Network testing that shows the path an attacker takes.
We test what someone can reach from the internet, and what they can reach once they're inside, then show the route that chains one weakness to the next.
- Your compliance scope depends on segmentation:
- testing proves the boundaries hold.
- Infrastructure has changed:
- a migration, a merger or a new office changes what's exposed.
- External and internal testing, in one engagement
- Active Directory and lateral movement covered
- Attack paths, not just a list of findings
- Retest included, report reissued
What is a network penetration test?
A network penetration test attacks your infrastructure the way an intruder would. External testing looks at what someone on the internet can reach. Internal testing assumes a foothold already exists, such as a phished laptop, and measures how far it goes. We prove what is exploitable, then show the attack path between the two.
What we test
- Internet-facing hosts
- VPN endpoints
- Internal servers
- Active Directory
- Network segments
- Wireless, where in scope
What you get back
- A discovered asset inventory
- Findings with evidence
- A narrative of attack paths
- Fixes ranked by exploitability
- A retest of the fixes
- Proof your segments hold
NET
The whole path, not just the findings
Individual findings matter less than how they chain. We show the route from entry to impact, so you fix what an attacker would actually use.
Findings are ordered by real exploitability in your environment, not by generic severity alone.
Six areas every network test covers
External perimeter
Exposed services, VPN endpoints and forgotten infrastructure.
Internal network
Lateral movement and what one foothold reaches.
Active Directory
Privilege escalation, Kerberos attacks and credential exposure.
Service configuration
Default credentials, unpatched services and weak protocols.
Segmentation
Whether the boundaries you rely on actually hold.
Where network testing matters most
- Financial services
- Healthcare
- Manufacturing
- Hosted platforms
- Education
- Corporate offices
The trigger is usually a compliance audit that relies on segmentation, a cyber insurance or customer questionnaire, or a change such as a migration or merger.
Browse plain-language security guides in the Resources libraryWhat sits in scope of a network test?
Three layers an attacker moves through: the internet edge, the internal network behind it, and the identity systems that tie it together. Scope covers the ranges and systems you agree.
01 · The edge
Internet-facing systems
- Public hosts
- Exposed services
- VPN endpoints
- Forgotten infrastructure
What an attacker finds before they have any access.
02 · Inside the network
Hosts and segments
- Servers and workstations
- Network segments
- Management interfaces
- Wireless, where in scope
How far a single foothold reaches.
03 · Identity
Active Directory
- Domain accounts
- Delegation and trust
- Credential exposure
Where an attacker turns a foothold into control of the domain.
If you have internet-facing services, a VPN, or Windows domain accounts, an outsider has more to try than you may expect.
Systems you ask us to exclude, such as fragile legacy devices, are agreed in writing first, and we treat them carefully or leave them out.
How a network penetration test runs
Six steps, each with a named output and a clear ask of your team. Every exploit stays inside the rules of engagement agreed in writing.
- Scope
Scoping
We agree IP ranges, test windows, excluded systems and escalation contacts in writing.
- IP ranges
- Test windows
- Exclusions
- Escalation contacts
- You get
- A written scope and rules of engagement.
- You provide
- Ranges, fragile systems to flag, and a technical contact.
- Discover
Discovery
We enumerate live hosts, open ports, services and versions across the agreed ranges.
- Live hosts
- Open ports
- Services
- Versions
- You get
- A host and service inventory.
- You provide
- A device or VM for internal testing.
- Identify
Vulnerability identification
We correlate services against known weaknesses and misconfigurations, then verify each by hand.
- Known weaknesses
- Misconfigurations
- Weak protocols
- Default credentials
- You get
- A verified list of weaknesses.
- You provide
- Nothing beyond the agreed access.
- Exploit
Exploitation
We prove exploitability on confirmed findings, within the rules of engagement.
- Proof of exploit
- Evidence
- Impact
- Severity rating
- You get
- Evidence for each exploited finding.
- You provide
- A contact for critical findings, who we call the same day.
- Pivot
Post-exploitation
We establish how far a foothold reaches: lateral movement, privilege escalation and access to sensitive data.
- Lateral movement
- Privilege escalation
- Sensitive data access
- Attack paths
- You get
- An attack path narrative.
