External
Forgotten VPN, old TLS, exposed management, leaked service banners, password spraying where authorised.
PerimeterVPNTLS
Coverage
Change-window friendly
Internal / AD
Kerberoast, unconstrained delegation, ACL abuse, relay, that one print spooler nobody owns.
ADKerberosRelay
Segmentation
Can the guest Wi-Fi, the build VLAN or the CCTV VLAN reach finance? We check, we do not assume the diagram.
VLANZero trust
Narrative
Not 400 Nessus rows. A story of how far an attacker gets, with the three fixes that actually cut the path.
Kill chainPrioritised
We agree hours. We do not surprise your NOC. Destructive checks stay out unless you write them in.
Why it matters
External perimeter, then the domain
The perimeter is bigger than the firewall rule
Forgotten subdomains, a staging host that answers on a public IP, an appliance web interface that was never meant to be reachable, a VPN concentrator two versions behind. We enumerate what is actually exposed, not what the network diagram says is exposed, because those diverged some time ago in every estate we have tested.
Internal testing is the one that changes minds
From an ordinary domain user on an ordinary laptop: Kerberoasting, AD CS misconfiguration, delegation abuse, credentials in SYSVOL and share permissions nobody has reviewed since the file server was migrated. This is the path a phished employee gives an attacker, and it is usually short.
Segmentation, tested rather than assumed
Most UK estates believe they are segmented. We check whether the finance VLAN can reach the domain controllers, whether the guest network is really isolated, and whether a compromised print server bridges two zones it was never supposed to. Assumed segmentation is the most common false comfort in the report.
We stop at proof, not at impact
Where a path leads to domain administrator, we prove it and stop. We do not dump the whole directory, encrypt anything, or persist. The point is a defensible finding and a fix, not a demonstration of how much damage we could have done.
Run externally, internally, or both. Both is the honest answer for most UK organisations, because the external test tells you how someone gets in and the internal test tells you what that costs you.
How it runs
The engagement, step by step
Scope and authorisation
IP ranges, domains, physical sites, testing window and explicit exclusions. Written CMA 1990 authorisation naming every range. Where a range belongs to a hosting provider, we confirm you are entitled to authorise testing of it.
External enumeration
DNS and subdomain discovery, certificate transparency, port and service identification, technology and version fingerprinting, and the exposed administrative interfaces that keep appearing in these engagements.
External exploitation
Known vulnerabilities in exposed services, default and reused credentials, authentication weaknesses on perimeter devices, and misconfigured remote access — each confirmed rather than reported from a version banner.
Internal foothold
From a standard domain-joined position or a supplied VPN account: network mapping, service enumeration, share permissions, and the credential material lying around on an ordinary workstation.
Active Directory attack paths
Kerberoasting and AS-REP roasting, delegation abuse, AD CS templates, ACL paths to privileged groups, and relay opportunities where signing is not enforced. We map the shortest path to domain administrator and prove it.
Report and re-test
Findings ordered by attack path, with host-level detail your infrastructure team can work from. Re-test of confirmed findings after remediation, included in the fee.
Deliverables
What lands on your desk
The path to domain admin
Where one exists, written step by step with the specific link that breaks it. One diagram that a CTO understands and an infrastructure engineer can act on the same afternoon.
Host-level findings
Per host and per service, with versions, evidence and remediation, in a form you can hand to whoever patches — including the appliances that are somebody else’s contract.
Segmentation results
What can reach what, tested rather than assumed, against the segmentation you believe you have. Frequently the most useful page in the report.
Re-test and attestation
Re-test of every confirmed finding, included, plus a letter of attestation naming ranges, dates, scope and outcome for your insurer, customer or auditor.
Scoping
What we need from you to start
- The IP ranges and domains in scope, in writing, with confirmation you own or are entitled to authorise testing of them.
- For internal testing: a standard domain user account and network access, either on site or through a VPN.
- A testing window, and whether your SOC should be told. Both answers are valid — one tests the estate, the other tests the response.
- Any fragile hosts, legacy systems or medical, industrial or safety equipment that must not be touched.
- Contact details for whoever answers the phone if something behaves unexpectedly at 16:00 on a Friday.
- Whether a third party manages the network, so they can be notified rather than surprised.
If you would rather your security team is not told, we can run the engagement quietly and treat detection as part of the result. Someone senior must know, and the authorisation letter has to exist either way.
UK compliance
Where this sits in a UK compliance programme
Cyber Essentials Plus
CE+ checks patching and configuration on a sample of devices. It does not attempt to move through your network. Internal findings are the ones that show what an attacker does after the phishing email that CE+ cannot prevent.
ISO/IEC 27001
Evidences network security controls, segregation in networks and technical vulnerability management, with a re-test that closes the loop for your auditor.
NCSC CAF
Supports outcomes on protecting data in transit, boundary defence and identity and access control. We map findings to the relevant outcomes where the mapping is honest and say so where it is not.
Cyber insurance
UK insurers increasingly ask specific questions about MFA on remote access, network segmentation and privileged account handling. This engagement produces evidence for those answers instead of estimates.
Questions
What UK buyers ask before signing
External starts from the internet with no credentials and answers how someone gets in. Internal starts from an ordinary domain user on your network and answers what it costs you once they are in. They find different things. Most UK organisations should run both, and the internal one usually produces the more uncomfortable report.
We avoid denial-of-service techniques unless you request them in writing, exclude fragile and safety-critical hosts at scoping, and keep a named contact reachable throughout. If something degrades we stop immediately and tell you.
Yes, and it is a reasonable thing to want — it tests detection as well as the estate. Someone senior in your organisation must know, and the signed authorisation must exist regardless. We will not run an unauthorised test to make the exercise more realistic.
One to two weeks for a combined external and internal engagement in a typical mid-sized UK estate. Driven by live host count and Active Directory complexity rather than by the size of your IP allocation.
Yes, and it is usually where the internal engagement earns its fee: Kerberoasting, AS-REP roasting, delegation abuse, AD CS template misconfiguration, ACL paths to privileged groups and relay where signing is not enforced.
Related
Engagements that usually run alongside
01
02
03
Cloud security VAPT
IAM, storage, network boundaries and the CI/CD path into your AWS, Azure or GCP estate.
02
Desktop & thick-client testing
Thick clients on .NET, Electron and native Windows, plus the services they talk to.
03
Security audit & reporting
The write-up an auditor accepts and a developer can act on, with a re-test to close it out.
Ready to scope a UK engagement?
A thirty-minute call. Assets, timeline, a quote in pounds sterling.
Request a quote