Penetration Testing Internal Network & AD: 2026 Verdict

Internal network and Active Directory penetration testing finds the privilege escalation paths that turn one phished laptop into full domain compromise — and UK certifications increasingly demand proof you've tested for it.

Who this is for

This guide is for IT leads, CISOs, and founders at UK SMEs and scaleups who need to test their internal network and Active Directory before a client audit, an ISO 27001 certification cycle, or a Cyber Essentials Plus renewal in 2026. If your last pentest only touched your website or a cloud VPC, this is the gap you haven't closed yet — internal AD compromise is how most real breaches actually spread. Before you get quotes, work out how the test should be scoped: how to scope a penetration test before you buy one covers the questions to ask a tester before signing anything.

What to look for in penetration testing for internal networks and Active Directory

Assumed breach methodology

A good internal AD test starts from the assumption that an attacker already has a foothold — a compromised laptop, a phished credential — not from "can they get in from the internet." That's the realistic threat model for 2026: initial access usually comes from phishing or a leaked password, not a firewall hole. Testers who only run unauthenticated external scans against your internal range are testing the wrong thing.

Active Directory attack path mapping

The tester should map privilege escalation paths using tooling like BloodHound, not just list CVEs. A domain with 40 misconfigured ACL entries and zero missing patches is more exposed than one with outdated software and a clean AD structure — the report needs to show you the actual route from standard user to Domain Admin.

Kerberos and credential attack coverage

Kerberoasting, AS-REP roasting, and NTLM relay checks are non-negotiable for any AD test in 2026. Service accounts with weak passwords and Kerberoasting exposure are still one of the most common findings in internal engagements, and a report that doesn't mention them hasn't actually tested AD.

Segmentation and lateral movement validation

The test should confirm whether a compromised workstation in one VLAN can reach finance servers or backup infrastructure in another. Segmentation failures are cheap to fix and expensive to discover during an actual incident — this is where the test earns its budget.

Retest and remediation window

A one-and-done report with no retest is close to worthless for compliance purposes. Look for a provider who includes a remediation retest, ideally within 30 days of the findings being delivered, so your evidence for ISO 27001 or Cyber Essentials Plus shows closed findings, not open ones.

Reporting quality auditors will actually accept

Auditors and certification bodies need CVSS scoring, clear reproduction steps, and an executive summary a non-technical board member can read. If you're not sure what a good report looks like, how to interpret a penetration testing report breaks down what belongs in each section and what red flags to check for before you accept the deliverable.

Top picks

Assumed breach internal AD test — the safe pick. Tester is given a low-privilege domain account and internal network access from day one, then works to Domain Admin using the same techniques a real attacker would. Runs 3-5 days for a domain under 5 domain controllers in 2026 pricing terms. Buy if you're preparing for ISO 27001 or Cyber Essentials Plus and want the most realistic result for the least wasted time.

Unauthenticated internal scan — the budget trap. Automated vulnerability scanner pointed at your internal range with no credentials and no manual AD review. Costs a fraction of a proper engagement but misses Kerberoasting, ACL abuse, and most lateral movement paths entirely. Skip this if your goal is certification evidence — most assessors won't accept it as a substitute for a manual test.

Purple team AD exercise — the wildcard. Your internal IT team works alongside the tester in real time, watching detection and response as the attack path unfolds. Typically 2-3 days plus a workshop day. Consider this if you already have basic AD hygiene sorted and want to test your detection stack, not just find new findings.

Hybrid Entra ID and on-prem AD test — the growing need. Covers on-prem Active Directory plus Entra ID (Azure AD) trust relationships, conditional access bypass, and hybrid join misconfigurations. Needs 5-8 days for most mid-size UK businesses running hybrid identity in 2026. Buy if more than half your workforce authenticates through Entra ID alongside on-prem AD — this is where most hybrid-identity findings live now.

Fully outsourced, no-scoping-call test — the one to avoid. Provider sends a template SOW without asking about your domain structure, number of forests, or trust relationships. Skip it — a test scoped in five minutes over email rarely surfaces the AD-specific findings that matter, and budgeting properly upfront avoids this: see how to budget for penetration testing as a UK SME for realistic day-rate ranges before you get quotes.

If you're still shortlisting who runs the engagement, best penetration testing companies for UK small businesses compares providers by scope depth and turnaround, not just price per day.

What to avoid

• Reports that list CVEs but skip AD-specific attack paths. A clean vulnerability scan with no BloodHound-style privilege escalation mapping means the test never actually attacked your domain the way a real intruder would.
• "Full network" scope that quietly excludes Active Directory. Some cheaper packages test workstations and servers but explicitly carve out domain controllers — read the scope document, not just the headline.
• No retest included in the price. If remediation isn't retested, your certification evidence shows unresolved findings a year later, which is exactly what an ISO 27001 surveillance audit or Cyber Essentials Plus renewal will flag.

Why this matters

Certification bodies in 2026 expect internal network testing as standard evidence, not an optional add-on — ISO 27001 Annex A controls and Cyber Essentials Plus both assume you've tested lateral movement, not just your perimeter. Active Directory sits at the center of almost every UK business's identity infrastructure, and a compromised domain controller means an attacker owns every account, every file share, and every system that trusts AD. Skipping AD-specific testing to save a few days of tester time is the most common gap auditors find during a gap analysis.

Verdict comparison table

One last thing

Most internal AD tests find the same root cause behind the flashiest findings: a single over-privileged service account sitting in the Domain Admins group for no operational reason. Auditing group membership before you even book the test often removes half the eventual findings for free.

Related guides

• Penetration testing for cloud infrastructure and AWS environments