Internal infrastructure & Active Directory
Internal network penetration testing
One phished laptop. How far could an attacker get from there? We find out, and show you the shortest path to domain admin.
Who it is for
- Organisations running Active Directory or Entra ID hybrid environments
- Businesses worried about ransomware
- Teams that need to validate network segmentation
- Anyone who has grown their network without a security review
What we cover
Active Directory
Misconfigurations, weak delegation, certificate services abuse and attack paths to domain admin.
Credential exposure
Weak and reused passwords, cached credentials, and secrets in file shares and scripts.
Lateral movement
How easily an attacker could move between workstations, servers and cloud services.
Segmentation
Whether sensitive networks like payment, OT or management are properly isolated.
Patching & hardening
Unpatched systems, legacy protocols and insecure default configurations.
Detection
What your monitoring tools spotted, and what they missed.
How it works
Scope
We agree the sites, ranges and starting point: usually a standard user on a standard laptop.
Access
On site, or remotely through a small testing device or VPN we help you set up.
Escalate
We find and safely exploit attack paths, keeping you updated on anything critical.
Report & retest
Findings tied to attack paths, so you fix the issues that break the chain first.
What you get
- Attack path narrative from initial access to impact
- Prioritised findings with remediation guidance
- Active Directory hardening recommendations
- Segmentation test results
- Debrief call and free retest
Frequently asked questions
Can't find your answer? Ask in the form below and we will get back to you as soon as we can.
Do you need to come on site?
Not necessarily. We can post you a small preconfigured testing device to plug in, or connect over a VPN. On-site testing is available where physical presence matters or is preferred.
Will you take down our network?
No. We use safe techniques, avoid exploits that risk instability and agree in advance anything that carries risk. You have a direct line to the tester throughout.
Should our IT team know about the test?
Usually yes, so they can help with access. If you want to test whether your monitoring detects us, we can keep the circle small. That is closer to a red team exercise.
How long does it take?
Typically 3 to 10 days of testing, depending on the number of sites, hosts and the complexity of your Active Directory.
What does the report look like?
You get a management summary written for non-technical readers, then a technical section with every finding rated by risk. Each finding has evidence, steps to reproduce and clear remediation advice. We walk you through it on a debrief call.
Is a retest included?
Yes. Once you have fixed the issues, we retest the findings rated critical, high and medium within 90 days of the report at no extra cost, and give you an updated report.
Get a fixed quote
A few quick questions so we can scope it properly. No obligation, no hard sell.
Thanks, we have your enquiry.
We will reply as soon as we can. If it is urgent, email hello@redstackd.com.