T1078 Valid Accounts

What we found

From a network port in a meeting room, the tester answered LLMNR name lookups and captured a workstation login. SMB signing was not required, so the login was relayed to a file server where that user was a local administrator. The server held stored credentials for a service account that was a member of Domain Admins.

Impact

Anyone who can plug into the office network can take control of the domain.

How to fix it

Disable LLMNR and NetBIOS name resolution, require SMB signing on all hosts, remove local administrator rights from standard users, and move privileged service accounts to group managed service accounts.

What you get

What you get from every network pentest

Not a scan export. Proven attack paths and fixes your team can act on.

Attack paths, not just a list

Each finding has a severity, a reproducible proof of concept and remediation guidance, and chained findings are shown as the path an attacker would take.

Mapped to the standards you report on

Findings map to MITRE ATT&CK techniques, and the report describes the methodology your PCI DSS, SOC 2 or ISO/IEC 27001 auditor asks about.

Walkthrough, then retesting

The tester who found each issue walks your team through it, and retesting is available once fixes land.

ioSENTRIX sample penetration test report cover

See how we write findings before you talk to us

A redacted sample penetration test report (web application): finding write-ups, proof-of-concept evidence and remediation. No form required.

Download the sample report (PDF) →

Verified reviews

What security leaders say about working with us

★★★★★

“Unlike other providers, Omair and his team truly dive deep into our infrastructure, delivering findings that go well beyond the surface level. Communication is direct and seamless.”

Jesus B.

Cybersecurity Manager, Banking

Verified G2 review ↗

★★★★★

“We were impressed with ioSENTRIX’s ability to independently validate the security of our customer-facing product.”

Zeehasham R.

Data Scientist, Security Operations · Fortune 500 insurer

Verified Clutch review ↗

★★★★★

“The team at ioSENTRIX is professional and highly skilled at their craft.”

Awwab A.

SVP, Chief Information Security Officer

Verified G2 review ↗

Internal vs external

What is the difference between internal and external penetration testing?

External penetration testing tests what an attacker on the internet can reach: your perimeter, VPN, email gateways and exposed services. Internal penetration testing starts from a foothold or insider access and tests what an attacker can do next: Active Directory, lateral movement and whether segmentation holds. Most organizations need both.

How it works

How a network penetration test works

Four steps, so you know what happens and what you get.

Scope and rules of engagement

We agree IP ranges, test windows, accounts, lockout limits and who to call if something looks wrong.

Before testing

External and internal testing

Testers work from the internet and from a foothold inside, following PTES and NIST SP 800-115.

Most of the engagement

Report

Each finding has a severity, a reproducible proof of concept and remediation guidance.

At close

Remediation support

We walk your team through the findings, and retesting is available once fixes land.

After fixes

Reply in under an hour → scoping call → fixed quote in writing → testing window agreed by scope → report, walkthrough and retest

How we compare

Not a vulnerability scan with a pentest cover page.

What a network penetration test covers compared with the usual alternatives.

ioSENTRIX network pentest

Vulnerability scan

Automated pentest tool

What is tested

External perimeter, internal network, Active Directory and segmentation

Known vulnerabilities by version and signature

Preset attack modules against reachable hosts

Exploitation

Manual, within agreed rules of engagement

None

Scripted, limited to built-in modules

Attack chaining

Findings chained into paths to your critical systems

Not done

Limited to the tool’s playbooks

False positives

Each finding confirmed with a proof of concept

Common; your team triages

Fewer, but business context is missing

Evidence

Proof of concept, fix and walkthrough

Scanner report

Tool report

Scope my network test

Scope and price

What affects the scope and price of a network pentest

Network penetration tests are priced on effort, not a per-IP list price. These are the decisions that move the quote.

What moves the quote

01How many external IP addresses and internet-facing services are in scope
02How many internal subnets, sites and hosts
03Whether Active Directory and identity attack paths are in scope
04Whether segmentation testing for PCI DSS is needed
05An unauthenticated start, or assumed breach from a standard user account
06Retesting windows and the report format your auditor expects

Read: Penetration testing cost and pricing: what a pentest really costs →

What we need from you to start

IP ranges and hostnames in scope, with any exclusions
Test windows and any systems that need special care
VPN access or a test device for the internal portion
A standard domain user account, if you want an assumed-breach start
A technical contact reachable during testing

Scope my network test

Case studies

Engagements we have run

Anonymized examples of ioSENTRIX engagements. Clients are described by industry, not named.

Passenger rail

CBTC system penetration test

A communication-based train control system, where testing found vulnerabilities in its segmented network and proprietary software.

Read the case study →

Hospitality

Room automation system penetration test

A hotel room automation system controlled from Android tablets, where testing found weaknesses in network segmentation and password policy.

Read the case study →

Advisory services

Full-stack penetration test

A Citrix-hosted web application handling legal and financial data, tested across the application, its dependencies, infrastructure and internal network.

Read the case study →

Track record

Numbers you can check

Ratings you can verify on G2 and Clutch.

4.9 / 5

on G2 from 12 verified reviews

5.0 / 5

on Clutch, Premier Verified

2017

founded; CREST-accredited, ISO 27001 certified, SOC 2 Type 2 attested

Independently verified

Credentials held by the firm

Every engagement runs inside a company whose methods and own security are checked by outside bodies.

