01
Active Directory
Excessive permissions, delegation, Kerberos and certificate services (AD CS) configuration.
Active Directory and Internal Network Testing
Once an attacker is inside, Active Directory is the first target. We find the paths from a staff laptop to domain admin before they do.
What it is
Most ransomware attacks start from a single compromised computer and spread through Active Directory to the whole company. In an internal network test we take the place of an attacker who has plugged into your network or taken over a staff account. We show how far we can get through excessive permissions, weak passwords, legacy protocols and misconfigurations, and report how to close every path.
What we cover
0602
Privilege escalation
Paths from a standard user to admin rights.
03
Lateral movement
Ways to move from one computer to others and to servers.
04
Password security
Weak, reused and non-expiring passwords, and service accounts.
05
Network separation
Whether user, server and management networks are really separate.
06
Legacy protocols
Settings attackers rely on, such as LLMNR, NTLM and SMBv1.
How we work
- 01
Scenario
A starting point is chosen: a device plugged into the network or a compromised user account.
- 02
Discovery
The domain, servers, permissions and trust relationships are mapped.
- 03
Attack paths
Privilege escalation and lateral movement paths are tried in a controlled way.
- 04
Report
Every attack path is described step by step with the fix to close it.
- 05
Hardening and retest
Once the recommended settings are in place, the paths are tried again.
What you get
- A step-by-step account of the paths to domain admin
- A list of risky permissions, accounts and settings
- Prioritised hardening recommendations
- A retest report after the fixes
When you need it
- If your company uses Active Directory or Entra ID
- If you want to see how ready you are for ransomware
- After a merger or a handover of IT infrastructure
- When your yearly penetration test only covers the external network
Methodologies & Standards
MITRE ATT&CKPTESNIST SP 800-115CIS BenchmarksMicrosoft Security Baselines
Frequently Asked
Not necessarily. A secure remote connection to your network or a test device we prepare is usually enough. On-site testing is also possible.
Testing is done without breaking anything; anything that could lock accounts or interrupt service is discussed first. No data is changed with the permissions we find.
Cloud identity has similar risks: excessive roles, application permissions and conditional access settings. We cover these in the cloud security review.
Related industries
More services in Cybersecurity
All ofCybersecurity- Penetration TestingWe find the gaps in your web, mobile, API and network before an attacker does.
- Source Code ReviewWe find vulnerabilities in the code itself, while it is still being written.
- Wireless (Wi-Fi) Security TestingWe test how exposed your office and guest Wi-Fi are to someone sitting in the car park.
- DDoS Resilience TestingWe measure, in a controlled way, whether your site and app stay up under heavy attack traffic.
- Phishing SimulationWe send your staff realistic fake e-mails, then raise awareness with short training.
- Cloud Security ReviewWe find public storage, excessive permissions and risky settings in your cloud accounts before an attacker does.
