The perimeter
Everything answering on your public addresses.
- Full port and service discovery
- Exposed management and remote access
- VPN, mail and edge device configuration
- Unpatched and end-of-life services
Two different questions, and most organizations only ever ask the first. From outside: what can somebody reach without an account. From inside: once one laptop is compromised, how far does it go, and how long before anybody notices. Protonyte runs both for companies in the US, the UK and the Gulf, following NIST SP 800-115 and the PTES, with Active Directory treated as the main event rather than an afterthought.
An external test answers the question your insurer asks: what is reachable from the internet, and can it be used. Exposed management interfaces, forgotten test servers, unpatched edge devices, VPN portals with no second factor.
An internal test answers the question that decides how bad a bad day gets. We start from a normal user account or a plugged-in laptop, exactly where a phishing email or a stolen password would leave an attacker, and see how far it goes. In most environments the honest answer is domain administrator in under a day - not because anything was unpatched, but because of how Active Directory was configured years ago and never revisited.
Structured on NIST SP 800-115 and the Penetration Testing Execution Standard, so the coverage is defensible and the report maps to something your auditor recognises.
Everything answering on your public addresses.
How an attacker turns reachable into logged in.
Starting where a phished user would leave an attacker.
The single most productive target in most corporate networks.
Whether the zones on the diagram exist on the wire.
Recorded as we go, and compared with your logs at the end.
Address ranges, the office or offices, the test window and the stop conditions, in writing.
A full picture of what is answering, before anything is attacked.
Careful, agreed and evidenced. We prove access rather than take anything.
From one foothold to the next, the way an intrusion actually progresses.
A route map of how we got in, a fix list in priority order, and a free retest.
Two documents and a conversation. Written so the person who signs the invoice and the person who writes the fix can both use them.
The work follows NIST SP 800-115, PTES, MITRE ATT&CK and CIS Benchmarks, so the coverage can be checked rather than taken on trust, and the report maps to what your auditor or your enterprise customer already recognises.
This page is one part of our penetration testing service. Where a finding needs a different kind of engagement to answer properly, we say so in the report rather than selling you the test we happen to be running.
External is run from the internet with no access, and answers what a stranger can reach. Internal is run from inside your network with a normal user account or a connected laptop, and answers how far a phished employee or a stolen password gets. They find different things, and most organizations only buy the first.
Not necessarily. An internal test can be run from a small device we ship to you, or from a virtual machine on your network, which keeps the cost down for Gulf clients. We do travel where the engagement needs it, and wireless or physical testing has to be on site.
No. Denial-of-service techniques are excluded by default and exploitation is agreed in advance. We prove access and stop; we do not encrypt, delete or move your data. Fragile or legacy hosts can be marked for enumeration only.
Annually as a floor, and again after a significant change - a new office, a datacentre move, a merger, a new edge device. PCI DSS requires it at least annually and after any significant change, and requires segmentation testing on top of that.
Yes, and it is normally the most valuable part. Delegation, certificate services, group nesting and service accounts accumulate quietly over years, and the result is usually a short path from a normal user to domain administrator that no patch would have closed.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.