CREST-accredited for penetration testing

CREST assesses the firm's testing methodology, quality assurance and handling of client data.

View our CREST listing →

SOC 2 Type 2 attested

An independent auditor tested our own security controls over time.

Request the SOC 2 report →

ISO/IEC 27001 certified

Our information security management system is certified to ISO/IEC 27001.

View in our trust center →

Recognized independently

Penetration Testing Solution of the Year, 2026 CyberSecurity Breakthrough Awards. G2 High Performer, Fall 2026.

Award announcement →See our G2 reviews →

Founded in 2017.

Our commitments

What you can count on

Four promises we make on every testing engagement.

Free retest of every fixOnce your team fixes a finding, we test it again at no extra cost and update the report.
A fixed priceThe quote you sign is what you pay. The price only changes if you change the scope.
A report your auditor acceptsIf your auditor has questions about the report, we answer them and update it until it is accepted.
A reply in under an hourSend the form and we reply within an hour during US business hours.

Get a scoped quote

For your buying team

Everything your reviewers will ask for

Security, finance and procurement each need something different. Forward this page, or pull what each reviewer needs.

For security

Sample report

See exactly what you get: findings, proof of concept, fixes and retest results.

Download the sample report (PDF) →

For vendor risk

Trust center

Our SOC 2 Type 2 report and security documentation for your vendor review.

Open the trust center →

For procurement

Procurement pack

Master services agreement, sample statement of work, certificate of insurance and W-9.

Request the procurement pack →

For your team

Share this page

Send the link to the people who need to sign off.

Who you work with

Who does the work

Senior security engineers do the hands-on work and write up the results, so the person who found an issue explains it to your team.

Certified engineers

Each engineer holds one or more of OSCP, OSWE, OSCE, CISSP, CISA or AWS security certifications.

Accredited firm

ioSENTRIX is CREST-accredited for penetration testing, ISO/IEC 27001 certified and SOC 2 Type 2 attested.

Since 2017

Founded in 2017, with security work for Fortune 100, financial services, insurance and SaaS companies.

Ready to see how far an attacker could get inside your network?

We reply in under an hour · no sales pitch

Scope my network test

Standards

Frameworks we test and map to

◆PTES◆NIST SP 800-115◆MITRE ATT&CK◆PCI DSS v4.0.1 Requirement 11.4◆ISO/IEC 27001:2022 Annex A 8.8 and 8.22◆CIS Benchmarks

FAQ

Frequently asked questions

What is the difference between internal and external network penetration testing?

External testing starts from the internet and targets what anyone can reach: your perimeter, VPN, remote access and exposed services. Internal testing starts from inside, as a compromised laptop or a malicious insider would, and targets hosts, file shares and Active Directory. Most organizations need both. Read internal vs external network penetration testing.

Does PCI DSS require network penetration testing?

Yes, for the cardholder data environment. PCI DSS v4.0.1 Requirement 11.4 calls for internal and external penetration testing at least once every 12 months and after significant changes, plus segmentation testing where segmentation is used to reduce scope. ioSENTRIX is not an Approved Scanning Vendor, so the quarterly external ASV scans in Requirement 11.3.2 need an ASV.

Will testing disrupt our network?

Testing follows rules of engagement agreed before we start, including test windows, lockout limits and systems to avoid. Anything that could affect availability is discussed with you first, and you have a contact who can pause testing at any time.

Can you test our internal network remotely?

Yes. The external test runs from our infrastructure, and the internal test usually runs over a VPN connection or from a test device placed on your network. On-site testing can be arranged where the scope calls for it.

How long does a network penetration test take?

Most network penetration tests run days to weeks, depending on how many networks, sites and hosts are in scope. We reply in under an hour during US business hours; the scope, timeline and fixed quote follow the scoping call, and the testing window is agreed before work starts.

Resources

Go deeper before you scope a test

Practical guides from our testers on the questions buyers ask most.

Internal vs external network penetration testing compared side by side

Guide · 10 min read

Internal vs External Network Penetration Testing: Differences, Methodology and When You Need Each

External tests prove what an internet attacker can reach; internal tests prove the blast radius after a foothold. Methodology, differences and PCI…

Read the guide →

Network infrastructure security best practices and checklist

Guide · 10 min read

Network Infrastructure Security: Best Practices, Components and Checklist

What network infrastructure security covers, the components a secure network needs, 10 best practices mapped to NIST and NSA guidance, and a…

Read the guide →

Guide · 5 min read

Vulnerability Assessment vs Penetration Testing - How are they different? A Quick Guide

Compromise assessment and penetration testing are wholly separate and cover the distinct security testing aspect. We've combined their key…

Read the guide →

Keep exploring

Related services

HubAll penetration testing services ServiceCloud penetration testing ServiceRed team services ServiceWeb application and API penetration testing ServiceICS and SCADA penetration testing

Ready when you are

Find out how far an attacker gets in your network

Tell us which networks you need tested and why. We reply in under an hour during US business hours, and a senior engineer follows with scope, timeline and a fixed quote.

We reply in under an hour · Fixed quote in writing before work starts · Your details are never shared