A mid-sized logistics company had invested sensibly in perimeter security — firewalls, endpoint protection, the usual stack — and wanted to know whether any of it would actually stop a determined attacker. The board's question was refreshingly honest: not 'are we compliant?' but 'if someone got in, how far would they get?' The engagement was scoped as an internal network penetration test across 15 targets spanning the company's segmented VLANs, including the corporate domain, warehouse systems and a legacy application server nobody had patched in years.
The rules of engagement assumed breach: we started from the position of an attacker with a foothold on a standard employee workstation — the realistic outcome of one successful phishing email. The objectives were explicit: attempt lateral movement across segments, escalate privileges within Active Directory, and determine whether an attacker could reach the systems that run the warehouse and the finance department. Everything was logged against a strict change window so production operations were never at risk.
Systematic probing of the VLAN architecture to map what each segment could actually reach — revealing that 'segmented' described the network diagram more accurately than the firewall rules.
Controlled movement from the initial foothold across workstations and servers using harvested credentials and misconfigurations — documenting each hop as a reproducible attack path.
Mapping and chaining Active Directory misconfigurations — unconstrained delegation and a service account with a decade-old password — into a complete path to domain admin.
Two documents: a technical report with reproduction steps and remediation for the IT team, and an executive summary translating attack paths into business risk the board could act on.
From simulated employee workstation to full domain administrator — via a chain of three individually minor misconfigurations that were devastating in combination.
Critical and high findings, all remediated within 60 days under the remediation plan delivered with the report.
Viable paths to domain admin found in the follow-up verification test — the same attack chain now dies at the first hop.
// results vary by project — ask us how we measured this one
“We thought segmentation meant safe. Watching someone walk from a receptionist's PC to the keys of the kingdom in four days changed our security budget permanently.”
IT Director, Apex Network client · NDA engagement — reference call availableA fixed-scope security engagement ends with findings ranked by severity, reproduction steps and a remediation plan your team can execute. No theatre, no fear marketing.