---
title: "Internal Network Penetration Testing | Mr Cyber"
url: https://mr-cyber.com/services/internal-network-penetration-testing
language: en
description: "Manual internal pentest that shows how far an attacker gets inside your network. Segmentation, servers, credentials and lateral movement. Fixed price."
---

# Internal network penetration testing

An internal network penetration test shows how far an attacker gets once inside your network, for example after a phishing email or through an infected laptop. Mr Cyber tests segmentation, servers, credentials and the paths to your critical systems by hand, following PTES and NIST SP 800-115, at a fixed price, with a free retest.

Fixed price **from €3,800** · 4 test days · retest included

[See my fixed price](https://mr-cyber.com/quote?service=internal)

Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book)

A laptop on the guest Wi-Fi can reach the server zone directly.

-   **4–8 test days**4 test days in the starting price
-   **PTES**\+ 4 more standards
-   **Report + debrief**within 5 business days
-   **Free retest**within 60 days

## Who it’s for

-   Mittelstand companies with a NIS2 duty or an ISO 27001 or TISAX audit
-   Companies that want to know what one compromised laptop could do
-   Manufacturers that need to check separation between office and production networks
-   Teams after a network redesign, a merger or a ransomware scare

## What we test

### Segmentation

-   Separation between office, server and production networks
-   Access to management networks and backups
-   Guest and wireless network separation, on request

### Servers & services

-   File shares and stored sensitive data
-   Outdated software and missing patches
-   Databases, management interfaces and web applications inside the network

### Credentials & access

-   Weak and reused passwords
-   Credentials stored in scripts, shares and tools
-   Local admin rights on clients and servers

### Paths to critical systems

-   From a normal user to domain admin
-   Access to backups, ERP and production systems
-   Detection of the test by your monitoring

## Also covered. In the same test, or as an engagement of its own.

## Wireless (Wi-Fi)

Office, warehouse and production Wi-Fi, tested on site in Germany, Austria and Switzerland. We check encryption and authentication, separation of guest and device networks from your business network, access points nobody approved, and what a connected device can reach.

No surcharge [Add to my request](https://mr-cyber.com/quote?service=internal,wireless)

## OT/ICS & production networks

Production networks and control systems, assessed passive-first. We start with documents and passive traffic analysis. Active checks only run in agreed test windows on systems you release, never on safety systems, to keep the impact on operations minimal. IEC 62443 serves as the reference, with NIS2 in mind. Offered as a separate engagement.

Separate engagement, from **€5,700** · 6 test days · plus travel [Add to my request](https://mr-cyber.com/quote?service=ot)

## Configuration & hardening review

Servers, clients, firewalls and golden images, compared with the CIS Benchmarks and BSI IT-Grundschutz. You get the deviations that matter, the recommended setting for each, and a hardening plan in a clear order.

No surcharge [Add to my request](https://mr-cyber.com/quote?service=internal,hardening)

No extra fee for the topic itself. If it needs more test days, the quote shows them upfront.

## How we test your internal network. Five phases, one tester.

The same senior tester from first scope to retest.

test days in the starting price

4

business days to the report

5

days for the free retest

60

Typically 4–8 testing days, depending on network size, locations and segments.

1.  Phase 1
    
    ### Scope & start date
    
    Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing.
    
    You pick the date
2.  Phase 2
    
    ### Network mapping
    
    Hosts, segments and services inside your network charted.
    
    Test day 1
3.  Phase 3
    
    ### Internal testing
    
    Segmentation, weak services and lateral movement tested.
    
    From test day 2
4.  Phase 4
    
    ### Report & debrief
    
    Audit-ready report and ticket file, then a call.
    
    Within 5 business days
5.  Phase 5
    
    ### Free retest
    
    Your fixes tested again and confirmed in writing.
    
    Within 60 days

## Methodology & standards

-   PTES
-   NIST SP 800-115
-   MITRE ATT&CK
-   CIS Controls
-   CVSS 3.1

## How we run an internal test

We start where a real attacker would: with a normal user account, or with network access only. From there we look for the paths to your critical systems and test them by hand (in large networks a representative sample plus the attack paths), following [PTES](http://www.pentest-standard.org/) and [NIST SP 800-115](https://csrc.nist.gov/pubs/sp/800/115/final).