- You provide
- Confirmation of which data is most sensitive.
- Report
Report & retest
You get findings with attack paths and fix priority, a walkthrough, and a retest of the fixes.
- Findings report
- Walkthrough
- Retest
- Attestation letter
- You get
- A report, a walkthrough and a reissued report after retest.
- You provide
- Engineers on the walkthrough, and the fixes to retest.
There's no one-size timeline: it depends on the number of hosts, ranges and sites in scope. You get a firm estimate in writing during scoping, before work begins.
What you receive
The engagement ends in one test file. Each item is paired with the question a reviewer or an auditor asks about it.
Each finding comes with the specific fix and its priority, and a retest that verifies it, so the evidence that it is closed exists before anyone asks.
A penetration test isn't a certificate; it's evidence. Auditors, insurers and customers judge it by how reproducible the findings are and whether fixes were verified.
01, Report phase: Executive summary
Written for non-technical stakeholders.
02, Scope phase: Scope and rules of engagement
Ranges, windows and exclusions, as agreed.
03, Discover phase: Host and service inventory
Everything discovered, including forgotten assets.
04, Identify phase: Verified weaknesses
Findings confirmed by hand, not scanner output.
05, Exploit phase: Exploitation evidence
Proof, within the rules of engagement.
06, Pivot phase: Attack path narrative
The route from entry to impact.
07, Report phase: Prioritised remediation
Ordered by real exploitability in your environment.
08, Report phase: Retest report
Every fix verified, report reissued.
Illustrative example, not client data
What one attack path looks like
- Entry
- Exposed management interface with a default login
- Foothold
- Administrator access on one server
- Movement
- Cached credentials reused on a file server
- Impact
- Read access to a shared finance folder
- Severity
- High (CVSS scored)
- Fix
- Remove the default login, restrict the interface
Four common network testing misconceptions
Each one is common, reasonable, and the reason a network stays exposed.
Assumption 01
Assumption: Our firewall keeps attackers out.
What testing actually shows
Perimeter controls matter, but internal testing assumes someone is already in, such as through a phished laptop.
Assumption 02
Assumption: A vulnerability scan is a penetration test.
What testing actually shows
A scan lists weaknesses. A test exploits and chains them to show the real path.
Assumption 03
Assumption: We know every system we expose.
What testing actually shows
Discovery routinely surfaces infrastructure nobody remembered was still exposed.
Assumption 04
Assumption: Our segmentation holds because we designed it to.
What testing actually shows
Segmentation is validated by testing. A boundary that fails is the one an audit relies on.
Heard one of these from your team? A scoped network test shows where you really stand.
Get a network test scopedWhat you can hold us to.
We don't publish client logos next to findings; we keep our clients' security posture private. These are the commitments we make instead.
Our commitments
Senior testers on the work
Every engagement is led by experienced practitioners, not handed to a junior running a scanner.
Peer-reviewed reports
Every report is peer-reviewed before it reaches you.
Written scope and rules
You know what is tested, when, and what happens if scope changes, before work starts.
Retesting included
We verify your fixes and reissue the report, so closure can be shown.
We've used several penetration testing services before, but Auditify Security stands out with their attention to detail. They conducted an in-depth network penetration test and uncovered several weaknesses in our system, which we were able to fix right away.
Want to speak to a client? Ask for a reference while we scope your work and we'll arrange it directly.
Ask for a referenceNetwork testing questions buyers ask
What is the difference between internal and external testing?
Outside in, versus assuming a foothold.
External testing looks at what an attacker on the internet can reach. Internal testing assumes a foothold already exists and measures how far it goes. They surface different problems, and most organisations benefit from both.
Know how far an intruder would get.
Send the basics
What you want tested (IP ranges, sites and Active Directory), who uses it, and any deadline such as a customer review or an audit.
We scope the work
We respond within 24 hours, then agree targets, access and rules of engagement in writing.
Your test, then your retest
You get a reproducible report, a walkthrough with your engineers, and a retest of the fixes.
- Your compliance scope depends on segmentation:
- testing proves the boundaries hold.
- Infrastructure has changed:
- a migration, a merger or a new office changes what's exposed.
We test and report. We don't change your network; fixes are made by your team, and we verify them.