Internal Penetration Testing

Internal penetration testing is a manual, authorised attack on your network from the inside that shows what someone already there could do: an employee whose laptop has been phished, a contractor on a meeting-room port, or malware on one workstation. Our testers start from that foothold, usually a standard domain user account, and try to reach domain admin, critical servers and sensitive data. We report every path we prove, with evidence and the fix that breaks it.

It is the inside half of our network and infrastructure penetration testing service. For the view from the internet, pair it with external penetration testing.

What is an internal penetration test?

An internal penetration test is a time-boxed, authorised attack on your internal systems by a qualified tester working from inside the network. Internal network penetration testing, internal infrastructure penetration testing and an “internal pentest” are the same service under different names.

Most tests assume the breach has already happened, so no time goes on phishing. You choose the starting points that match your risks:

What does internal network penetration testing cover?

Everything reachable from the starting point, within the scope you authorise:

Server internal penetration testing, where only critical servers are in scope, uses the same method with a narrower target list.

How is an internal penetration test carried out?

An internal pen test moves from paperwork to proof in five steps:

1. Scoping and authorisation. We agree the networks, sites, domains and starting scenarios, the rules of engagement and the testing window, and you sign written authorisation.
2. Access set-up. You import our test virtual machine, connect a test device or issue VPN access, plus a standard domain user account if the scenario starts from one.
3. Discovery. From that starting point we map live hosts, services, file shares and the Active Directory domain.
4. Exploitation and lateral movement. We capture and reuse credentials, follow Active Directory attack paths and move between systems towards the agreed targets, logging every action with a timestamp.
5. Reporting. The report and a debrief with your team, followed by the retest described below.

Every test follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.

How do attackers reach domain admin from inside the network?

Usually by chaining medium-risk misconfigurations, not one dramatic exploit, which is why an Active Directory security assessment needs a human tester. A typical chain:

1. Capture a credential by poisoning LLMNR or NBT-NS lookups, or relaying NTLM authentication to hosts without SMB signing.
2. Map the domain. Any domain user can read most of Active Directory; graphing groups, sessions and permissions shows the shortest route to Domain Admins.
3. Crack service accounts. Kerberoasting and AS-REP roasting expose hashes for weak passwords, cracked offline without touching the account.
4. Abuse Certificate Services. A misconfigured AD CS template (such as ESC1) can let a normal user obtain a certificate as an administrator.
5. Abuse rights and delegation. GenericAll or WriteDACL rights, or unconstrained delegation, let one account take over another, up to replicating every password hash from a domain controller (DCSync).

The report shows where each chain can be broken, so you can fix the cheapest link first. Our guide to Active Directory penetration testing covers each technique in depth. If your domain synchronises to Microsoft Entra ID, the same chain can continue into the cloud, which Azure and Entra ID penetration testing covers.

How do you test lateral movement?

Lateral movement is how an attacker spreads between machines using stolen credentials and normal admin protocols such as SMB, WinRM and RDP. We test whether harvested credentials work elsewhere and whether privileged accounts leave reusable credentials on ordinary machines. We log when each action happened, so your security team can check which steps raised an alert and which went unseen. Lateral movement is also how ransomware reaches every server at once; our guide on how to prevent ransomware sets out the controls that stop it spreading.

Does internal penetration testing include segmentation testing?

It can, and if segmentation reduces your PCI DSS scope it must. Requirement 11.4.5 requires segmentation controls to be tested at least every 12 months and after any change to them; 11.4.6 makes it every six months for service providers. From each out-of-scope network we scan towards the cardholder data environment (CDE) and check every open path against your approved flows. Our PCI DSS penetration testing service covers the internal, external and segmentation tests in Requirement 11.4.

How does remote internal penetration testing work?

Remote internal penetration testing gives our testers a foothold inside your network without a site visit, through a test virtual machine, a small test device or your own VPN, and most of our internal tests run this way. The right option depends on your estate:

How much does an internal penetration test cost?

It depends mainly on how many sites, network segments and Active Directory domains are in scope. Published prices from UK providers we reviewed in September 2026 include internal network tests from £1,800, and UK pricing guides we reviewed put typical day rates at about £1,000 to £1,500 per tester-day. We quote a fixed price once scope is agreed.

Our penetration testing cost guide compares prices across test types.

What do you receive after the test?

• A plain-English executive summary for leadership, auditors and customers
• Attack-path narratives showing where each chain breaks
• Findings with evidence, CVSS ratings and remediation steps
• An Active Directory appendix: privileged group members, Kerberoastable accounts, risky delegation
• A timeline of tester actions for your detection team
• A debrief call, then a retest of remediated findings, with terms confirmed in your fixed-price proposal

A single finding looks like this (illustrative, not client data):

Do you also need an external penetration test?

Usually, yes: an internal test shows what an attacker could do once inside, while an external penetration test shows whether they could get in from the internet, and PCI DSS requires both (11.4.2 and 11.4.3). Our comparison of internal vs external penetration testing explains which to prioritise if you can fund only one.

Internal and external describe where a test starts. The “three types of penetration testing” people often quote, black box, grey box and white box, describe how much the tester is told in advance instead, and an assumed breach internal test is usually grey box. Our overview of the types of penetration testing covers both ways of classifying a test.

Which compliance requirements does an internal penetration test meet?

The NCSC’s penetration testing guidance treats a test as a check on your vulnerability management, so each finding names the process gap behind it. PCI requirement text is in the PCI SSC document library. Preparing for Cyber Essentials Plus? Test a few weeks before the audit.

Why choose Sovereign Secure for internal penetration testing services?

• A PCI QSA company. The PCI Security Standards Council approves us as a Qualified Security Assessor company, Qualified PIN Assessor and Card Production Security Assessor, and we sit on its Global Executive Assessor Roundtable for 2026 to 2028. We know what assessors expect as 11.4.2 and 11.4.5 evidence.
• An IASME Cyber Essentials certification body, issuing CE and CE+ certificates.
• ISO 27001 certified, so the information security management system that governs your credentials and findings is independently audited.
• Clients in payments, banking, retail and hospitality, including Fiserv, Accor, JCPenney, Cashplus and Ahli United Bank.
• UK headquarters in Accrington, Lancashire. Remote testing by default, on-site when the scope needs it.

Get a fixed quote for your internal penetration test

Tell us your sites and network segments, rough user and server numbers, your Active Directory domains, whether remote testing suits you, and why you need the test (PCI DSS, ISO 27001, insurance or a customer). We will confirm scope and send a fixed-price proposal. Use the penetration testing quote form or call +44 161 523 5276.