Network and infrastructure assessment
What is exposed to the internet and the office network, and what an attacker could reach from there.
An infrastructure assessment answers two questions: what can someone on the internet reach, and what could they do with one foothold inside. We start from the inventory you give us, compare it with what is actually answering on the network, and report the gap as well as the vulnerabilities.
What we test
- External exposure: open ports, admin panels, databases and remote desktop reachable from the internet
- Remote access: VPN, SSH and RDP configuration, password login and multi-factor coverage
- DNS and email: records, subdomain takeover risk, SPF, DKIM and DMARC
- Patch levels of exposed services against published CVEs
- Internal network (on site or over VPN): segmentation, shared credentials, legacy protocols
- Firewall and router rules reviewed against what the business actually needs open
What do you get at the end?
- An asset list of what we found answering, next to what you told us exists
- Findings with severity, host and port, evidence and the fix
- A retest of fixed items
How does the engagement run?
Scope and written authorization first, then testing inside the agreed window, the report, and a retest of what you fix. The steps are the same for every service and are set out on the approach page.
Frequently asked questions
Do you run load or denial-of-service tests?
Not against production. Scanning is rate limited and agreed in advance. If you need resilience testing, we scope it separately against an isolated environment.
What is the difference between external and internal testing?
External testing starts from the internet with no access, the way an outside attacker would. Internal testing starts from a foothold on your network, on site or over VPN, and shows how far someone could move from one compromised laptop or account. You can scope either or both.
Do we need to give you a list of our systems?
Yes: the domains, IP ranges and key hosts in scope. We test only what is in the signed scope. Part of the report compares that list with what we found answering, because a forgotten server is a common way in.
Tell us what you want tested.
A short call, then a signed scope. No testing before that.