What is internal penetration testing?

Internal penetration testing starts from the assumption that someone is already inside your network, a phished laptop or a malicious insider, and measures how far they could actually get. Instead of asking whether an attacker can break in, it asks the sharper question: when one does, or when a single password is stolen, what can they reach, and what stops them? You get the real path from a foothold to your most sensitive systems, and a fix list to cut it off.

What is the difference between internal and external penetration testing?

External testing looks at your business from the internet and asks what an outsider could get through before they are inside. Internal testing picks up where that leaves off: it assumes a foothold already exists and measures the damage from there. External is the door the whole world sees; internal is what happens if someone gets past it. Many businesses test external first, then add internal as the natural next step.

Does an internal test mean you think our staff are malicious?

No. Simulating an insider is a controlled assumption, not an accusation. The reason we start from inside is simple: one phished password or one infected laptop puts a real attacker in exactly that position, and you want to know what happens next before it happens for real. The test is about the network, not a judgment of the people on it.

How do you get inside our network to run the test?

Usually with a small device we ship that plugs into your network, or a secure connection we set up together, agreed during scoping. We do not need to physically visit for most internal testing. From there we work as though we were a compromised machine already sitting on the network, which is exactly the scenario the test is meant to measure.

How long does an internal penetration test take?

Most small and mid-sized internal engagements run about one to two weeks from scoping to report, depending on the size of the network and what is in scope. We agree the timeline with you during scoping so it fits around your operations. Time for your team to make fixes and for the retest is planned in from the start.

← All services

Internal Penetration Testing

What happens after someone is already inside? We simulate a compromised laptop or a curious insider and see how far it gets: the flat networks, the over-shared drives, the path from one ordinary login to full domain control. You get the real route an intruder would take, in plain English, with a prioritized fix list to cut it off.

Request a quote See pricing

Manual and automated testing. Transparent pricing from $6,500. Retest included.

Get a fair, fixed quote

Internal penetration testing starts from the assumption that someone is already inside your network, a phished laptop or a curious insider, and measures how far they could actually get. It is not about assuming the worst of your staff. It is that one stolen password or one bad click puts a real attacker in exactly that position, and it is far better to learn what happens next on a test than during an incident. We work from a foothold outward, map the path to your most sensitive systems, and hand you a fix list that cuts it off. New to this? Our guide to what a penetration test is covers the basics first.

What we test

The inside view, where the boring risks live

Most of what actually gets an intruder from a single laptop to the whole network is unglamorous: a reused password, a flat network, an account nobody turned off. Here is what an internal test puts under the light.

Active Directory and accounts

The account system most Windows networks run on. We look for the stale accounts that should have been disabled, the service account with too much power, and the path from an ordinary login to full domain control.

Flat networks and segmentation

Whether one compromised laptop can see the whole network, or just its own corner. Flat networks are not automatically wrong, but they decide how far one bad day spreads. We measure the blast radius.

Passwords and reuse

Reused passwords, weak passwords, and credentials cached where an attacker can grab them. This is boring and it is also, again and again, the actual way in. We check it the way an intruder would.

Shared drives and data

The one file share everyone can see, with the spreadsheet of passwords or the folder of client records in it. We find what is over-shared and reachable from a normal user account.

Backups, from the inside

Whether your backups are reachable from the same network an attacker would be standing on. Reachable backups are often the finding that decides how a ransomware event actually ends.

Internal services and servers

Databases, admin consoles, and legacy systems that are fine facing your staff but were never hardened against a hostile insider. We test them from the position of someone already through the front door.

A flat network is a good example of how we think about findings. Having one is not automatically a failure, plenty of small shops run that way and get by. But it decides how far one compromised laptop spreads, so we measure that blast radius honestly and tell you whether it is worth the cost to segment, rather than scoring it as a crisis on principle.

How it works

From a foothold to a confirmed fix

No jargon, no drama, no surprises. Five steps, and you always know what is happening and why. The only extra logistics compared to an external test is getting us a foothold inside, which is usually a small device we ship or a connection we set up together.

Curious what the write-up at the end looks like? We walk through it, section by section, in our guide to what a penetration test report looks like.

01

Scope

A short call to agree what we test, when, and how we get inside, usually a small device we ship or a connection into your network. Rules of engagement and scope are put in writing before anything starts.
02

Test

We start from the position of a compromised device or a curious insider and see how far it gets. Automated tooling plus real hands-on testing, chaining the small things together the way a real intruder would.
03

Report

A clear report in plain English: what we found, how serious each item really is, and proof, including the path we took from foothold to whatever we reached. An executive summary and a technical section.
04

Fix list

A prioritized, do-this-first remediation list. Your team or your existing IT provider makes the fixes, and we are happy to walk them through it on a call, in plain language.
05

Retest

Once the findings are fixed, we check the work and confirm the fixes hold. The retest is included on every tier, not billed back as an upsell.

Why manual testing matters

The way in is a chain, not a single flaw

An automated scanner hands you a list of separate issues, each with a score. A real intruder does not stop at one. They take a cached password here, a weak share there, an over-privileged account somewhere else, and string them into a path from an ordinary laptop to the domain controller. Finding that chain is what a person does and a scanner cannot.

That is the whole difference between a scan and a test. If you are comparing the two, our plain guide to a penetration test versus a vulnerability scan is worth five minutes.

Pricing

What an internal test costs

Internal testing comes as part of our Medium Full tier, which pairs it with external testing and starts at $6,500. Testing from both the outside and the inside is the common shape, because the two answer different halves of the same question. The retest is included, not billed back as an upsell.

We publish our prices, which most firms will not do, so you can budget before the conversation instead of during it. The final number depends on the size of your network and what is in scope, and the quote is fixed once we agree it.

See full pricing What drives the cost

Start outside, or go straight to both?

If you have never tested before, plenty of businesses start with an external test to see the door the whole world can see, then add internal next. Others go straight to both. Either is fine, and we will tell you honestly which fits your situation.

External penetration testing

FAQ