Penetration Testing
Network Penetration Testing (Infrastructure Penetration Testing)
Network penetration testing is a manual attack on your servers, network devices and Active Directory, from the internet-facing perimeter to the internal estate, that shows how far a real attacker could get. As a PCI SSC-approved QSA company, we document external, internal and segmentation tests as PCI DSS 11.4 evidence.
Prefer to talk? Call +44 161 523 5276
- External and internal infrastructure testing
- Active Directory attack paths
- PCI DSS 11.4.5 segmentation testing
Trusted by banks, payment providers and global brands
On this page
- Network penetration testing services: what's included
- What an infrastructure pentest covers
- Internal, external or both?
- How long does a network penetration test take?
- How much does network penetration testing cost?
- Which tools do network penetration testers use?
- How is a network penetration test carried out?
- Why choose Sovereign Secure for network penetration testing?
- Frequently asked questions
Overview
What is network penetration testing?
The short answer
Network penetration testing, also called infrastructure penetration testing, is a manual attack on your servers, network devices and Active Directory. It covers the external perimeter as seen from the internet, the internal network as seen by a phished user or insider, and, for PCI DSS, the segmentation that isolates the cardholder data environment.
Network penetration testing (also called infrastructure penetration testing, or network pen testing for short) is a manual, authorised attack on your servers, network devices, remote access and directory services that finds and proves the weaknesses that lead to a breach. A network penetration test has two halves, and most organisations need both.
External testing looks at everything you expose to the internet the way an outside attacker would: firewalls, VPN and remote access, email, DNS and web servers. Our external penetration testing service covers that perimeter in detail, including what PCI DSS Requirement 11.4.3 asks for.
Internal testing starts from inside the network, modelling a phished employee, a malicious insider or malware that has already landed. It focuses on Active Directory, because that is where most real intrusions escalate. Our internal penetration testing service shows how we work from a standard user towards domain administrator.
Segmentation testing confirms that the controls isolating your cardholder data environment actually hold. PCI DSS Requirement 11.4.5 requires it at least every 12 months, and 11.4.6 every six months for service providers. Our PCI DSS penetration testing service brings all three together in one report written for your QSA.
Need testers on site? Our head office is in Accrington, Lancashire, so we reach offices and data centres across Manchester and the North West for internal work, and we test remotely across the rest of the UK and abroad.
What's included
Network penetration testing services: what's included
A network engagement can cover external, internal or both, plus segmentation testing.
- 01
External perimeter testing
Assessment of your internet-facing hosts and services for exposed entry points, weak services and exploitable vulnerabilities.
- 02
Internal infrastructure testing
Testing from inside the network to model an insider or a foothold attacker, working towards sensitive systems and data.
- 03
Active Directory assessment
Identification of privilege-escalation and lateral-movement paths from a standard user to domain administrator. Our guide to Active Directory penetration testing explains the common attack paths.
- 04
Segmentation testing
Verification that network segmentation isolating the cardholder data environment holds, as required by PCI DSS 11.4.5.
- 05
Service and patch analysis
Enumeration of exposed services, protocols and software versions, with exploitable issues confirmed by hand.
- 06
Credential and authentication testing
Checks for weak, default and reused credentials, and for insecure authentication across the estate.
- 07
Manual verification
Every finding validated by hand, with clear reproduction steps and evidence.
- 08
Retest
A retest of remediated findings, scoped in your fixed-price proposal, with the report updated to show them closed.
What we test for
What an infrastructure pentest covers
Coverage spans the external perimeter, the internal network and PCI segmentation.
Exposed services and entry points
Open ports and unnecessary services that offer an attacker a way in.
- Unfiltered open TCP and UDP ports
- Legacy or unpatched services
- Exposed admin and management interfaces
- Unused but active services
- Poorly segmented network zones
Insecure protocols and encryption
Outdated or unencrypted communication that lets an attacker intercept or manipulate traffic.
- Plaintext protocols such as Telnet and FTP
- Weak or deprecated TLS and SSL configurations
- SMB signing and legacy SMB issues
- Insecure remote access such as RDP without network level authentication
- Missing encryption for internal traffic
Outdated and vulnerable software
Exploitable components across devices and services with known vulnerabilities.
