How is internal network access obtained for the test?

One of two ways: through an access point provided by the client, simulating an already-compromised machine, or from scratch starting at the external surface. The second measures the full chain; the first, the internal impact.

What is lateral movement and why does it matter?

It is the path from one compromised machine to the rest of the network: reused credentials, accessible shares, system trusts. It matters because it decides whether an incident is one reformatted machine or a stopped company.

Does the internal test break production?

It should not. Intrusive actions pass a human gate with written windows and forbidden targets. What breaks production uncontrolled is an unauthorized exploit — exactly what the ROE exists to prevent.

← Learn

Surface

Internal infrastructure pentesting

How the internal network gets tested: lateral movement, domain escalation, and what it means that one compromised endpoint does not become the whole network.

Rekon — hybrid offensive security · 2026-09-17

The internal test answers the question nobody wants to ask out loud: if an attacker is already inside, what do they win? The right answer is “not much”. The frequent answer, in real networks, is “everything”: reused credentials, an unsegmented domain, and backups reachable by the same user who opened the phishing email.

The typical chain the test looks for

A low-privilege foothold. Credentials in memory or on shares. A path to the domain: misconfigured delegation, abusable GPOs, crackable SPN service accounts. Escalation to domain admin. And from there, the business question: can the attacker wipe the backups? Can they touch the entire Active Directory? Every step gets documented as an attack path with its PoC.

What a well-made internal test delivers

A map of where the attack stops. Segmentation that works and segmentation that is decorative. Credentials that travel and credentials contained. And a remediation priority ordered by path, not by host: closing the path beats patching twenty loose machines. The natural complement is cloud and identity — today the “inside” also lives outside. To start: #contacto.

Straight answers

How is internal network access obtained for the test?: One of two ways: through an access point provided by the client, simulating an already-compromised machine, or from scratch starting at the external surface. The second measures the full chain; the first, the internal impact.
What is lateral movement and why does it matter?: It is the path from one compromised machine to the rest of the network: reused credentials, accessible shares, system trusts. It matters because it decides whether an incident is one reformatted machine or a stopped company.
Does the internal test break production?: It should not. Intrusive actions pass a human gate with written windows and forbidden targets. What breaks production uncontrolled is an unauthorized exploit — exactly what the ROE exists to prevent.

Time to test your doors?

Tell us what needs validating. We answer with proposed scope, not a brochure.

Talk to Rekon More in Learn