Network and Active Directory penetration testing
A network penetration test attacks your perimeter from the internet and, in an assumed-breach test, your internal network from the position of one compromised laptop. In most enterprises the decisive weakness is Active Directory: ITovio maps and proves the path from an ordinary account to domain administrator, and what that path gives an attacker.
Enterprise only. Cyber security is the one service ITovio offers at enterprise level: established companies and enterprises with production systems worth attacking properly. We do not sell low-budget scans or small-business security packages.
- Enterprises with on-premises or hybrid Active Directory and Microsoft Entra ID.
- Organisations with VPN gateways, firewalls and remote-access appliances on the internet.
- Companies that want to know what ransomware operators could do after one phishing click.
- Groups integrating an acquired company's network.
Definitive results, not maybes
Proven, not suspected
Every finding in the report is exploited by hand and shipped with a working proof of concept, reproduction steps and evidence. No unverified scanner output, no "potential" issues padding the page count.
Ranked by business impact
Severity is scored with CVSS and then argued in plain language: what an attacker reaches, which data, which customers, what it would cost you.
Closed means closed
After you fix, we attack the same issue again. The retest report states, per finding, whether it is closed, partly closed or still open.
A clean result is still a result
If a target holds, the report says exactly what was attacked, how and for how long, so "nothing exploitable found" is evidence you can hand to a customer, auditor or board.
What we test
| Phase | What we do |
|---|---|
| External perimeter | Discovery of everything you expose, then testing of VPN, firewall and remote-access appliances, mail, DNS, exposed management interfaces and forgotten hosts |
| Edge devices | Known exploited vulnerabilities in the appliances you run, checked against public advisories and the CISA Known Exploited Vulnerabilities catalogue, plus configuration and credential weaknesses |
| Assumed breach | A standard user account and a corporate device as the starting point, as if one employee had been phished |
| Active Directory | Kerberoasting and AS-REP roasting, delegation abuse, ACL attack paths, certificate services (AD CS) template abuse, legacy protocols, password reuse |
| Lateral movement | Credential exposure on hosts and shares, local admin reuse, remote management paths, segmentation between office, servers and production |
| Hybrid identity | Sync servers, Entra ID connect paths, privileged cloud roles reachable from on premises and the reverse |
| Impact | Demonstrated, safely: what domain admin or a key server gives access to, stopped at the agreed limit |
Why assumed breach
Perimeters get breached through phishing, stolen credentials and vulnerable appliances. Testing only the outside tells you how hard the door is, not what happens once someone is in. An assumed-breach test starts inside and answers the question boards actually ask: how bad would it be.
Every attack path is reported as a chain, with the single changes that would break it. Breaking one link early is often worth more than fixing twenty isolated findings.
Asked before most engagements
Is the internal test done on site?
Will you crack our passwords?
Do you use real malware?
Does this include phishing?
Reviewed by the ITovio security team on 3 November 2026.
Related
Red team and objective-based attack simulation
Read itServiceCloud penetration testing for AWS, Azure and Google Cloud
Read itGuideWhat attackers exploit in 2026, and what we test for
Read itGuideHow to scope a penetration test
Read itAll specialist testing: Web application testing, API testing, Cloud testing, Mobile app testing, AI and LLM testing, Red team and attack simulation.
Find out what an attacker would find first.
A 30-minute scoping call, then a written scope with targets, depth, windows and deliverables before you commit. Enterprise engagements only.
