The external test answers one question: what can someone on the internet reach, and what happens when they do. The internal test answers another: what can someone do who is already inside, with the workstation of an employee and nothing else.
Inside most corporate networks the distance from an ordinary user to a domain administrator is a few steps: a password in a file share, a service account with too many rights, a certificate template that anyone may request. We find those steps and show the path.
01Scope
What we test
External perimeter: exposed services, VPN and remote access, mail, DNS
Known vulnerabilities and weak configuration of network services
Active Directory: Kerberos, delegation, certificate services, group policy
Yes. We connect through a VPN you provide or through a small device or virtual machine placed in your network. The starting position is the same as on site.
Will you take the domain down?
No. Techniques that risk availability are excluded by the rules of engagement or executed only in a window you approve. The purpose is to prove access, not to cause damage.
What is the difference between this and a vulnerability scan?
A scan lists possible weaknesses. A penetration test proves which of them can be used, combines them and shows where an attacker ends up. PCI DSS and other frameworks treat the two as separate requirements for that reason.