An internal pentest does not ask whether someone can get in. It assumes they already are, and measures how far they get, how fast, and what stops them. Here is the sequence, the evidence, and the limits.
An internal network penetration test starts inside, from a position an attacker would realistically hold once something has already gone wrong: a laptop with malware on it, a contractor’s device on the wrong VLAN, credentials bought from a broker. The premise is assumed breach. They are in, and the only questions are how far, how fast, and what stops them.
Getting in has become the cheap part. In the 2026 Verizon Data Breach Investigations Report, exploitation of vulnerabilities is now the most common initial access vector for breaches, at 31% against 20% the year before, and ransomware was present in 48% of all breaches. Only 26% of vulnerabilities in CISA’s Known Exploited Vulnerabilities catalogue were fully remediated in 2025, down from 38%, and the median time to close one rose from 32 days to 43.
That exposure does not stop at the perimeter. Of the ten most common cybersecurity misconfigurations NSA and CISA report from their red and blue team assessments, four describe the inside of the network rather than its edge: insufficient internal network monitoring, lack of network segmentation, poor credential hygiene, and improper separation of user and administrator privilege. An external test sees none of them.
What follows is the sequence of an internal network penetration test, in order.
Everything begins with a written agreement about where the test starts. Three starting points cover most engagements, and the choice changes the test:
The rules of engagement then fix everything the test is not allowed to improvise. NIST puts that in the planning phase and is blunt about the order: no actual testing occurs in that phase.
Ranges and domains in scope. Systems nobody touches: life-safety equipment, industrial control, the legacy host that falls over when scanned. Test windows. Whether your security team is told. Whether the endpoint agent stays enabled. And the stop conditions that end the test in five minutes.
Whether a test starts on Monday morning or Wednesday afternoon is logistics, not security:
With the foothold agreed, the first job is an accurate picture of what the network trusts. Host discovery and service enumeration across the ranges in scope. File shares, and what can be read without credentials. Printers, hypervisors and management interfaces still answering to their defaults. Then, once a domain account is in play, the directory itself: users, groups, group policy, service accounts, delegation and trusts.
The output is a graph, not a list. Which account can log into which machine, which of those machines a privileged account used recently, and which chains of individually reasonable permissions end somewhere that matters. That graph is the difference between "you have 400 vulnerabilities" and "these three permissions, in this order, reach your finance database". Ranking routes by what they reach is also how you learn where network segmentation actually stops a route.
This phase belongs to an internal test and to no other kind: it looks at the identity fabric every application on the estate defers to, and on Windows that means Active Directory.
None of it is improvised. MITRE ATT&CK’s Credential Access tactic lists 17 techniques and Lateral Movement lists nine. The handful that decide most internal engagements:
The preview is public: ASD’s ACSC, with CISA, NSA and partners, published Detecting and Mitigating Active Directory Compromises in September 2024, covering the 17 most common techniques used to compromise Active Directory and the mitigation for each.
Nothing is a finding until it is verified. NIST SP 800-115 draws the line plainly: a vulnerability scanner checks only for the possible existence of a vulnerability, while the attack phase of a penetration test exploits it to confirm that it exists.
Success feeds backwards: new credentials mean new access, which redraws the map and sends us back into reconnaissance. NIST draws that as a loop between the attack and discovery phases.
Privilege escalation is pursued to the level the rules allow: local administrator, then a route towards domain-wide control if the scope says so. Where full domain compromise is authorised it is proven once, through a controlled action agreed in advance, and then the chasing stops. Nothing is encrypted, nothing is deleted, no production data leaves your network, and every noisy action is timestamped so your defenders can see what they caught and what they missed.
Deliverables, in the order people actually read them:
A finding reads like this:
ID INT-004
Title Domain credentials captured and relayed to a file server
Severity High · Assets [file server], [print server], 2 subnets
Impact Local administrator on 2 servers; route to backup console
Fix Enforce message signing; disable legacy name resolution
Retest Same route re-run, closed against the same evidenceFixes are verified, never assumed. A retest re-runs the specific route behind every finding you say is fixed, and closes it against the same standard of evidence that opened it. It is the only defensible answer to whether the remediation budget worked.
Some findings cannot be closed with a patch. Segmentation, privilege design and service account sprawl are projects, not tickets. Those get a plan and a date instead of a green tick, and the report says so.
Any consultancy quoting a duration before seeing the estate is guessing. As a planning range, a single-site test against one domain typically needs one to two weeks of testing, with reporting after that and a retest later that costs a fraction of the original. What moves the number:
Two documents give the engagement its shape. The Penetration Testing Execution Standard defines seven sections: Pre-engagement Interactions, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, Post Exploitation and Reporting. NIST SP 800-115 describes four phases of penetration testing, planning, discovery, attack and reporting, with reporting running simultaneously with the other three rather than bolted on at the end. MITRE ATT&CK supplies the vocabulary, so a finding reaches your detection team named the way their tooling names it.
What does not apply matters just as much. The OWASP Web Security Testing Guide, the OWASP API Security Top 10 and MASVS are the right references for web, API and mobile testing. They are not the references for an internal network test.
The most useful paragraph in any introductory meeting is the one about limits.
If this is the exercise your estate needs, here is how we run an internal network pentest.
Sources
The real sequence of an external network penetration test: scope and rules of engagement, reconnaissance, perimeter analysis, exploitation, reporting and retest, plus what the test will not cover.
The seven phases of a web application penetration test, what has to be ready before day one, how long it runs, what lands in your inbox at the end, and the things it deliberately does not cover.
The real sequence of an iOS or Android engagement: what gets agreed before day one, what happens on a device we control, what reaches your backend, what you receive, and the six things this test deliberately does not cover.
If any of this looks like a problem you are carrying, half an hour on a call scoping it with a senior pentester is worth more than reading another article.
Hablar con un pentester seniorPick a time that suits you. You tell us what you need and where you are, and we explain how we work and how we can help.
