Internal and Active Directory Penetration Test
How far an attacker gets after one laptop or account is compromised, and what they reach on the way.
Book a Scoping CallA phished laptop, a rogue device or a contractor gone bad. We start with no credentials and see how far we can get, then repeat as a standard user. You get a prioritised fix list your IT team or provider can act on, and a summary your customers, insurer or auditor will accept.
Who it is for
- Organisations asked to evidence internal or Active Directory testing for a customer, insurer or supply-chain requirement.
- Businesses that want to know how far an attacker gets after one laptop or account is compromised.
- IT managers and managed service providers who want an independent check of a network they run.
Scope bands
Fixed scope, fixed fee. Answer four questions, receive a fixed-fee quote, and nothing changes once work starts. Larger or more complex requirements are scoped as a Bespoke engagement, still at a fixed fee agreed before work begins.
| Question | Focused | Core | Extended |
|---|---|---|---|
| How many staff and devices are on the network? (a rough number is fine) | Up to 100 | Up to 300 | Up to 750 |
| How many sites are in scope? | 1 | Up to 2 | Up to 4 |
| How is Active Directory run? | None, or cloud only | One on-prem domain | Multiple domains or forests |
| How many internal server systems are in scope? (line-of-business apps, databases, file or ERP servers) | Up to 5 | Up to 15 | Up to 30 |
Staff and devices
- Focused
- Up to 100
- Core
- Up to 300
- Extended
- Up to 750
Sites
- Focused
- 1
- Core
- Up to 2
- Extended
- Up to 4
Active Directory
- Focused
- None, or cloud only
- Core
- One on-prem domain
- Extended
- Multiple domains or forests
Internal server systems
- Focused
- Up to 5
- Core
- Up to 15
- Extended
- Up to 30
Your highest answer sets the band. One answer in Extended places the engagement in Extended, whatever the other three are.
Bespoke
Larger or multi-forest estates.
Included with every Enhanced package
- Full technical report: every finding with severity, business impact, evidence and remediation guidance.
- Letter of attestation: a forwardable summary for the customer, insurer, investor or auditor who asked for the test.
- 60-minute debrief for technical and business stakeholders.
- One retest within 30 days, with a retest report.
- Immediate escalation of any critical issue found during testing, not held until the report.
- Independent quality review of every report by a second senior practitioner before issue.
Also included with this package
- Attack path walkthroughs from a starting foothold to domain control or sensitive data.
- Active Directory review: the misconfigurations that let attackers escalate, mapped so you can see the routes.
- Prioritised remediation plan.
How it works
- 01Answer the four scoping questions.
- 02Receive a fixed-fee quote.
- 03Sign authorisation and set up access (some packages include an access guide).
- 04We test, issue the report within five business days, run the debrief and complete the retest.
Good to know
On-site or remote, customer’s choice. For remote testing we ship a preconfigured device or a virtual machine you deploy.
Testing uses non-destructive techniques and every finding is manually verified.
Exploitability, not a scanner dump
- Every finding is reproduced by hand before it reaches the report. Anything a tester cannot reproduce is discarded rather than passed on with a caveat.
- Findings are rated by what an attacker could actually do with them in your environment, not by the raw score a tool assigned.
- Where a route exists from a starting foothold to something that matters, we show the route rather than listing the steps as separate findings.
- Every report is independently quality reviewed by a second senior practitioner before it is issued.
Who tests
Testing is led by a UK Cyber Security Council Principal practitioner (Security Testing) holding CREST CRT, OSCP, OSEP and CyberScheme Team Leader. Every report is independently quality reviewed by a second senior practitioner before issue. Our founders bring over ten years each in UK defence and critical national infrastructure. Tarian Labs is Cyber Essentials certified and based in South Wales.
Fixed scope, fixed fee, agreed before work starts.
A short call with a practitioner is enough to size this accurately.
Book a Scoping Call