NexusSec.External vs internal testing
External network testing
We test what the internet can see: your firewall, VPN gateways, mail servers, published applications and any service you may not realise is exposed. In practice we frequently find forgotten management interfaces, legacy VPN appliances and services opened temporarily during a project and never closed.
Internal network testing
We simulate an attacker who already has a foothold — a phished laptop, a compromised contractor account, or someone plugged into a meeting-room port. This is where most organisations discover uncomfortable truths, because internal networks are often far flatter than assumed. See network segmentation.
What we test
| Area | What we examine |
|---|---|
| Perimeter | Firewall rule exposure, published services, VPN configuration, remote access |
| Active Directory | Privilege escalation paths, Kerberos weaknesses, delegation, credential exposure, password policy |
| Servers | Patch level, default and weak credentials, insecure services, hardening gaps |
| Network devices | Switch and router configuration, management-plane exposure, SNMP, legacy protocols |
| Segmentation | Whether zones genuinely enforce policy, or route freely to one another |
| Lateral movement | How far a single compromised host can reach — the finding that matters most |
Our approach
- Scoping and authorisation — targets, boundaries, timing and rules of engagement agreed in writing. We do not begin without documented authorisation.
- Reconnaissance — mapping what is genuinely reachable, which often differs from the documented estate.
- Assessment — automated discovery for breadth across the agreed scope.
- Manual exploitation — validating which findings are actually exploitable, and discarding false positives.
- Post-exploitation — establishing realistic blast radius without disrupting operations.
- Reporting — executive summary plus reproducible technical detail, prioritised by business risk.
- Retest — verifying your fixes actually closed the issues.
What we commonly find
- Flat internal networks where any workstation can reach servers, backups and management interfaces.
- Over-permissive firewall rules added during troubleshooting and never reviewed — see our firewall audit service.
- Active Directory misconfigurations providing a path from a standard user to domain admin.
- Legacy protocols such as LLMNR and NBT-NS enabled, allowing credential capture.
- Service accounts with weak passwords and excessive privilege.
- Backup systems reachable from user networks — the single most damaging finding, because it removes your recovery option.
Will it disrupt operations?
A professional engagement is designed not to. Testing windows, excluded systems and prohibited techniques are agreed during scoping, denial-of-service testing is excluded unless explicitly requested, and fragile legacy systems are handled with care or tested outside business hours. We would rather agree a constraint in advance than cause an outage.
How often
At least annually, and again after significant change — a network redesign, an office move, a merger, a major infrastructure upgrade, or migration of key services. Between engagements, continuous vulnerability scanning catches newly disclosed issues and configuration drift.