Internal network pentest

During a pentest with the internal IT infrastructure as scope, weaknesses and vulnerabilities are identified and, where possible, exploited to achieve the agreed-upon objectives. Depending on those objectives, lateral movement through the network may also be attempted.

With physical access to the internal corporate network granted, potential technical risks can be identified and the feasibility of exploiting them in practice can be demonstrated.

To make the assessment more efficient and therefore potentially save time and costs, an assumed-breach or insider-threat scenario can be applied. This means that credentials for a (low-privileged) user account are provided as a starting point, simulating a scenario in which credentials have been obtained, for example through a successful social engineering attack (such as phishing) or misuse by an internal user.