Infrastructure penetration testing, from perimeter to domain admin.
External and internal infrastructure penetration testing that shows how an attacker could get in, move through your network and take control of Active Directory — and what it would take to stop them.
Most serious breaches end in your internal network and Active Directory.
Attackers rarely stop at the first foothold. A single exposed service or phished laptop is usually the start of a path that ends with domain administrator access, your backups and your most sensitive data.
We test both ends of that path: what is exposed to the internet, and how far an attacker could get once inside. The result is a clear picture of your real attack paths — and the few fixes that break them.
Your perimeter, your network and your directory.
External, internal and assumed-breach testing, scoped to the question you need answered.
External perimeter
Internet-facing hosts and services, discovered and tested for exploitable weaknesses.
Remote access
VPNs, remote desktop gateways and other routes into your network.
Email and exposed services
Mail infrastructure and other services commonly targeted for initial access.
Internal network
Hosts, services and protocols reachable from a standard user position.
Active Directory
Kerberos attacks, certificate services, delegation, ACL abuse and credential exposure.
Privilege escalation
Local and domain privilege escalation paths to administrative control.
Lateral movement
How an attacker could move between systems and reach critical assets.
Segmentation
Whether network segmentation actually isolates sensitive environments, including PCI scope.
Build & configuration
Operating system and server hardening against recognised benchmarks.
How we test.
AI-assisted speed for the repetitive work. Senior, manual testing for judgement, exploitation and evidence.
Scope
Agree IP ranges, sites, starting point and rules of engagement.
Discover
Map exposed and internal hosts, services and trust relationships.
Test
Manual testing supported by efficient tooling.
Exploit & escalate
Safely demonstrate attack paths and privilege escalation.
Report & retest
Attack paths, fix priorities and revalidation.
Choose the right starting point.
External
What an attacker on the internet can find and exploit across your perimeter.
Internal
Testing from inside your network, as a malicious insider or compromised device.
Assumed breach
Starting from a compromised user account and laptop — the question boards care about most.
Fixed price, agreed before testing starts.
Penetration tests are priced per consultant day at £795 + VAT per consultant day. You get a fixed price in a statement of work after a short scoping call — no hidden day rates.
Typically 1–3 days for external and 3–6 days for internal and Active Directory. Multi-site and combined engagements are quoted individually.
- Senior, hands-on testing by the person who scopes it
- Live findings on the client platform
- Report with executive summary and remediation
- Retest terms agreed up front
Evidence you can act on — and share.
Executive summary
Plain-English risk, business impact and priorities for leadership and boards.
Attack paths
How individual weaknesses chain together into real-world impact.
Technical findings
Evidence, CVSS scoring and specific, practical remediation for every finding.
Live findings
Findings published to the SMARTSEC client platform as the engagement runs.
Retest
Independent revalidation of fixes, with retest terms agreed in the statement of work.
Debrief
A walkthrough of the results with your technical team and stakeholders.
What we typically find.
Examples of the issue types this kind of test regularly uncovers — illustrative, not client data.
- Exposed management interfaces and outdated internet-facing services
- Kerberoastable service accounts with weak passwords
- Misconfigured Active Directory Certificate Services
- Credential exposure through legacy name resolution protocols
- Excessive privileges and dangerous ACLs in Active Directory
- Local administrator password reuse across hosts
- Weak network segmentation between user and server environments
- Unpatched systems with publicly known exploits
Evidence for the people who ask.
- PCI DSS — Requirement 11.4 calls for internal and external penetration testing at least annually and after significant change, plus segmentation testing where used.
- Cyber insurance and clients — annual external testing is a common minimum expectation.
- ISO 27001 — supports technical vulnerability management and network security controls.
- DORA and FCA operational resilience — evidence that an attacker could not take important business services past tolerance.
Infrastructure questions.
What is infrastructure penetration testing?
A manual assessment of your network infrastructure — external, internal or both — to identify how an attacker could gain access, escalate privileges and reach critical systems, with every finding verified.
What is the difference between external and internal testing?
External testing looks at what is exposed to the internet. Internal testing starts inside your network and looks at what an attacker or insider could do from there, including attacks on Active Directory.
What is an assumed-breach test?
A test that starts from the position of a compromised standard user and laptop. It answers the question most boards ask: if someone gets in, how bad would it be?
Do you test Active Directory?
Yes. Active Directory is central to most internal tests, including Kerberos attacks, certificate services, delegation and permissions.
How do you test internally?
Usually through a standard laptop or a virtual machine we provide, connected to your network or VPN, agreed in advance.
Will testing disrupt our systems?
Testing is planned to avoid disruption. Potentially disruptive techniques are only used with explicit approval, and fragile systems can be excluded.
Need your infrastructure tested?
Tell us about your network, sites and what you want to know — we’ll confirm scope and a fixed price.