A network penetration test is a controlled attack on your own network, carried out by a skilled tester who tries to get in the way a real criminal would. The network penetration test process runs in set stages: scoping, discovery, exploitation, post-exploitation, reporting and retesting. The aim is to show you which weaknesses matter in practice, so you can fix them before someone else finds them.
This guide walks through each stage in plain terms. It also covers what you will receive at the end, and how to get the most from the money you spend.
Table of Contents
What does a network penetration test actually involve?
The UK’s National Cyber Security Centre (NCSC) describes penetration testing as “a method for gaining assurance in the security of an IT system”. Testers try to breach it using the same tools and techniques an attacker might use. A network test applies that idea to the infrastructure itself: firewalls, servers, workstations, switches, remote access and the services they expose.
Think of it as a rehearsal. A scanner tells you a door might be unlocked. A tester walks through the door, looks around, and tells you what they could reach once inside.
Is it the same as a vulnerability scan?
No. A scan is automated and produces a list of possible flaws. A pen test uses a scan as one input, then a person checks which flaws are real, chains them together and shows the effect. Many scan findings turn out to be harmless. Some small ones, combined, give full control of a domain.
Which stages make up the network penetration test process?
Every provider words the network penetration test process a little differently, but the sequence is much the same. Here is what happens, in order.
1. Scoping and rules of engagement
Scoping decides what is tested, when, and how hard. The NCSC advises involving risk owners, technical staff who know the systems, and someone from the test team. The result should cover technical boundaries, test types, timeframes, effort in days and any reporting needs, such as CVSS scores.
This is also where you agree what is off limits. A fragile legacy system or a live payment platform may need gentler handling. Written permission is essential, because testing without it is a crime.
2. Reconnaissance and discovery
The tester maps the network. For an external test, that means finding the addresses, domains and services visible from the internet. For an internal test, it means finding hosts, shares, users and services from inside the building or VPN.
Tools such as port scanners show which services are listening. Public sources show what staff and old DNS records give away. Often this stage alone turns up forgotten servers nobody remembered they owned.
3. Vulnerability identification
Next the tester looks for weaknesses in what they found. These include missing patches, default passwords, weak encryption settings, open file shares and badly configured services. Automated tools help here, but the tester decides what is worth pursuing.
4. Exploitation
This is the part people picture. The tester tries to use a weakness to gain access, such as logging in with a guessed password or running code on an unpatched server. Good testers work carefully. They avoid crashing systems and stop to ask if something looks risky.
5. Post-exploitation and lateral movement
In any network penetration test process, getting in is rarely the end. The tester then asks what an attacker could do next. Can they read sensitive files? Can they steal credentials and move to other machines? Can they reach the domain controller, which often means control of the whole estate?
This stage is where a network test earns its fee. It turns “we found a medium-rated flaw” into “this flaw led to your finance data in under a day”.
6. Reporting
You should get a written report with the issues found, a risk level for each, and how to fix them. The NCSC says reports should also include an opinion on how accurate your own vulnerability assessment was. CHECK-style reports use HIGH, MEDIUM, LOW and INFORMATIONAL ratings, and CVSS can sit alongside them. A good report also has a short summary that a non-technical director can read in five minutes.
7. Remediation and retesting
Fixing is your job, and it sits outside the test itself. The NCSC is clear that decisions on applying fixes are the organisation’s responsibility, and that risk should not be wholly outsourced to the test team. After you fix the serious issues, ask for a retest to confirm they are closed.
What is the difference between internal and external network testing?
An external test starts from the internet with no special access. It asks what a stranger can reach. An internal test starts from inside, as an employee, a visitor on the Wi-Fi or an attacker who has already landed on one laptop. It asks how far they can go from there.
| Question | External test | Internal test |
|---|---|---|
| Starting point | The internet | Inside your network |
| Typical targets | Firewalls, VPNs, mail and web servers | Servers, workstations, file shares, Active Directory |
| Main question | Can someone get in? | How much damage if they do? |
Most organisations need both. Aardwolf runs external network penetration testing and internal network penetration testing as separate engagements, so you can start with whichever worries you more.
Will a network penetration test disrupt our systems?
It should not. In a well-run network penetration test process, testers agree timings in advance and avoid noisy attacks that could knock services over. Some risk always remains, which is why scoping and a named contact on your side matter. Tell your IT team and any managed service provider before testing starts, so nobody mistakes the test for a real incident.
What does a network penetration test not tell you?
A single test is a snapshot. The NCSC notes that a test can only confirm your systems were not vulnerable to known issues on the day. A new flaw may be published next week. The test is also a check on your vulnerability management, not a replacement for it, so keep patching and scanning between tests.
For wider background on method, NIST’s Technical Guide to Information Security Testing and Assessment (SP 800-115, published in 2008) sets out how organisations plan and run technical tests and act on the results. It is older, but the planning logic still holds.
How should you prepare before testing starts?
- List the systems you own, including cloud and remote sites.
- Share any recent vulnerability assessment with the testers, as the NCSC suggests.
- Name a contact who can answer questions during the test.
- Back up critical systems.
- Decide who will own each fix before the report lands.
If you would like a tester to scope this with you, you can read about our penetration testing services or get in touch for a conversation about what your network needs. There is no obligation, and a plain chat about scope is often the most useful first step.
Frequently asked questions
How long does a network pen test take?
It depends on the number of live hosts and the depth you want. Small networks may take a few days of tester time, and large estates take longer. Your scoping call should give you a firm figure in days.
Who should carry out the test?
The NCSC says tests should be done by qualified and experienced staff only. For central government and critical national infrastructure, it points to its CHECK scheme of assured companies. Private firms can use that as a useful benchmark too.
How often should we test?
Test after major changes, such as a new office, a merger or a new remote access setup, and on a regular cycle. Many firms choose once a year.
Do we need to fix everything in the report?
No. Start with the high-risk items and the ones that let an attacker reach important data. Then plan the rest by risk, cost and effort.
Subscribe to our newsletter
Honest updates, straight to your inbox. Unsubscribe any time.
