Internal Network Penetration Testing
Assess what an attacker could achieve once inside your network.
What this assessment covers.
Once an attacker breaches your perimeter, the internal network becomes their playground. DERISK’s Internal Network Penetration Testing service simulates an attacker who has gained a foothold inside your network, mapping attack paths, credential exposure, and lateral movement opportunities.
This assessment has a strong focus on Active Directory. We deeply analyse your identity infrastructure — Kerberos, ACLs, GPOs, trust relationships, and credential storage — to uncover paths to domain compromise. We also assess internal hosts, services, shares, and trust relationships to chain vulnerabilities and simulate privilege escalation.
All findings are published in real time to the DERISK PTaaS portal with attack path visualisation and remediation guidance, giving you a clear picture of how an attacker could move through your internal environment.
How we test.
A structured, expert-led methodology from initial reconnaissance through to real-time reporting and remediation guidance.
- 01
Internal Network Discovery & Mapping
Starting from a position similar to an insider or compromised workstation, we map the internal network — hosts, services, shares, and trust relationships — to understand the internal attack surface.
- 02
Active Directory Deep Analysis
We deeply analyse Active Directory — Kerberos, ACLs, GPOs, trust relationships, and credential storage — to uncover paths to domain administrator and other high-privilege targets.
- 03
Credential Exposure & Lateral Movement
We identify exposed credentials, cleartext passwords, and reusable hashes across the internal network, chaining them to simulate lateral movement between hosts and systems.
- 04
Privilege Escalation & Domain Compromise
We chain discovered vulnerabilities and misconfigurations to simulate how an attacker could escalate their access from a standard user to domain administrator or other high-privilege targets.
- 05
Real-time findings published to the DERISK PTaaS portal
Attack paths and vulnerabilities are published live to the PTaaS portal with visualisation, so you can see exactly how an attacker could move through your internal environment.
- 06
Reporting & Remediation guidance
You receive a detailed report with attack path visualisations, risk-rated findings, and prioritised remediation guidance covering internal network and Active Directory controls.
Why teams choose us.
Expert-led, manually validated, and delivered through the DERISK PTaaS platform for continuous visibility and rapid remediation.
Outstanding Features
- ✓Deep Active Directory assessment including Kerberos, ACLs, GPOs, and trust relationships
- ✓Real-time attack path visualisation and reporting through the DERISK PTaaS platform
- ✓Credential exposure and lateral movement simulation
- ✓Privilege escalation path analysis from standard user to domain administrator
Why Choose Our Service?
- ▸Active Directory expertise: Deep assessment of identity infrastructure and privilege management
- ▸Attack path analysis: Understand how seemingly minor weaknesses can lead to full domain compromise
- ▸Lateral movement simulation: Validate an attacker’s ability to pivot across your internal network
- ▸Continuous visibility: Track findings, remediation, and retesting through the DERISK PTaaS platform
Frameworks & standards.
Testing is aligned with industry-recognised frameworks and standards to ensure comprehensive, repeatable coverage.
What you receive.
Everything you need to understand, prioritise, and remediate findings — delivered through the platform with ongoing validation.
Internal Network Pentest questions.
What does an assumed-breach test simulate?
An attacker who already has a foothold: a phished user, a compromised laptop, or a contractor with legitimate access. It measures how far they get, how fast, and whether you would see it happen.
What is tested in Active Directory?
Kerberos configuration and delegation, ACL and group membership abuse, credential hygiene and cached secrets, certificate services misconfiguration, and the privilege-escalation chains that end in Domain Admin.
Do you need to be on site?
Not usually. Testing is typically run from a connected device or VPN access we agree during scoping, which is faster to arrange and no less effective.
Will this trigger our security monitoring?
It should — and that is useful data. We log all activity with timestamps so you can measure what your detection stack caught, what it missed, and how quickly your team responded.
Often scoped together.
Network Pentest
Simulate real-world attacks across your external, internal, AD, and wireless networks.
External Network Pentest
Simulate an attacker targeting your internet-facing systems from the outside.
Social Engineering
Test your human defences against phishing, vishing, and other manipulation techniques.
Configuration Review
Identify misconfigurations and harden your systems against attack.
Ready to secure your assets with Internal Network Pentest?
Get in touch with DERISK to schedule an assessment or learn more about how our expert-led testing can strengthen your security posture.
Request a demo ↗