Overview
Once an attacker holds a single laptop or VPN account, the internal network decides how bad the day gets. We start from that assumed foothold, usually over a secure remote connection, and work towards the systems your UK business could not run without. Where card data or patient data is involved, we also confirm whether segmentation actually keeps those zones apart.
Once an attacker has any foothold inside, whether through a phished laptop, a compromised supplier or a reachable service, the question is how far they can go. An internal test answers that by starting from an assumed-breach position on your network and attempting to expand access the way an intruder would: harvesting credentials, abusing misconfiguration, and pivoting from one system to the next toward the data and systems that would actually hurt you to lose.
We look hard at the weaknesses that let movement happen quietly. Shared local administrator passwords, credentials cached in memory and files, services running with too much privilege, and overly trusting network paths all let an attacker escalate without raising an alarm. We also test your segmentation directly, checking whether the boundaries you believe separate sensitive zones from the general network actually hold when pushed.
The output is a narrative of attack paths, not just a scan of internal hosts. We show the steps from initial foothold to high-value target, score each finding with CVSS v4.0, and recommend fixes that break the chain at the cheapest point, often a configuration change that removes an entire class of movement. Where this engagement meets a segmentation requirement, we document the result in terms your auditor will accept.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Access setupWe agree a starting position, from a connected device to a standard user account.
- DiscoveryWe map reachable systems, services, shares and trust relationships.
- Credential & escalationWe harvest credentials and pursue local and network privilege escalation.
- Lateral movementWe pivot toward critical assets, recording each step of the path.
- Report & debriefAttack paths are documented, scored and explained with chain-breaking fixes.
What you receive
- Narrative of attack paths from foothold to critical assets
- Risk-rated findings with CVSS v4.0 scores
- Segmentation test results where in scope
- Chain-breaking remediation prioritised by cost and impact
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- PTES
- NIST SP 800-115
- MITRE ATT&CK
- PCI DSS segmentation testing
- CVSS v4.0
- CWE
- UK GDPR Art. 32
- Cyber Essentials controls
Frequently asked questions
How do we give you internal access?
Usually a device we connect to your network, a VPN profile, or a jump host, plus a standard user account for assumed-breach testing. We agree the exact starting position with you, since it shapes what the test demonstrates.
Should testing start with or without credentials?
Assumed-breach, with a standard user account, reflects how most real intrusions unfold and finds far more in the time available. A zero-credential start is useful for specific questions, and we can combine both; we recommend the right mix during scoping.
Can this satisfy a segmentation testing requirement?
Yes. Where your scope calls for segmentation testing, we design the engagement to probe the specific boundaries involved and document whether they hold, in language suited to an auditor reviewing that control.
What permission do you need before testing our network?
Signed written authorisation from someone entitled to give it, which keeps the work on the right side of the Computer Misuse Act 1990. If a hosting company, landlord or managed IT provider runs part of the estate, we ask you to confirm their permission too.
Is this the same as a Cyber Essentials Plus audit?
No. Cyber Essentials Plus has a Certification Body check, hands-on, that the scheme's five controls are in place. An infrastructure pentest goes further, chaining weaknesses to show real attack paths. Many teams use our findings to tidy up before their Certification Body visits.