Internal Penetration Testing for Your Business
Internal penetration testing services answer a worrying question: if someone got onto your network today, how far could they go? Omeiro starts from an assumed-breach position and looks for attack paths to Domain Admin, including unconstrained Active Directory delegation, LLMNR poisoning, SMB relaying and Kerberoasting.
What internal penetration testing looks at
The main areas we check, by hand with tools as support. The exact scope depends on your package and is agreed in writing before work starts.
Open services
- Open ports and services
- Old or unpatched versions
- Remote access
Logins
- Default passwords
- Weak password rules
- Shared admin accounts
Firewall and segments
- Rules that allow too much
- Flat networks
- Guest network access
Servers and devices
- Missing updates
- Exposed admin panels
- Unneeded features
Checklist Based on common risks and good practice. The exact scope depends on your package and is agreed in writing before work starts.
What you get with internal penetration testing
Assumed-breach internal network testing identifying unconstrained Active Directory delegation, LLMNR poisoning, SMB relaying, and Kerberoasting attack paths to Domain Admin.
Basic Package
Up to 25 internal hosts, findings report. 5-day delivery, 2 revisions.
Standard Package
Up to 100 hosts; privilege paths checked. 8-day delivery, 2 revisions.
Premium Package
Up to 300 hosts; Active Directory review; retest. 12-day delivery, 2 revisions.
Clear brief first
We confirm what you need before work starts, so the scope is clear on both sides.
Revisions listed
Each package shows its revision rounds. A round is one list of changes sent together.
Yours once paid
Copyright of the final work passes to you once the order is paid in full.
Work starts only after the scope is agreed in writing and you confirm you own or control the systems involved.
How our internal penetration testing works
Get a foothold
You give us the network access a compromised laptop would have.
Explore
We map hosts, shares and accounts.
Escalate
We try to climb to higher privilege using common weak spots.
Report
Attack paths and fixes are written up, with a retest on Premium.
Internal penetration testing: starting from an assumed breach
Internal penetration testing assumes an attacker already has a foothold, such as a phished laptop or a rogue device on a network port. We begin from a typical user position and measure how far they can travel. Provide network ranges, Active Directory details, any segments that are off limits and a contact for the test window. Production servers with fragile services are flagged ahead of time so aggressive checks are avoided on them.
The findings that matter most are chains, not single bugs. A weak service account password, a misconfigured certificate template and a missing SMB signing setting can together lead to full domain control. Good internal penetration testing documents each step, rates the path and recommends fixes that break the chain at the cheapest point. EDR tuning and privileged access management often follow as the next projects.
In short
- Delivery in 5 to 12 days, by package.
- Fixed price, shown before you order.
- IT managers wanting an assumed breach assessment after an incident elsewhere.
- Copyright yours after full payment.
Internal Penetration Testing: common questions
How much does internal penetration testing cost?
Prices are fixed and shown by package on our Internal Penetration Testing pricing page, so you see the full price before you order. You can also ask for a custom quote.
How long does internal network pentest take?
Delivery depends on the package: Basic 5-day delivery; Standard 8-day delivery; Premium 12-day delivery.
What is included in the Basic Package?
The Basic Package includes: Up to 25 internal hosts, findings report. Higher packages add more scope, revisions and support.
Can I get a custom assumed breach assessment package?
Yes. If none of the packages fits, use the custom package form on our pricing page to describe what you need, and our team sends you a fixed price.
Will the test disrupt staff?
We avoid risky actions and agree testing windows with you.
What access do you need?
A connection like a typical employee workstation, plus agreed scope.
How is this different from an external test?
External tests start outside, while this one starts inside your network.
Do you try to take over Domain Admin?
We try to show whether the path exists, within the rules you set.
What is an assumed breach assessment?
It starts from the assumption that an attacker has already got inside, for example through phishing. The test then measures what they could reach and how quickly your team would notice.
Who owns the final work?
Copyright of the final work passes to you once the order is paid in full. Paid fonts, stock files or licences, if used, are licensed in your name.
Ready to start your internal penetration testing?
Compare the packages and pick the one that fits. Not sure which? Write to us and we will help you choose.