You’re defended at the edge — but blind on the inside.
Your perimeter holds. But if one laptop gets phished, what stops the attacker from reaching everything else? You don’t actually know how far a single foothold travels.
Manual internal network penetration testing
We assume the attacker is already inside — a phished employee, a rogue insider, a compromised laptop — and prove how far they get, how fast they reach Domain Admin, and where the path breaks.
Trusted by
Sound familiar?
Domain Admin feels one misstep away.
Years of group policies, nested permissions, and service accounts have piled up. You suspect there’s a path from a normal user to full domain control — you just haven’t had anyone prove it.
What could a disgruntled employee actually reach?
A contractor, a departing engineer, an over-permissioned account. You want to know what damage someone with legitimate internal access could do — before you find out the hard way.
A phishing campaign got through.
Someone clicked, credentials leaked, and you contained it — you think. Now you need to know what that initial access could have unlocked, and whether your segmentation actually held.
The parent company wants internal testing across entities.
A group-level mandate or audit requires internal pentests across subsidiaries and shared infrastructure. You need consistent, defensible results — not five different vendors with five different bars.
You built network segments — but never tested them.
VLANs, zones, and firewall rules look right on the diagram. Whether they actually stop lateral movement is a different question, and the diagram won’t answer it.
The cost of inaction
85%
of Active Directory environments contain at least one exploitable path from a standard user account to Domain Admin.
Under 24h
is how long it typically takes to escalate from a single internal foothold to domain control on a network that’s never been tested.
1 click
is the realistic starting point. Edge defenses assume nothing gets in — internal testing assumes something already did.
What you should test
Deep manual testing of what one foothold can become — and how far it travels before something stops it.
Assumed breach (Grey-box)
We start with a standard internal foothold — a low-privilege account or a planted device — and prove the path from there to domain dominance.
Insider (authenticated)
We test from the position of a real employee or contractor, across the roles and access levels people actually hold, to map what legitimate access can be abused.
Vulnerability classes to hunt
- Privilege escalation
- Domain privilege escalation
- Kerberoasting
- AS-REP roasting
- Pass-the-hash
- Pass-the-ticket
- NTLM relay
- LLMNR / NBT-NS poisoning
- ADCS abuse
- Delegation abuse
- GPO abuse
- Weak / reused local admin passwords
- Credential dumping
- Cleartext credentials in shares
- Service account exposure
- Lateral movement
- Network segmentation bypass
- Trust relationship abuse
- DNS / SMB misconfiguration
- Insecure protocols
- Legacy authentication
- Unconstrained delegation
- Shadow admin paths
- Misconfigured ACLs
- Sensitive data on internal shares
- Internal application flaws
- Hypervisor / management plane exposure
- Backup system abuse
- Domain trust escalation
Attack surface to cover
- Active Directory
- Domain controllers
- Member servers
- Workstations
- Service accounts
- Privileged accounts
- Group Policy
- Trust relationships
- File shares
- Internal web applications
- Internal APIs
- Databases
- Network segments / VLANs
- Firewall & segmentation rules
- Hypervisors & virtualization
- Backup infrastructure
- Network devices
- Print & management services
- Internal DNS
- Certificate services (ADCS)
- Jump hosts
- Workstation builds
- Shared credentials
- Crown-jewel systems
What manual actually means
Most security work stops at finding a vulnerability. We treat that as the starting point.
Not sure how far one foothold would get inside your network? Let’s find out.
A senior pentester (not a sales rep) will get back to you with an honest read on what would actually be worth testing.
Case studies
From real engagements
A few engagements that show what working with us looks like — at scale, over years, across industries.
Manufacturing · FMCG
Multiple penetration testing engagements for a global food & beverage company in 120+ markets.
Blackbox and Greybox testing across multiple IT services — guaranteeing high protection for consumers, employees, contractors and shareholders while satisfying group-level compliance controls.
Read case study
B2B SaaS · LMS
Comprehensive web application pentest backing ISO 27001 certification for a corporate LMS platform.
Blackbox & Graybox testing aligned with OWASP — followed by remediation re-test and a final report that validated security posture for the ISO 27001 audit.
Read case studyWhat you'll receive
Five deliverables — built for the people who'll actually use them: your engineers, your C-level, your auditors, and your insurers.
Want to see what these actually look like?
Real structure, real findings, real format. The same documents your team and your auditors will see.
Interim Urgent Report
When we find Critical, you find out today.
If we discover a Critical-severity vulnerability mid-engagement that needs immediate attention, you get an alert with reproduction steps and recommended actions. We keep testing, you start remediating in parallel. No waiting until the final report.
For
Your engineering team, your CTO
Technical Report
Prioritized findings your engineers can act on the same day.
