Penetration tests & assessments
A penetration test of your Microsoft environment, by someone who can also build it.
Most attacks on Microsoft environments run through identity: a stolen session, excessive privileges, a forgotten path to Domain Admin. We look for those paths, and tell you not only what is wrong but also how to fix it.
When does it make sense?
- After a migration or redesign: does the security design work as intended?
- To prepare for an audit, or as evidence for a regulator or client.
- After an incident elsewhere in your sector: could it happen to you?
- When you have introduced App Control, Conditional Access or tiering and want to know whether it holds.
What you get
- A report for management and for administrators
- Prioritised findings with concrete fixes
- A retest after remediation
- If you want, help with fixing, from the same specialist
- Active Directory
- Microsoft Entra ID
- Microsoft Intune
- Defender XDR
- MITRE ATT&CK
Penetration tests & assessments
How we approach it
Scope
Agree scope, timing and rules of engagement together, so the test is safe for production.
Test
Attack paths in Active Directory and Entra ID, the workplace and tenant settings, the way an attacker would.
Report
Findings by priority, each with its impact and a concrete fix.
Retest
After remediation, we check that the findings are really fixed.
Frequently asked questions
Is a penetration test safe for our production environment?
We agree scope and rules of engagement up front and don’t run tests that put availability at risk. Where a test carries risk, we agree the timing and approach with you.
What exactly do you test?
Active Directory and Microsoft Entra ID (attack paths, privileges, Kerberos, hybrid links), the Windows workplace (local rights, LOLBins, App Control, BitLocker, LAPS) and the configuration of Intune, Conditional Access and the tenant.
What do you need from us?
Usually an ordinary user account and access to a workstation or the network, as an employee would have. That tests what an attacker can reach after one stolen account.
Do we only get a report?
No. Every finding comes with a concrete fix, and a retest follows remediation. Because we build these environments too, we can help with the fixes if you want.
Do you also do purple teaming?
Yes. We run attacks while your security team watches in Defender XDR, and improve detection together.
Start with a 20-minute intake.
We discuss your situation and tell you honestly whether and how we can help, even if the answer is ‘you don’t need this’. You’ll hear from us within two business days.