Overview
External testing shows what an attacker on the internet can reach; internal testing shows how far they could go after phishing one employee. PCI DSS requires both at least every 12 months, and the FTC Safeguards Rule expects annual testing unless you run effective continuous monitoring. Internal access runs over a secure VPN or a small test device we ship to you, so there are no travel costs.
Ransomware groups rarely need zero-days. They get in through an unpatched VPN appliance, an exposed remote desktop service or a phished laptop — and then move laterally through flat networks and over-privileged accounts until they reach domain admin and your backups.
Our external tests map and attack everything you expose to the internet. Our internal tests start from an assumed-breach position — a standard user on a corporate device — and show the path an attacker would take to your most critical systems.
Wireless networks and voice systems are tested as separate, specialist engagements — see our WiFi and VoIP penetration testing services.
How testing works for US organizations
- Signed scope and written authorization before any testing, including hosting and cloud provider permissions
- Testing windows agreed around your US time zone at scoping, including after-hours windows for production
- Fully remote delivery, with internal and wireless access via VPN or a shipped test device, so no travel costs
- Reports mapped to SOC 2, PCI DSS, HIPAA and customer questionnaires, with a fixed price in USD
What's included
Our approach
- DiscoveryAsset discovery and service enumeration across agreed IP ranges and domains.
- Vulnerability analysisCombining scanning with manual validation to remove false positives.
- Exploitation & escalationSafe exploitation and privilege escalation toward agreed objectives.
- Lateral movementDemonstrating realiztic paths to crown-jewel systems and data.
- Report & retestAttack narrative, prioritized fixes and verification of remediation.
What you receive
- External exposure map
- Internal attack path narrative
- Segmentation test results (PCI DSS)
- Active Directory hardening recommendations
- Retest report and attestation letter
Standards & frameworks
- PTES
- NIST SP 800-115
- PCI DSS 11.4
- MITRE ATT&CK
- CIS Controls
Frequently asked questions
Can internal testing be done remotely?
Yes. We provide a pre-configured virtual machine or small device that connects securely back to our testers, avoiding travel costs.
How often should network tests be performed?
At least annually and after significant infrastructure change. PCI DSS requires internal and external testing at least every 12 months and after significant changes.
Will you take down our network?
No. We avoid disruptive techniques unless explicitly agreed and coordinate testing windows for fragile systems.
Are you a PCI QSA or ASV, FedRAMP 3PAO or CMMC C3PAO?
No. We don't claim any of those statuses on this site. Most penetration tests for SOC 2, HIPAA, PCI DSS Requirement 11.4, the FTC Safeguards Rule and customer due diligence don't require them. If your contract, assessor or program requires a specific accredited provider, tell us at scoping and we'll say plainly whether we can meet it. See US compliance requirements.
Do you quote in US dollars?
Yes. US proposals are fixed-price and quoted in USD, with scope, effort, deliverables and payment terms set out in writing before work starts. See our US pricing guide for published market ranges.