Every vulnerability with reproduction steps, proof-of-concept exploitation, business impact, and a prioritized remediation roadmap. No false-positives. No filler. Built so your developers know exactly what to fix and in what order.
For
Your engineers, your CTO, your security team
Executive Summary
What the board and investors actually need to know.
A business-language report covering the security posture of your perimeter, the risks identified, their potential business impact, and the path to remediation. Written for CEOs, boards, investors, and Enterprise procurement teams — not engineers.
For
Your CEO, your board, investors, M&A counterparties, and your customers
Retest Report
Verified evidence that the fixes actually work.
After your team remediates the findings, we re-test each one and confirm the fixes hold under the same exploitation attempts. The updated report is your proof that the vulnerabilities are actually closed — not just patched on paper.
For
Your auditors, your Enterprise customers
Security Certificate
A public-facing artifact you can share with customers and prospects.
After remediation and retest, we issue an official certificate confirming your external perimeter passed deep manual penetration testing. Use it on your website, in security questionnaires, in Enterprise sales conversations — the artifact your prospects and procurement teams want to see.
For
Your sales team, your marketing, your Enterprise prospects
How we deliver on your goals
Industry-standard methodologies, executed by senior engineers.
Standards
Methodologies we follow
- OWASP
- PTES
- NIST SP 800-115
- MITRE ATT&CK
Compliance pentest requirements we satisfy
- SOC 2
- ISO 27001
- GDPR
- HIPAA
- PCI DSS
The principles behind it
Manual hacking
Scanners run only as a baseline. Every finding is hand-built and verified by a senior engineer — exploited and chained manually, with your perimeter's context in mind.
Cyclical, not linear
Each finding feeds the next. New access reveals new attack surface. We loop back, dig deeper, and chain — until we reach the deepest impact your architecture allows.
Business impact, not a bug list
A list of CVEs doesn't tell you what an attacker would actually do to your business. We translate every finding into a real-world scenario — what gets compromised, who loses what, and how the chain unfolds.
Senior engineers only
No juniors learning on your environment, no outsourced backfill, no swapping engineers mid-engagement. Every engagement is run by senior offensive engineers with deep external infrastructure and adversary-simulation experience.
Quality over speed
We're not a conveyor optimizing for throughput. We take fewer engagements at a time and go deep on each — that's the trade-off.
Do no harm
All testing happens under signed Rules of Engagement. High-risk actions on production are coordinated with you in advance. Critical findings trigger an immediate alert — no surprises, no broken environments.
Actionable findings, zero false-positives
Every finding is verified, prioritized, and documented with reproduction steps and remediation guidance. Your engineers know exactly what to fix first — and they don't waste a day on noise.
Engineer-to-engineer communication
Direct access to our engineers throughout the engagement. No sales translators, no project managers gatekeeping technical detail.
Hacking as a craft
We hire engineers who hack on their own time — for research, for CTFs, for the love of the craft. Our team treats every engagement as a challenge to solve, not a ticket to close.
From your first message to your final certificate
A structured engagement built around your team — with senior engineers, direct communication, and zero surprises.
-
First conversation
What happens- You reach out — by call, form, or email, whichever you prefer
- A senior engineer (not a sales rep) gets back to you
- We define your goals and scope of the engagement together
- We give you an honest read on whether we're the right fit, and what would actually be worth testing
You receive A clear answer on direction — and whether we're a match — before anything is signed. -
Scoping & proposal
What happens- A technical session with your team to understand your perimeter, your asset inventory, and your high-value targets
- We walk you through a sample report so you know exactly what the deliverables look like
- You get a detailed proposal: scope, approach, timeline, price
You receive A full proposal and a sample report you can review with your CTO, CISO, CEO, and procurement before deciding. -
Kick-off
What happens- Contract and NDA signed
- Rules of Engagement signed — clear boundaries on what we test, when, and how
- Access provisioning and documentation handoff
- A senior engineering team is assigned to your engagement and briefed
You receive Signed engagement contract, Rules of Engagement document, kickoff meeting summary. -
Reconnaissance & threat modeling
What happens- Passive intelligence gathering on your public surface
- Perimeter mapping — what is exposed, where the highest-risk surfaces are, and what was forgotten
- Threat model: what's worth attacking, and how an external adversary would actually approach your perimeter
- A direct engineer-to-engineer communication channel is set up for the duration of the engagement
You receive Anything urgent that surfaces during this stage is flagged to you immediately. Otherwise, this stage feeds directly into the testing that follows. -
Active exploitation
What happens- Manual hacking, vulnerability discovery, exploitation
- Attack chain construction across multiple findings
- Impact assessment for every finding before any aggressive exploitation on live systems
- Continuous loop: each new access reveals new attack surface, and we go deeper
You receive If we find a critical attack path that is easy to exploit and demands immediate action, you get an Interim Urgent Report — an alert with reproduction steps and recommended response. We keep testing, you start remediating in parallel. -
Primary report delivery
What happens- Findings consolidated, verified, and documented
- Technical Report and Executive Summary written
- Remediation roadmap prioritized
You receive A Technical Report (for your engineers) and an Executive Summary (for your board, Enterprise customers, and auditors). -
Debrief call
What happens- Walkthrough of findings with your engineering team
- Walkthrough of business impact with your leadership
- Q&A on remediation priorities — what to fix first and why
You receive A prioritized remediation roadmap and direct answers to your team's questions. -
Remediation support
What happens- Support for your developers throughout the fix cycle
- Clarification on attack vectors and remediation approaches
- Pace depends on your team — we don't push and we don't drag
You receive Technical guidance throughout remediation, scoped to your engagement. -
Retest & final certificate
What happens- Each remediated finding is re-tested against the original exploitation
- Verification that the fix holds — not just patched on paper
- Updated reports and security certificate issued
You receive A Retest Report, an updated Technical Report, and your Security Certificate.
