Overview
Many Indian organisations run large branch, warehouse or plant networks routed back to one head office, and segmentation is often thinner than the diagrams suggest. Once a single PC is compromised, that design decides how far ransomware travels. We test from a foothold you provide, usually over VPN or a small device couriered to your office, so travel costs are avoided. On-site work can be discussed at scoping where a network needs it.
Once an attacker has any foothold inside, whether through a phished laptop, a compromised supplier or a reachable service, the question is how far they can go. An internal test answers that by starting from an assumed-breach position on your network and attempting to expand access the way an intruder would: harvesting credentials, abusing misconfiguration, and pivoting from one system to the next toward the data and systems that would actually hurt you to lose.
We look hard at the weaknesses that let movement happen quietly. Shared local administrator passwords, credentials cached in memory and files, services running with too much privilege, and overly trusting network paths all let an attacker escalate without raising an alarm. We also test your segmentation directly, checking whether the boundaries you believe separate sensitive zones from the general network actually hold when pushed.
The output is a narrative of attack paths, not just a scan of internal hosts. We show the steps from initial foothold to high-value target, score each finding with CVSS v4.0, and recommend fixes that break the chain at the cheapest point, often a configuration change that removes an entire class of movement. Where this engagement meets a segmentation requirement, we document the result in terms your auditor will accept.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Access setupWe agree a starting position, from a connected device to a standard user account.
- DiscoveryWe map reachable systems, services, shares and trust relationships.
- Credential & escalationWe harvest credentials and pursue local and network privilege escalation.
- Lateral movementWe pivot toward critical assets, recording each step of the path.
- Report & debriefAttack paths are documented, scored and explained with chain-breaking fixes.
What you receive
- Narrative of attack paths from foothold to critical assets
- Risk-rated findings with CVSS v4.0 scores
- Segmentation test results where in scope
- Chain-breaking remediation prioritised by cost and impact
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- PTES
- NIST SP 800-115
- MITRE ATT&CK
- PCI DSS segmentation testing
- CVSS v4.0
- CWE
- CERT-In Directions 2022
- RBI IT Governance Direction 2023
Frequently asked questions
How do we give you internal access?
Usually a device we connect to your network, a VPN profile, or a jump host, plus a standard user account for assumed-breach testing. We agree the exact starting position with you, since it shapes what the test demonstrates.
Should testing start with or without credentials?
Assumed-breach, with a standard user account, reflects how most real intrusions unfold and finds far more in the time available. A zero-credential start is useful for specific questions, and we can combine both; we recommend the right mix during scoping.
Can this satisfy a segmentation testing requirement?
Yes. Where your scope calls for segmentation testing, we design the engagement to probe the specific boundaries involved and document whether they hold, in language suited to an auditor reviewing that control.
Can internal and Active Directory testing be done without a site visit?
Usually, yes. We connect through a VPN you provide or a small preconfigured device that your team plugs in at the office. On-site work can be discussed at scoping where a network needs it.
Will you look at our CERT-In log and time-sync settings?
When infrastructure is in scope, we note whether logs appear to be kept for the 180 days the 2022 CERT-In Directions require and whether systems sync time with NIC or NPL servers. Treat this as a technical observation, not a legal opinion.