Services / Network assessment
Test the paths through your network.
A network security assessment of exposed services and internal access paths, with controlled network penetration testing and practical guidance for your infrastructure team.
See the whole path, edge to Domain Admin.
Most breaches don't stop at the perimeter. We show you every step a real intruder would take from your internet edge to total domain control, and exactly where to break the chain.
Two modules. Pick one, pick both.
Scope external network penetration testing, internal network penetration testing of the Active Directory estate, or run them together for the full attack path.
Module 01 External perimeter
Asset enumeration
CT logs, DNS, shadow IT, and forgotten subdomains, the real attack surface.
Service discovery
Full TCP / top-1000 UDP, TLS posture, manual triage on every vector.
Auth-surface testing
VPN, OWA, O365, Citrix, low-and-slow spray plus MFA-bypass detection.
Edge exploitation
Documented appliance and public-app exploit paths only.
Cloud exposure
Open buckets, IAM trust misconfigurations, and public databases.
Module 02 Internal Active Directory
Host discovery
Passive broadcast capture, mDNS, LLMNR, and NetBIOS.
AD enumeration
Full BloodHound, DACL / GPO / ACL paths, Tier-0/1/2 boundary mapping.
AD CS abuse
ESC1 through ESC11 certificate-template sweep.
Credential access
Kerberoasting, AS-REP roast, shadow credentials, LAPS retrieval.
Lateral movement
Pass-the-hash / -ticket, WinRM / DCOM / SMB with operator tooling.
Tier-0 pursuit
DCSync and golden / silver / diamond tickets, proven, never executed.
Detection-gap
Sigma rules authored for every TTP that landed during the assessment.
Rules of engagement
Aggressive on access.
Careful with your estate.
We prove impact without putting production at risk. You always know what is running.
No LSASS dumps by default
We prove access without dumping credentials unless you ask us to.
krbtgt stays on-host
No golden-ticket material ever leaves your environment.
Capability, not destruction
We demonstrate impact, we never break your estate to prove it.
A white cell, not a secret
Your named contacts always know exactly what is running, and when.
What it looks like
in practice.
An illustrative example of the class of issue this engagement is built to find, and what changes after it.
Illustrative example, not client data
BeforeWhat we found
# one local admin hash, sprayed across the estate $ spray --hash <local admin> --targets all [+] WS-0142 admin (match) [+] WS-0143 admin (match) [+] FS-01 admin (match) ... [+] 412 of 460 hosts same local password
AfterAfter the fix
# same spray, per host randomised passwords $ spray --hash <local admin> --targets all [-] WS-0142 rejected [-] WS-0143 rejected [-] FS-01 rejected ... [-] 0 of 460 hosts lateral movement blocked
Local administrator password reuse. One workstation compromise became 412 because the same local password was imaged onto every host. This is the single highest value internal fix most organisations can make, and it costs nothing but a rollout.
How far could an intruder get in your network?
Request a quoteAssessment walkthrough
Internal access paths and detection.
An assumed-breach assessment examines how a standard account could reach critical systems, and what evidence defenders would have along the way.
Read the walkthrough- Initial access
- Internal permissions
- Critical systems
Illustrative methodology. Client details remain confidential.
What you get
Six artefacts you can act on.
Boardroom deck
The risk story for leadership, in plain language.
Technical report
Every path and finding, with evidence and remediation.
BloodHound bundle
The graph data behind every attack path we walked.
Sigma pack
Detection rules for each TTP that landed during the assessment.
Tier-0 remediation
A prioritised plan to close the domain-compromise paths.
Retest letter
Written verification that the fixes hold.
The usual questions.
Will you take down our network?
No. We are careful by default, capability, not destruction, and a white cell that always knows what is running.
External, internal, or both?
Either. Most clients scope both so we can show the full edge-to-Domain-Admin path in one engagement.
Do you need domain credentials?
For the internal module we usually start from an assumed-breach position. We agree the exact starting point with you.
How long does it take?
Typically one to two weeks per module, with a fixed timeline agreed before we start.
Brief us on the network.
External, internal, or both. A senior operator replies within one business day.