Network Pentest internal, external & infrastructure
A network pentest is a penetration test of your infrastructure — external perimeter, internal network, Active Directory, segmentation, VPN and Wi-Fi — that reproduces a real attacker's behavior to prove, with evidence, how far they could reach from the internet or from inside your network.
What a network pentest is
A network pentest assesses IT infrastructure security from a real attacker's perspective, covering both the external perimeter exposed to the internet and the corporate internal network. The goal goes beyond a scanner report: we enumerate services, exploit flaws in a controlled way and chain findings into attack paths that demonstrate concrete impact on servers, workstations, domains and data.
An infrastructure pentest combines two perspectives. Externally, we measure what an attacker with no access can reach from the internet. Internally — usually under an assumed-breach premise — we start from a point on the network to measure lateral movement, privilege escalation and the reach of an attacker already inside. Berghem delivers each finding with a proof of concept, evidence, severity and impact-prioritized remediation.
For regulated institutions, infrastructure scope must also meet sector requirements — including the BACEN/CMN resolutions on cybersecurity. We structure the test to produce evidence useful to your compliance process.
What's included
What we test in a network pentest
We cover the external perimeter and the internal network. Each domain below is enumerated, manually validated and chained into attack paths that demonstrate real impact — never just an isolated tool finding.
External network and perimeter
We enumerate the internet-facing surface — servers, portals, VPNs, email, DNS and published services — looking for vulnerable versions, weak credentials, forgotten services and misconfigurations. The goal is to identify how an attacker with no access gains the first foothold in the environment.
Internal network and lateral movement
Starting from a point on the internal network, we map hosts, services and trust relationships to reproduce lateral movement. We exploit legacy protocols, open shares, reused credentials and misconfigured services to measure the real reach of an attacker already inside the perimeter.
Active Directory
Active Directory is the central target of most internal attacks. We analyze Kerberos (Kerberoasting and AS-REP roasting), insecure ACLs and delegations, passwords in GPOs, cross-domain trusts and escalation paths to Domain Admin — always in a controlled, reproducible way.
Network segmentation
We test whether logical segmentation actually contains an attacker. We check isolation between VLANs, filtering between network zones, internal firewall rules and the separation of sensitive environments — such as cardholder data, OT or management networks — from the rest of the infrastructure.
VPN and remote access
We assess VPN concentrators, gateways and remote-access services for vulnerable versions, weak authentication, missing MFA and flaws that bypass access control. Remote access is today one of the leading entry vectors in real-world incidents.
Wi-Fi networks
We test corporate and guest wireless networks: authentication mechanisms (WPA2/WPA3, 802.1X), EAP attacks, open or poorly isolated networks and the ability to pivot from Wi-Fi into the internal network. We also assess the separation between the guest network and the corporate environment.
Modalities of an infrastructure pentest
A network penetration test can start from outside or inside. We combine modalities to fit the goal — mapping external exposure, measuring the blast radius of an internal compromise, or assessing domain resilience.
External network pentest
The perspective of an attacker on the internet, with no prior access. We enumerate and exploit the external surface to identify how an intruder gains the first access to the environment — the scenario closest to a real opportunistic attack.
Internal network pentest
We start from a point inside the network — a compromised workstation or a network jack — to measure lateral movement, escalation and the reach of an attacker already present. It measures the real damage after the first compromise.
Active Directory pentest
Focused on the Windows identity infrastructure: we map attack paths in Active Directory, assess hardening, delegations, Kerberos and trusts, and measure the distance between an ordinary user and full control of the domain.
How we run the test
We work with agreed rules of engagement and a secure channel with the client from start to finish. We align windows, limits and stop criteria to preserve operational stability throughout the exercise.
Scope and rules of engagement
We define IP ranges, segments and in-scope assets, the modality (external, internal or both), test windows and limits. We agree on authorization, points of contact and stop criteria before any action.
Reconnaissance and enumeration
We inventory hosts, services, versions and trust relationships with active scanning and manual review. We build the map of the network and identities to locate the most promising attack paths, cutting noise and false positives.
Exploitation and lateral movement
We exploit flaws in a controlled way — initial access, privilege escalation, lateral movement and domain compromise — chaining findings into full attack scenarios while preserving system stability.
Report and remediation
We deliver each finding with a proof of concept, evidence, severity rating and impact-prioritized remediation. We present the results technically and offer a retest to validate the fixes applied.
Related services
A network pentest usually pairs with other offensive-security and infrastructure-testing efforts.
Cloud Pentest
Penetration testing of AWS, Azure and GCP environments — complements network scope by covering cloud and hybrid infrastructure.
Red Team
End-to-end adversary simulation with defined objectives, stealth and assessment of detection and response capability.
Social Engineering
Phishing and pretexting that are frequently the initial access vector for compromising the internal network.
Offensive Security
Overview of Berghem's offensive-security pillar: pentest, Red Team and adversary simulation.
Frequently asked questions about network pentesting
What's the difference between an external and internal network pentest?
What is tested in an Active Directory pentest?
Does a network pentest interfere with operations?
Does an infrastructure pentest meet compliance requirements?
Ready to test your network?
In a 30-minute conversation we map your internal and external infrastructure and design the ideal network-pentest scope.
Talk to a specialist