### You set the limits

Before the start we agree in writing which networks are in scope, which systems are off-limits and when testing happens. Production systems that must not be touched are excluded or checked passively only.

### Critical findings don’t wait for the report

If we reach critical systems or find something urgent, you hear from us the same day.

### Attack paths your team can follow

The report shows each path from the starting point to the critical system, step by step, so your IT team can see where one fix breaks the whole chain.

## What you get

-   Executive summary for management and auditors
-   Attack paths shown step by step, from the starting point to critical systems
-   Every finding with evidence and fix guidance
-   CVSS 3.1 scoring plus business-risk rating and remediation priorities
-   Debrief call with your IT team
-   Free retest and updated report

### Always included

-   Free retest within 60 days
-   Debrief call with your team
-   NDA, DPA and testing authorisation with the offer
-   Critical findings reported the same day
-   Testing stops at any time on your call
-   Audit-ready report (PDF)
-   Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
-   Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42

Pentest report · Admin & Söhne GmbH · MC-2026-023

Risk: High CVSS 3.1 · 8.8 Open · retest included

### Guest Wi-Fi reaches the file server with all scanned documents

Visitor Wi-Fi “AS-Gast” · file server 10.20.1.15 · shared folder “Scans”

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

#### Description

A laptop in the visitor Wi-Fi can reach the server zone. The “Scans” folder there opens without a password and holds every document the office printers have scanned. Visitors can not only read these files, they can also change and delete them.

#### Steps to reproduce

1.  Connect a test laptop to the visitor Wi-Fi with the guest password from the reception desk.
2.  Observe that the file server in the server zone can be reached from there.
3.  Open the “Scans” folder without a password, save a harmless test file and delete it again.

```
Test laptop in "AS-Gast" (visitor Wi-Fi)
  → file server 10.20.1.15 reachable
Shared folder "Scans": no password · read = yes · write = yes
Content: 18,400 files (ID scans, contracts, invoices)
```

#### Business impact

Any visitor, applicant or contractor can copy ID card scans, signed contracts and invoices from the meeting room, or encrypt and delete them. A GDPR breach reportable within 72 hours, and a ready path for ransomware into your server zone, without any hacking skill.

#### Remediation

Separate the visitor Wi-Fi from all internal networks so it only reaches the internet. Protect the “Scans” folder with a login, limit it to the people who need it, and delete old scans regularly. Check the other shared folders for the same setting.

CWE-284 (Improper Access Control) · CWE-732 (Incorrect Permission Assignment for Critical Resource) · BSI IT-Grundschutz NET.1.1 (network architecture) · MITRE ATT&CK T1039 (Data from Network Shared Drive)

## Fixed price from

[€3,800](https://mr-cyber.com/quote?service=internal)

4 test days · report in 5 business days · retest included

Services exclusively for businesses. · [What drives the price](https://mr-cyber.com/pricing)

## Frequently asked questions

How much does an internal penetration test cost?

The price depends on the number of locations, segments and hosts. The quote form shows your binding fixed price instantly (on-site work and very large networks need a short call first); for priced scopes the written offer (PDF) is sent to you by email right after your request. Prices start at €3,800.

Will the test disrupt our operations?

No. Test windows, excluded systems and test intensity are agreed upfront. Sensitive systems such as production control can be left out or only checked passively. Nothing destructive happens without your explicit approval.

Does someone need to come on site?

Usually not. The test runs remotely through a small virtual machine or VPN access you provide in your network. We send you the setup in advance. On-site testing in Germany, Austria and Switzerland is available on request, plus travel costs.

What do you need from us?

A network access point (virtual machine or VPN), a normal user account, the address ranges in scope, a list of excluded systems and a contact for emergencies.

Is Active Directory part of the internal test?

Internal tests always touch Active Directory, because most attack paths run through it. A dedicated Active Directory pentest goes deeper and reviews the whole directory configuration.