- Services with known CVEs
- Outdated firmware on routers, switches and firewalls
- Legacy or unsupported operating systems
- Unpatched third-party applications
- Vulnerable open-source packages
Active Directory and lateral movement
The misconfigurations and trust relationships that let an attacker escalate from a standard user to domain administrator.
- Weak, reused and cached credentials
- Kerberos and authentication misconfigurations
- Excessive privileges and unsafe delegation
- Insecure trust relationships and shares
- Lateral-movement and privilege-escalation paths
Firewalls and access controls
Rule sets and ACLs that expose internal systems or fail to block unauthorised access.
- Overly permissive firewall rules
- Inbound access from untrusted networks
- Missing egress filtering
- Insecure default configurations
- Gaps in logging and alerting
PCI segmentation
Controls meant to isolate the cardholder data environment, tested to confirm they hold.
- Reachability from out-of-scope to in-scope networks
- Effectiveness of segmentation controls (PCI DSS 11.4.5)
- Leakage between network zones
- Firewall and VLAN boundary enforcement
- Scope confirmation for the cardholder data environment
Internal, external or both?
Most organisations need both, because the two tests answer different questions: what an attacker can reach from the internet, and how far one compromised account or device inside the network can go. Our guide to internal vs external penetration testing covers the choice in more detail.
| Test | Attacker position | Typical findings | PCI DSS |
|---|---|---|---|
| External penetration testing | On the internet, with no access to your network | Exposed services, weak VPN and remote access, unpatched internet-facing hosts, weak TLS, default credentials | Requirement 11.4.3 |
| Internal penetration testing | Inside the network, as a phished user, an insider or an infected device | Active Directory attack paths, weak and reused credentials, missing patches, flat networks, lateral movement | Requirement 11.4.2 |
| Segmentation testing | Between network zones | Routes from out-of-scope networks into the cardholder data environment | Requirements 11.4.5 and 11.4.6 |
If your Wi-Fi is in scope, add wireless penetration testing: a foothold on the wireless network quickly becomes an internal network problem. To check the firewall rules themselves line by line, rather than what gets through them, add a firewall security audit. Our overview of the types of penetration testing shows where network tests sit alongside application, cloud and social engineering tests.
How long does a network penetration test take?
It depends on how much there is to test. In the published prices from UK providers we reviewed in September 2026, a small fixed-scope external test of 1 to 5 IP addresses equated to about half a day of consultant time, and a scoped external engagement to about 2.5 to 6 days. Internal tests usually take longer, because Active Directory gives a tester far more ground to cover. These factors set the number of days:
| Driver | Effect on duration |
|---|---|
| Live IP addresses and exposed services | The main driver for an external test |
| Hosts, sites and subnets | More segments to reach and enumerate on an internal test |
| Active Directory size and trusts | Larger domains and trusts between them open more attack paths to follow |
| Segmentation in scope | Each zone boundary tested for PCI DSS adds time |
| Access method | On site, through network access, or through a test device on the relevant segments |
Telling the tester more in advance (grey box) puts more of those days into testing rather than discovery; our guide to black box vs white box penetration testing explains the trade-off. We confirm the number of days in your proposal.
How much does network penetration testing cost?
In the published prices from UK providers we reviewed in September 2026, external network penetration tests ranged from £550 for 1 to 5 IP addresses to £6,250 or more for a scoped engagement, and internal network tests started from about £1,800. These are market figures from a small sample, not Sovereign Secure prices.
| Test | Published UK prices (September 2026) | What moves the price |
|---|---|---|
| External network test | £550 (1 to 5 IPs) to £3,500 (50+ IPs) as fixed packages; £3,750 to £6,250+ as scoped engagements | Live IPs, exposed services, VPN and remote access, email and DNS |
| Internal network test | From £1,800 | Sites and subnets, Active Directory size, on-site or remote access |
Our penetration testing cost guide explains how tester-days turn into a price, and the network penetration testing quote form collects the IP ranges, sites and domain size we need to scope yours.
Which tools do network penetration testers use?
Testers commonly use port scanners such as Nmap to find live hosts and services, vulnerability scanners such as Nessus or OpenVAS to flag known weaknesses, packet capture tools such as Wireshark, and Active Directory tools such as BloodHound to map the paths from a standard user to domain admin.