Recognized by the industry
Top-rated on industry platforms
Our engineers hold certifications including
In their own words
XRAY CyberSecurity delivered a comprehensive, well-structured report with practical recommendations tailored to strengthening our application security. We received two reports — a detailed Technical and a separate Executive — which allowed us to quickly present results to leadership and build an action plan. Their readiness to communicate directly with our vendors significantly accelerated remediation.
XRAY CyberSecurity provided penetration testing for our products built on different technologies. We were able to discover vulnerabilities, fix them, and receive confirmation through retesting that they were mitigated. Communicating with their team felt more like working with coworkers than an external vendor — they were professional, knowledgeable, and gave us valuable advice.
XRAY CyberSecurity conducted gray-box penetration testing following OWASP methodologies. Their thorough manual analysis identified vulnerabilities worth attention, and their detailed technical and executive reports — followed by a retest validating our remediation — allowed us to proceed with ISO 27001 certification.
XRAY CyberSecurity conducted thorough assessments across our web applications and cloud environments, simulating real-world attack scenarios. Their detailed reports provided clear, actionable insights that significantly improved our security posture, and their ability to communicate complex findings in an understandable way was invaluable to our team.
The work was done quickly and professionally. XRAY CyberSecurity's specialists highlighted our vulnerable points, enabling us to improve our software quality. We received a report with detailed penetration scenarios and both technical and organizational recommendations for remediation and prevention.
5/5 on Clutch
read all reviews
Ready to test from the inside?
Frequently asked questions
What’s the difference between this and an external pentest?
External tests whether an attacker can get in; internal tests what happens once they’re already inside. We assume the perimeter has been bypassed — by phishing, a malicious insider, or a compromised device — and measure the blast radius from that foothold.
How do we provide the starting foothold?
Usually a standard low-privilege domain account and either a device on your network or a connection we use to simulate a compromised host. We agree the exact starting position in the kickoff — it should mirror a realistic breach, not a privileged shortcut.
Will testing impact our production network?
Testing runs under signed Rules of Engagement. We avoid disruptive techniques by default, and any action that could affect availability — restarts, aggressive relaying, anything touching critical systems — is coordinated and approved before we run it.
Will this set off our EDR / SOC?
That’s often part of the value. You can have us run quietly to test detection and response, or coordinate with your SOC so testing doesn’t trigger a real incident. We discuss which you want to measure before we start.
How do you handle confidentiality, our data, and legal accountability?
Signed NDA and a contract with full corporate liability. Anything accessed during testing — including sensitive data found on internal shares — is stored encrypted, restricted to the assigned engineers, and deleted after the engagement per your contract. We carry professional indemnity insurance.
Do we need to give you Domain Admin to test Active Directory?
No — that would defeat the point. We escalate to privilege ourselves, the way an attacker would, starting from a normal user. If you want a faster, deeper review of specific configurations, we can also run a targeted authenticated pass, but the core test earns its access.
How much effort does this require from our team?
Setup is concentrated up front — provisioning the foothold and a kickoff on your environment. After that, mostly occasional clarifying questions. The larger investment is your team’s remediation time afterward, which we support with direct guidance.
What if you reach Domain Admin on day one?
Then we’ve done you a favor early — and we keep going. We document the full path, then continue mapping every other route in, what data is reachable, and where segmentation does or doesn’t hold, so remediation fixes the class of problem, not just one path.
Are there hidden fees? Is retesting included?
The proposal price is fixed and written into the contract against agreed scope. Retesting after remediation is included, with an updated Technical Report and Security Certificate. The only thing that moves the price is you expanding scope, agreed in writing before any work begins.