What is network penetration testing?
Network penetration testing is an authorized look at what is reachable, and what that reachability allows, from a starting point you choose. Externally, the starting point is the internet. Internally, it is a place inside the network you have agreed. The work names the hosts, services, and paths that matter, confirms the weaknesses we can actually use, and leaves you with a priority order. It is not a full inventory of every open port on every address you own.
What we test
An external test stays on the hosts, services, and ranges you name. Typical questions are straightforward. Which management interfaces answer on the internet? Does remote access trust more than the design says? Which services still offer a protocol you thought had been removed? An internal test starts from a remote-access account, a placed host, or an on-site window, and asks whether a user on one network can reach something you described as isolated.
Where the directory is in scope, we look at the paths from the account we hold: excessive rights, old trust, and management protocols that should not cross a boundary. We may name a technique with its MITRE ATT&CK identifier so a detection team can look it up. The identifier is a label for what we did. It is not a claim that we simulated a named intrusion set.
You provide the ranges, the source addresses we may use, the hours, and a person who can stop the work. Segmentation claims are tested only across the boundaries you describe. A host that answers and was not in scope is not in the report.
Approach and standards
The shape follows PTES and NIST SP 800-115 in the ordinary sense: agree the scope, learn what is there from the position you authorized, attempt only what the rules allow, and report what was demonstrated. Scanning covers ground. Conclusions come from what we can do with a weakness inside the rules. Password spraying, denial of service, and anything that would disrupt operations stay out unless the rules of engagement allow them in plain language.
Black-box external testing, with no credentials, answers the internet question. Grey-box internal testing, with a normal user account, answers the question your own staff or a stolen laptop would face. We will not quietly upgrade a normal account into a domain administrator and call the result assumed breach unless the rules say that is the objective. That objective is closer to a red team assessment, and we will say so.
The day-to-day rules are the methodology: a named contact on each side, an emergency stop, and a report that separates a reachable management interface from a missing log.
How long it takes and what affects the price
An external test of a modest perimeter is often five to ten testing days after the rules are signed, plus reporting. An internal test grows with the number of sites, the size of the ranges, and whether Active Directory or a similar directory is in scope. A single remote-access path is not the same engagement as three offices and a plant network. The contract names the window. We do not publish day rates.
Price follows the number of ranges and locations, whether the test is external, internal, or both, how much care production systems need, and whether a retest of a wide change is included. Travel for an on-site start is scoped only when the position cannot be reached remotely, and it is written down before anyone books a ticket.
What you receive
You receive the scope, including source addresses and time windows, a technical report, a short summary, and a retest note. Each finding says where it was, how it was confirmed, what it would let someone do, and what to change. If a host was out of scope, it is not in the report, even if it answered. The methodology page describes the same set of documents for every engagement.
When to choose this
Choose an external test when you want the internet’s view of the perimeter. Choose an internal test when you want to know whether the networks you described as separate actually are. Choose a cloud security assessment when the “network” is security groups, private endpoints, and identity in an account, and a packet on a VLAN is the wrong picture. Choose web application penetration testing when the exposed service is an application and the host is incidental. Offices in Doha and Marseille run the same method. Tell us the starting position on the contact page.