Vulnerability Assessment
Broad scanning, verification and prioritisation of known vulnerabilities across your systems.
Services
Internal Network Penetration Testing
An internal penetration test starts from an agreed foothold, such as a compromised employee device, and assesses how an attacker could move towards critical systems.
The test starts from a device connected to your network, or a virtual machine you provide, with ordinary employee privileges. The goal is to find paths for lateral movement and privilege escalation.
We map our findings to MITRE ATT&CK techniques, so you can see clearly which control would have stopped the attack at which stage.
What we test
- Active Directory configuration, group policies and privilege relationships
- Password policies and credential abuse
- Network segmentation and access paths to critical systems
- Unpatched servers, file shares and internal web applications
- Lateral movement and privilege escalation scenarios
- Wireless network segregation (if in scope)
How we work
Starting point
We start with an employee account and device, or a test machine you provide.
Discovery
We map the network, Active Directory relationships and critical assets.
Progression
We attempt lateral movement and privilege escalation in a controlled manner.
Reporting
We document the attack chains, the ATT&CK mapping and prioritised countermeasures.
What you receive
- Attack chain narrative
- Executive summary
- Technical findings mapped to ATT&CK
- Active Directory hardening advice
A good fit for
- Businesses with an office network and servers
- Companies using Active Directory
- Anyone wanting to measure ransomware risk
Frequently asked questions
Is it done on site or remotely?
In most cases, a virtual machine deployed in your network or VPN access is enough. If needed, we can work on site in and around Tekirdağ.
Can you test during business hours?
Yes. Steps that could affect users are scheduled for time windows we agree with you.
Related services
Continuous Security and Attack Surface Monitoring
Regular monitoring of your internet-facing assets, with alerts for new exposures and changes.
Compliance Readiness: KVKK, ISO 27001, NIS2
Technical and process-focused preparation for KVKK, ISO/IEC 27001:2022 and, for Germany, NIS2/GDPR requirements.
See your weaknesses before attackers do.
Let's define the scope together. You'll receive a written proposal with the right type of test and a clear timeline.