Is this the test my cyber insurance carrier is asking for?

Usually an external network test, sometimes external plus internal, and increasingly a phishing assessment alongside it. Carriers word it differently and some are vague on purpose. Send us the questionnaire before the call and we will tell you which scope answers it, and which parts you do not need to buy yet.

How is this different from the vulnerability scan we already run?

A scan lists what might be exploitable. A test proves what is, and shows how far it goes. Scanners also miss the things that matter most in mid-market environments: chained weaknesses, permissions nobody remembers granting, and a helpful person on the phone. Keep scanning. Test on top of it.

How much of my team's time does this take?

A scoping call, a short kickoff to agree rules of engagement and testing windows, and a readout at the end. Between those, your team keeps working. We coordinate directly with whoever owns the systems in scope so tickets do not pile up on your desk.

Will you break something?

The point is to find the path, not to prove we can take you down. Denial of service testing is off the table unless you ask for it in writing. Fragile systems get flagged in scoping and are handled carefully or excluded, and there is a stop condition and a phone number that a human answers.

What if you do not find anything serious?

Then you have documented evidence of that from a third party, which is exactly what the board, the carrier, or the client asking the question wants. It is also rarer than you would hope. In most environments the issue is not that nothing is wrong, it is that nobody has had time to look.

How often should we test?

Once a year covers most compliance requirements. Test again after anything material: a cloud migration, a new plant or branch, an acquisition, or a significant change to remote access. If your environment changed and the report did not, the report is out of date.

Penetration Testing Services

What we test

Every way in, not just the ones a scanner finds

Attackers do not stop at the firewall, so neither do we. Run one surface, or all six as a single engagement.

External network testing

The view an attacker gets from the internet, with no credentials and no invitation. This is usually the test your insurer and your clients are actually asking for.

Exposed services, forgotten hosts, and shadow infrastructure
Credential attacks against remote access and email
Known vulnerabilities with working public exploits
Proof of exploitation, not a severity score

Internal network testing

We start where a phished user or a compromised laptop would start, then see how far we get. Segmentation and privileges get tested against a real attacker path.

Lateral movement and privilege escalation
Active Directory attack paths to domain control
Segmentation between office, plant, and branch networks
Reach to the data that would actually hurt

Cloud and identity testing

Identity is the perimeter now. We test the tenant, the permissions, and the misconfigurations that automated tools score as green.

Entra ID (formerly Azure AD) and conditional access gaps
Over-permissioned service accounts and app registrations
Public storage, exposed endpoints, and open management planes
Guest access and tenant-to-tenant paths

Wireless testing

Plant floors, branch offices, and guest networks are the easiest places to get in without walking in. We test what your access points give away from the parking lot.

Encryption and authentication weaknesses
Rogue and lookalike access points
Guest network separation from production
Signal reach beyond the building

Phishing and social engineering

Most breaches start with someone being helpful. We test email, phone, and in-person pretexts to find where a good process bends under pressure.

Targeted phishing built around real workflows
Voice pretexting against the service desk
Password reset and access request attempts
Who reported it, and how quickly

Physical entry testing

Badge readers, side doors, and the person who holds one open for you. We attempt real entry and document exactly how far into the building we got.

Reception, badge cloning, and tailgating attempts
Access to network ports, closets, and server rooms
Unattended workstations and printed material
The path from the lobby to your network

From the field

What a real test turns up

One engagement, start to finish. Names removed, findings intact.

PLACEHOLDER: industry, employee count, sites

Their cyber insurance renewal asked for a current third-party test. The last one they had was a vulnerability scan with a cover page on it, and nobody could tell the board what it meant.

PLACEHOLDER: replace this paragraph with the cleared engagement narrative. Structure to keep: where we started, the specific foothold we found, how far it went, and where we stopped.

PLACEHOLDER: one closing line on the outcome, for example what the renewal or audit did next and what changed in the environment.

PLACEHOLDER: days from the internet to domain control

PLACEHOLDER: findings their previous scan had flagged

PLACEHOLDER: critical and high findings, ranked in fix order

PLACEHOLDER: days to remediation and verified retest

Why Netrix

The test is the easy part. The report is what your team lives with

Five things we do differently, and they all show up after the testing stops.

People, not a scanner with a logo on it. Our testers hold certifications that require breaking into a live environment to pass, including OSCP, GPEN, GXPN, and CEH. You get the exploit path we took, step by step, reproducible by your team.
Findings ranked by what an attacker reaches, not by a generic score. A medium that leads to your finance share matters more than a high that leads nowhere. You get a fix order your team can start on Monday.
Retesting is part of the engagement, not a change order. When the fixes are in, we come back, verify each one, and confirm the path is closed. That verification is what your insurer and your auditor actually want to see.
Production stays up. Rules of engagement, testing windows, and a stop condition get agreed before anyone touches anything. A named engineer is reachable for the whole engagement, and if something looks fragile we call you rather than push.
The people who test your environment sit next to the people who defend it. If you want the findings to turn into monitoring, identity work, or a managed security engagement, that handoff happens inside one firm. If you would rather take the report and go, that is fine too.

Before you call

Find the gap before
someone else does

Every way in, not just the ones a scanner finds

External network testing

Internal network testing

Cloud and identity testing

Wireless testing

Phishing and social engineering

Physical entry testing

What a real test turns up

The test is the easy part. The report is what your team lives with

The questions we get every week

Book the test before someone else runs it for free

Find the gap beforesomeone else does

Every way in, not just the ones a scanner finds

External network testing

Internal network testing

Cloud and identity testing

Wireless testing

Phishing and social engineering

Physical entry testing

What a real test turns up

The test is the easy part. The report is what your team lives with

The questions we get every week

Book the test before someone else runs it for free

Find the gap before
someone else does