Most attacks on your network come down to two questions: what can someone reach from the outside, and how far can they get once they are in. We test both.
Everything an attacker can reach from the internet. We work through your public-facing estate from the outside in, hunting for the exposed service, weak credential or forgotten host that hands them a first foothold.
What happens once someone is inside. Starting from a foothold on your network, a plugged-in laptop, a phished user or a rogue insider, we show how far that foothold reaches towards your servers, your domain and the data that matters.
Your servers might sit in a rack you own, in a datacentre you rent, or in a cloud account you spun up last week. We test them wherever they live.
On-premises servers and network gear in your own comms room or office. We test the estate you own and manage, end to end.
Colocation or fully managed hosting. We test your kit wherever it sits, and help you line up the provider sign-off that testing needs.
AWS, Azure and Google Cloud. We test the services and identity you expose, and, where it is in scope, the account configuration an attacker abuses after getting in.
Mostly in the cloud? See our dedicated cloud penetration testing.
Segmentation is only as strong as the rules behind it. We test the boundaries you depend on from both sides, and show you where a flat network or a stale firewall rule quietly undoes them.
An infrastructure test runs in six phases, from agreeing scope to retesting the fixes. Here is what each one involves.
We agree the estate in scope, the testing window and the rules of engagement, and line up any datacentre or cloud provider authorisation before we touch anything.
We map your real attack surface: live hosts, open ports, exposed services and the software behind them, external and internal.
We find the weaknesses that matter, missing patches, weak configuration, default and reused credentials, and separate the real from the noise.
We prove impact by hand, safely exploiting what we find so you see what is genuinely at risk, not a list of maybes.
We escalate, move laterally and show how far a foothold reaches towards your domain and data, without disrupting production.
You get an executive and technical report within 48 hours, then a free retest of the critical and high findings on the external infrastructure once you have fixed them.*
The report is what you are paying for, so we write it properly. Your board gets an executive summary it can act on; your engineers get the technical detail to fix each issue.
* The free retest applies to external infrastructure, web application and API, and mobile application engagements, and covers the critical and high findings on those parts of the scope. One retest per engagement, requested within 30 days of the original test and delivered remotely, excluding on-site costs. UK-based engagements only. See our terms for full details.
Straight answers to what clients ask most about infrastructure engagements.
External testing looks at everything an attacker can reach from the internet: your public IP ranges, VPNs, mail, remote access and anything else exposed at the perimeter. Internal testing starts from a foothold inside the network, a plugged-in laptop, a phished user or a rogue insider, and shows how far an attacker can push from there towards your servers, your domain and your data. Most organisations need both, because they answer different questions.
Yes. We test infrastructure wherever it runs, including AWS, Azure and Google Cloud. That covers the services and identity you expose to the internet, and, where it is in scope, a look at the configuration and permissions inside your cloud accounts that an attacker would abuse after getting a foothold. We agree the exact boundaries with you up front so the testing stays within your provider rules.
Yes. Whether your servers sit in your own comms room, in colocation or in a fully managed datacentre, we can test them. The one thing we need is authorisation: where a third party owns or hosts the kit, they usually have to sign off the testing window and scope alongside you. We will tell you exactly what that involves and help you get it in place before anything starts.
Yes. We routinely test whether the boundaries you rely on actually hold, for example that a flat office network cannot reach a sensitive server estate, or that your cardholder data environment is properly separated for PCI DSS. We check firewall and VLAN rules from both sides, confirm what can genuinely cross the boundary, and show you where segmentation is weaker than the diagram suggests.
It depends on the size of the estate in scope, the number of live hosts and how much of it is external versus internal. A small external test can be a couple of days; a larger internal or combined engagement runs longer. We scope it with you on a free call and give you a fixed number of testing days up front, so there are no surprises on either time or cost.
At least once a year is the common baseline, and it is what most compliance frameworks and cyber insurers expect. You should also test after any significant change: a new internet-facing service, a cloud migration, a merger or a large network redesign. Between tests, managed vulnerability scanning keeps watch so new issues surface in days rather than at the next annual test.
Tell us what your estate looks like and what you are worried about. We will come back within one working day with a suggested approach and a straight, fixed-price scope.