Our external and internal penetration testing service evaluates whether an authorised attacker could gain access to yor infrastructure, escalate privileges, move through the environment or reach sensitive assets. It is intended for organisations that need realistic validation beyond vulnerability scanning, whether from an internet-facing position or from an assumed foothold inside the network.
The purpose is to validate realistic attack paths safely and convert technical weaknesses into remediation priorities.
Scope is fixed with you before any work starts. Depending on the objective, environment and authorised access, the engagement may cover:
You will not reveal anything to the testers. They will act from the position of unprivileged hackers throughout the testing process- from initial access and execution to exploitation.The decision about the approach in use depends on your particular circumstances.
You will disclose to the testers the full network and system information, including network maps and credentials.
You will share only limited information with the testers.
Agree objectives, assets, exclusions, testing windows, emergency contacts and written rules of engagement.
Identify reachable systems, services, technologies and likely entry points.
Use expert-led manual testing supported by appropriate tools to distinguish exploitable risk from scanner noise.
Where authorised and safe, test privilege escalation, lateral movement and access to agreed target assets.
Provide evidence, remediation priorities and optional validation after fixes are implemented.
Everything we hand over speaks to both leadership and the people who will act on it. Depending on scope, they may include:
Testing is governed by written authorisation, explicit exclusions, safety limits and emergency contacts. Material findings are manually validated, supported with reproducible evidence and explained in terms of realistic impact rather than scanner severity alone.
The engagement may draw on PTES, NIST SP 800-115, MITRE ATT&CK, relevant CREST and customer rules of engagement. Referencing a framework describes how we structure the work; it is not, in itself, a certification, accreditation or regulatory ruling.
Timelines are set once scope is agreed, and vary with the size of the environment and the availability of evidence and stakeholders.
Testing is performed only with written authority and within agreed safety limits. The service cannot prove the absence of all weaknesses and must not include third-party systems, destructive actions or persistence outside the authorised scope.
Discuss External and Internal Penetration Testing with us. A short scoping session confirms the objective, boundaries, evidence, delivery model and outputs before we issue a proposal.
Scope is fixed with you before any work starts. Typical areas include internet-facing hosts, services, gateways and administrative interfaces, Internal networks, servers, workstations and shared services, Directory services and common privilege-escalation paths where authorised, and Network segmentation and trust relationships. Exclusions, required access, your responsibilities and acceptance criteria are all set out in the proposal and SoW.
Deliverables depend on the agreed objective and may include approved rules of engagement and test plan, Executive summary of realistic business exposure, Technical findings with evidence and affected assets, and Attack-path narrative and impact analysis. Every significant finding is tied to evidence, business impact, priority and a clear owner for the next step.
Authorised testing can create risk if it is poorly controlled. CTG agrees testing windows, prohibited techniques, stop conditions and emergency contacts before work begins, and uses higher-risk techniques only with explicit approval.
Retesting can be included in the initial scope or ordered after remediation. It validates the previously confirmed findings and closely related bypass conditions; it is not automatically a complete new assessment.
Timelines are set once scope is agreed, and vary with the size of the environment and the availability of evidence and stakeholders.
These services answer related but distinct questions. Scoping identifies whether External and Internal Penetration Testing, Web, API and Mobile Application Security Testing, or a coordinated programme is the smallest useful approach without duplicating work.
Testing is performed only with written authority and within agreed safety limits. The service cannot prove the absence of all weaknesses and must not include third-party systems, destructive actions or persistence outside the authorised scope.
