What Does Network Penetration Testing Involve?
Key takeaways
- Written authorisation naming the scope, the window and the emergency contact is a precondition, and a testing engagement without it can be treated as a criminal offence under the IT Act.
- External testing finds what an internet attacker can reach; internal testing finds what a single compromised laptop or an employee badge can reach.
- The report is ranked by business impact rather than by scanner severity, because a critical scanner finding on an unused host matters less than a medium finding on the payment server.
- Retest is normally a separate short engagement, and it is the only reliable way to show that a finding is actually closed.
- A good network penetration test deliverable is evidence a board can read: what an attacker could reach, what it was worth, and what to do first.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is the difference between internal and external network testing?
They simulate two very different attackers. External testing starts from the internet and asks what is exposed: your public IP ranges, remote access gateways, web applications, mail and DNS servers, and any cloud storage left open. It answers the question a scanner would ask about you. Internal testing starts from a foothold inside the network, on a domain-joined laptop or a test access point, and asks what that position is worth: can it reach the finance server, harvest credentials, move sideways. For most Indian businesses the internal test reveals more, because the perimeter has been hardened for years while the internal network still trusts any valid credential.
How is a network penetration test actually carried out?
In phases, and each phase has a defined entry and exit condition. Scoping and authorisation come first, covering the exact IP ranges and domains, the testing window including night hours, the allowed techniques, the rules of engagement and the escalation contact. Passive and active reconnaissance follows, mapping the attack surface from public data. Scanning and vulnerability validation come next, filtering out noise manually. Then controlled exploitation to prove impact on confirmed issues, with no destructive action without written approval. Privilege escalation and lateral movement attempts establish how far a single foothold goes. A short validation phase confirms the findings. Throughout, the tester produces evidence, and the report and retest close the engagement.
What should I get from the engagement at the end?
Four things, and ask for all four before the work starts. A findings report with each issue rated by business impact, a clear description, exact reproduction steps, the evidence collected, and specific remediation with an owner and target date. A technical appendix with raw scan output, tool versions and the complete test log. A management summary a non-technical director can read in ten minutes, explaining what an attacker could reach and what it was worth in risk terms. And a retest scoped to this round's findings, which converts a report into a closed item. Ask for the report in a format your team can track, not only a PDF.
| Phase | What happens | Output |
|---|---|---|
| Scope and authorisation | Targets, window, methods, escalation contact agreed in writing | Signed authorisation and scope annexure |
| Reconnaissance | Attack surface mapped from public data and DNS | Attack surface map and asset list |
| Scanning and validation | Findings filtered and confirmed by hand | Validated vulnerability list |
| Exploitation | Impact proven on confirmed issues, no destructive action | Proof-of-concept evidence |
| Privilege escalation and lateral movement | Reach from a single foothold assessed | Attack path diagram |
| Reporting and retest | Findings ranked by business impact, then re-tested | Ranked report, management summary, retest result |
What are the frequently asked questions?
Get a straight answer on this
Send us your public IP ranges and your internal subnet plan, and we will return a scoped network penetration testing proposal with a fixed price.
Send us the details See pricing