Internal penetration testing
An internal penetration test begins where most reports end: the attacker is already inside. A phished user, a contractor laptop, a device someone plugged in. From that position it measures what happens next — which Active Directory paths lead to domain control, whether segmentation actually holds, how large the blast radius is, and what your detection saw while all of it was going on.
For teams who already accept that prevention will fail once
Security teams who have invested heavily in perimeter and endpoint controls and have never measured what a single successful phish is actually worth.
Organizations running Active Directory with delegation, service accounts and trusts accumulated across years of mergers and migrations.
Detection and response teams who want a real adversary to grade their telemetry instead of a tabletop exercise.
Same building, three very different questions
Internal testing gets confused with both of its neighbours, and the confusion is expensive. An external test asks what a stranger can reach. A red team asks whether a determined adversary can achieve an objective without being noticed. An internal test grants the starting position deliberately and spends the whole engagement on the part that comes after, which is where trust relationships, segmentation and directory design get graded.
A red team is a valid and different exercise, and it is a poor substitute for internal testing: it optimizes for one path taken quietly, not for a map of every path that exists.
The Active Directory paths that keep working
Beyond the directory: segmentation, blast radius and what you saw
Frequently asked questions
What does assume-breach mean in practice?
It means the engagement does not spend its budget proving that someone can get in, because that is already the industry's working assumption. The tester is given a realistic starting position — a standard user account, or access to a workstation treated as compromised — and the entire engagement is spent on what happens after that. It is the most efficient way to learn what one successful phishing email is worth.
How is internal testing different from external testing?
External testing measures exposure: what a stranger can reach and break with no access. Internal testing measures consequence: given access, how far it goes. They surface different failures. External work tends to find inventory and exposure problems; internal work tends to find trust, segmentation and directory problems, and those are usually the ones that decide how bad a real incident becomes.
What starting access should we provide?
A standard, non-privileged domain user account is the most useful default, because it reproduces the position of a phished employee exactly. Adding a second account at a different privilege level lets the tester verify separation between roles. Some teams start fully unauthenticated on the network first, which is realistic for a rogue device scenario and typically produces credentials within the engagement anyway.
Should we tell the security operations team?
For an internal penetration test, yes. Coverage is the goal, so an uninformed SOC spends the engagement responding to the tester instead of letting the estate be mapped. Tell them the window and the tester's source addresses, and separately record what their tooling detected. If you specifically want to test whether they catch an adversary, that is a red team, and it is a different purchase.
What should the report contain?
Each attack path from starting position to final privilege, with evidence at each step and the earliest point where one change breaks the chain. Then blast radius per starting position, an explicit segmentation result, and the detection observations. A list of individually rated findings without the paths that connect them is the most common weakness in internal reports, because it hides the fact that three mediums are one critical.
How often should internal testing happen?
The compliance floor is annual, and directories drift faster than that: a new service account, a delegation added for one project, a template published to make an application work. Each of those can reopen a path that was closed last year. Retesting after remediation is the minimum, and testing that runs continuously against the internal estate is how the drift stops accumulating unnoticed.
ALWAYS-ON PLATFORM
More than a test. A strategic layer for real security.
Our AI is powered by a proprietary data layer built from thousands of hours of pentesting and real-world validations. Strike combines autonomous execution and expert human validation to uncover complex risks, reduce noise, and prioritize actionable findings.
In-depth continuous testing
Strikers uncover high-impact vulnerabilities across multi-technology environments (web apps, APIs, mobile, cloud, and more).
AI-led retesting on-demand
Validate fixes instantly, without waiting for the next testing cycle.
Real-time fixing
AI agents guide your team step-by-step through remediation to accelerate resolution.
Step-by-step Threat emulation creation
Easily scope, launch, and track your Threat emulation with full transparency.
Human triaging & peer review
Every finding is validated by security experts to ensure accuracy and impact.
Full visibility
Track every finding with complete transparency through security expert work logs and real-time notifications.
Seamless integrations
Connect directly with Slack, Teams and Jira to streamline collaboration with your security and development teams.
Vulnerability Manager
Visualize, manage, and retest vulnerabilities in one platform, with full context on severity, sources, and remediation.
Compliance-ready reporting
Automatically generate up-to-date reports aligned with PCI DSS, HIPAA, ISO 27001, SOC 2, and more.
Ongoing partnership
Weekly check-ins with a dedicated Customer Success Manager, plus personalized onboarding and strategic planning.
More than an offensive security platform, Strike operates as a continuous validation layer for environments that never stop changing.
Trusted by security teams that lead
Human expertise.
AI power.
Superior security.
Whether you’re scaling fast, closing enterprise deals, or just tired of noisy reports, we’ll help you build a security stack that moves faster than your threats.