Tools produce leads, not findings. A tester confirms each one by hand, discards the false positives and chains the real issues together, which is what turns a list of vulnerabilities into an attack path your team can fix.
How it works
How is a network penetration test carried out?
- 1
Scoping
We agree the in-scope ranges, whether the test is external, internal or both, and the rules of engagement, then fix the price. Our checklist on how to prepare for a penetration test covers your side.
- 2
Discovery
We enumerate hosts, services and the network layout, mapping the attack surface.
- 3
Testing
Manual exploitation and privilege escalation across the perimeter, the internal network and Active Directory, plus segmentation checks where required.
- 4
Reporting
An executive summary and technical report with reproduction steps, CVSS ratings, attack paths and remediation advice.
- 5
Debrief
A walkthrough with your team covering the findings, the attack paths and the fixes.
- 6
Retest
Once remediated, we retest and reissue the report showing findings closed.
Every test follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.
Why Sovereign Secure
Why choose Sovereign Secure for network penetration testing?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- Segmentation testing documented by a QSA company, so it stands as PCI DSS 11.4.5 evidence.
- Real attack-path testing through Active Directory, not just a vulnerability list.
- External and internal testing scoped together or separately, as you need.
- Fixed scope and price, with any retest and its window agreed in your proposal.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
Do you test Active Directory?
Yes. Internal engagements focus heavily on Active Directory, mapping the paths from a standard user to domain administrator through misconfigurations, weak credentials and unsafe trust relationships.
Does this satisfy PCI DSS 11.4 and 11.4.5?
Yes. Internal and external penetration testing addresses Requirements 11.4.2 and 11.4.3, and segmentation testing addresses Requirement 11.4.5. As a PCI QSA company, we document both so they serve directly as your evidence.
How often is segmentation testing required for PCI?
PCI DSS requires segmentation testing at least once every 12 months for merchants, and at least once every six months for service providers, and after any change to segmentation controls. We can schedule tests to match your assessment cycle.
How often should we run an infrastructure penetration test?
At least once a year and after any significant change, such as a new site, a firewall replacement or a cloud migration. PCI DSS sets the same 12-month minimum for internal and external tests, and ISO 27001 auditors look for a regular cadence under Annex A 8.8.
What do you need from us for a network or infrastructure penetration test?
For an external test, the in-scope IP ranges and any allow-listing needed. For an internal test, network access or a test device on the relevant segments, and standard-user credentials for Active Directory testing. We confirm the detail during scoping.
Will testing affect running systems?
We plan around your operations and agree rules of engagement in advance. We avoid denial-of-service techniques, exercise care with fragile legacy systems, and escalate anything critical immediately.
Is network penetration testing legal?
Yes, when the owner of the systems authorises it in writing; testing a network without permission can be an offence under the Computer Misuse Act 1990, as our guide to whether penetration testing is legal in the UK explains.
Can network penetration testing be done remotely?
Mostly, yes. An external test is remote by nature, since it attacks your internet-facing systems from outside, and an internal test can usually run through a VPN connection or a test device or virtual machine placed on the relevant network segments. On-site visits are mainly needed for wireless penetration testing, physical access checks and networks that cannot be reached any other way.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- External Penetration TestingExternal penetration testing of your internet-facing perimeter by a PCI QSA company: VPN, email, web and cloud, mapped to PCI DSS 11.4.3. Get a fixed quote.
- Internal Penetration TestingInternal penetration testing by a PCI QSA company: Active Directory attack paths, lateral movement and PCI 11.4.5 segmentation, remote or on-site. Get a quote.
- PCI DSS penetration testingPCI compliance penetration testing to PCI DSS Requirement 11.4 by a QSA company: internal, external, application and segmentation pen tests with ROC-ready reports.
- Firewall & config reviewFirewall security audit and configuration review against CIS Benchmarks and PCI DSS Requirement 1: rule-base analysis, segmentation checks and hardening advice.
- Penetration testing costPen test cost in the UK for 2026: published day rates and penetration testing price ranges by test type, what drives cost, and how to get a fixed quote.
- Penetration testing quoteScope your test types and asset counts and get a fixed-price penetration testing proposal.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“The Cyber Security Services were delivered on time and price was competitive.”
Call +44 161 523 5276
Email [email protected]