Skip to content

Internal network penetration testing

An internal network penetration test shows how far an attacker gets once inside your network, for example after a phishing email or through an infected laptop. Mr Cyber tests segmentation, servers, credentials and the paths to your critical systems by hand, following PTES and NIST SP 800-115, at a fixed price, with a free retest.

Fixed price from €3,800 · 4 test days · retest included

See my fixed price

Prefer to talk first? Book a call

Office Guest Wi-Fi Server zone Firewall no filter srv-db srv-file srv-erp
A laptop on the guest Wi-Fi can reach the server zone directly.
  • 4–8 test days4 test days in the starting price
  • PTES+ 4 more standards
  • Report + debriefwithin 5 business days
  • Free retestwithin 60 days

Who it’s for

  • Mittelstand companies with a NIS2 duty or an ISO 27001 or TISAX audit
  • Companies that want to know what one compromised laptop could do
  • Manufacturers that need to check separation between office and production networks
  • Teams after a network redesign, a merger or a ransomware scare

What we test

Segmentation

  • Separation between office, server and production networks
  • Access to management networks and backups
  • Guest and wireless network separation, on request

Servers & services

  • File shares and stored sensitive data
  • Outdated software and missing patches
  • Databases, management interfaces and web applications inside the network

Credentials & access

  • Weak and reused passwords
  • Credentials stored in scripts, shares and tools
  • Local admin rights on clients and servers

Paths to critical systems

  • From a normal user to domain admin
  • Access to backups, ERP and production systems
  • Detection of the test by your monitoring
See my fixed price

Prefer to talk first? Book a call

Also covered. In the same test, or as an engagement of its own.

Wireless (Wi-Fi)

Office, warehouse and production Wi-Fi, tested on site in Germany, Austria and Switzerland. We check encryption and authentication, separation of guest and device networks from your business network, access points nobody approved, and what a connected device can reach.

No surcharge Add to my request

OT/ICS & production networks

Production networks and control systems, assessed passive-first. We start with documents and passive traffic analysis. Active checks only run in agreed test windows on systems you release, never on safety systems, to keep the impact on operations minimal. IEC 62443 serves as the reference, with NIS2 in mind. Offered as a separate engagement.

Separate engagement, from €5,700 · 6 test days · plus travel Add to my request

Configuration & hardening review

Servers, clients, firewalls and golden images, compared with the CIS Benchmarks and BSI IT-Grundschutz. You get the deviations that matter, the recommended setting for each, and a hardening plan in a clear order.

No surcharge Add to my request

No extra fee for the topic itself. If it needs more test days, the quote shows them upfront.

How we test your internal network. Five phases, one tester.

The same senior tester from first scope to retest.

test days in the starting price
4
business days to the report
5
days for the free retest
60

Typically 4–8 testing days, depending on network size, locations and segments.

  1. Phase 1

    Scope & start date

    Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing.

    You pick the date

  2. Phase 2

    Network mapping

    Hosts, segments and services inside your network charted.

    Test day 1

  3. Phase 3

    Internal testing

    Segmentation, weak services and lateral movement tested.

    From test day 2

  4. Phase 4

    Report & debrief

    Audit-ready report and ticket file, then a call.

    Within 5 business days

  5. Phase 5

    Free retest

    Your fixes tested again and confirmed in writing.

    Within 60 days

Methodology & standards

  • PTES
  • NIST SP 800-115
  • MITRE ATT&CK
  • CIS Controls
  • CVSS 3.1

How we run an internal test

We start where a real attacker would: with a normal user account, or with network access only. From there we look for the paths to your critical systems and test them by hand (in large networks a representative sample plus the attack paths), following PTES and NIST SP 800-115.

You set the limits

Before the start we agree in writing which networks are in scope, which systems are off-limits and when testing happens. Production systems that must not be touched are excluded or checked passively only.

Critical findings don’t wait for the report

If we reach critical systems or find something urgent, you hear from us the same day.

Attack paths your team can follow

The report shows each path from the starting point to the critical system, step by step, so your IT team can see where one fix breaks the whole chain.

What you get

  • Executive summary for management and auditors
  • Attack paths shown step by step, from the starting point to critical systems
  • Every finding with evidence and fix guidance
  • CVSS 3.1 scoring plus business-risk rating and remediation priorities
  • Debrief call with your IT team
  • Free retest and updated report

Always included

  • Free retest within 60 days
  • Debrief call with your team
  • NDA, DPA and testing authorisation with the offer
  • Critical findings reported the same day
  • Testing stops at any time on your call
  • Audit-ready report (PDF)
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
See my fixed price See the report
Pentest report · Admin & Söhne GmbH · MC-2026-023
Risk: High CVSS 3.1 · 8.8 Open · retest included

Guest Wi-Fi reaches the file server with all scanned documents

Visitor Wi-Fi “AS-Gast” · file server 10.20.1.15 · shared folder “Scans”

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A laptop in the visitor Wi-Fi can reach the server zone. The “Scans” folder there opens without a password and holds every document the office printers have scanned. Visitors can not only read these files, they can also change and delete them.

Steps to reproduce

  1. Connect a test laptop to the visitor Wi-Fi with the guest password from the reception desk.
  2. Observe that the file server in the server zone can be reached from there.
  3. Open the “Scans” folder without a password, save a harmless test file and delete it again.
Test laptop in "AS-Gast" (visitor Wi-Fi)
  → file server 10.20.1.15 reachable
Shared folder "Scans": no password · read = yes · write = yes
Content: 18,400 files (ID scans, contracts, invoices)

Business impact

Any visitor, applicant or contractor can copy ID card scans, signed contracts and invoices from the meeting room, or encrypt and delete them. A GDPR breach reportable within 72 hours, and a ready path for ransomware into your server zone, without any hacking skill.

Remediation

Separate the visitor Wi-Fi from all internal networks so it only reaches the internet. Protect the “Scans” folder with a login, limit it to the people who need it, and delete old scans regularly. Check the other shared folders for the same setting.

CWE-284 (Improper Access Control) · CWE-732 (Incorrect Permission Assignment for Critical Resource) · BSI IT-Grundschutz NET.1.1 (network architecture) · MITRE ATT&CK T1039 (Data from Network Shared Drive)

Fixed price from

€3,800

4 test days · report in 5 business days · retest included

Services exclusively for businesses. · What drives the price

See my fixed price

Prefer to talk first? Book a call

Frequently asked questions

How much does an internal penetration test cost?
The price depends on the number of locations, segments and hosts. The quote form shows your binding fixed price instantly (on-site work and very large networks need a short call first); for priced scopes the written offer (PDF) is sent to you by email right after your request. Prices start at €3,800.
Will the test disrupt our operations?
No. Test windows, excluded systems and test intensity are agreed upfront. Sensitive systems such as production control can be left out or only checked passively. Nothing destructive happens without your explicit approval.
Does someone need to come on site?
Usually not. The test runs remotely through a small virtual machine or VPN access you provide in your network. We send you the setup in advance. On-site testing in Germany, Austria and Switzerland is available on request, plus travel costs.
What do you need from us?
A network access point (virtual machine or VPN), a normal user account, the address ranges in scope, a list of excluded systems and a contact for emergencies.
Is Active Directory part of the internal test?
Internal tests always touch Active Directory, because most attack paths run through it. A dedicated Active Directory pentest goes deeper and reviews the whole directory configuration.

Related services

NIS2 & Compliance

Internal network pentest: your fixed price in seconds

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call