Network and infrastructure penetration testing

Network penetration testing, internal or external.

ShieldProbe Assess tests your networks and server infrastructure: internet-facing services, private networks, and on-premises or cloud-hosted servers. Testing is black-box, under an agreed PTES scope. A named consultant approves each finding before you see it.

Scope your network test Open the sample report

Targets: Networks and server infrastructure, on-premises or cloud-hosted
Location: Internal or external
Access: Black-box only
Methodology: Agreed PTES scope

External and internal tests start from different places.

External testing reaches your authorized internet-facing services from ManticoreAI infrastructure, with nothing installed on your side. Internal testing reaches private networks and servers through an approved connector or access path.

Neither needs supplied login credentials. Network and server testing is black-box: authenticated grey-box testing is for web applications and APIs.

Bring to scoping

Target ranges, hostnames and their owners, plus written authorization.
Internal access: the connector or approved access path, and any allowlisting.
Permitted activities, including whether privilege escalation and lateral movement are in scope.
Testing windows, stop conditions and escalation contacts.

What a network and server test covers.

Test exposed services, misconfigurations and exploitable weaknesses. Validate privilege escalation and lateral movement where the agreed scope permits.

Internet-facing services, private networks, and on-premises or cloud-hosted servers.

Methodology: Agreed PTES scope. Testing follows the exposed services and weaknesses it can reach within that scope, and records what was not reached. Some buyers call this a VAPT engagement: weaknesses are found, then tested to prove which ones can be exploited.

The boundaries of this test

On-premises or cloud-hosted servers are tested as running systems, not as a blanket cloud configuration or IAM audit.
Defend and Fix address supported application findings. Network and server findings come with remediation guidance in the report.
A clean result covers the agreed scope, access and time window. It does not prove the absence of vulnerabilities.

What we test

Web, API, network and server pentesting.

Choose the systems to test, where they run and the access we start with. Each assessment has an agreed scope and consultant-reviewed evidence.

Networks & server infrastructure

Internet-facing services, private networks, and on-premises or cloud-hosted servers.

Test exposed services, misconfigurations and exploitable weaknesses. Validate privilege escalation and lateral movement where the agreed scope permits.

Location: Internal or external
Access: Black-box only
Methodology: Agreed PTES scope

Web applications

Customer portals, dashboards and browser-based applications.

Test authentication, sessions, access controls and business workflows. Follow weaknesses through to their demonstrated impact.

Location: Internal or external
Access: Black-box or grey-box
Methodology: Agreed OWASP Top 10 or full WSTG scope

APIs

REST, GraphQL and SOAP APIs, including backend services and integrations.

Test endpoint authorization, data exposure, input handling and API workflows, using the agreed accounts and API specification.

Location: Internal or external
Access: Black-box or grey-box
Methodology: Agreed OWASP API Security Top 10 or full WSTG scope

Internal or external?

External: test internet-facing systems from our infrastructure.

Internal: reach private applications, APIs, networks and servers through an approved connector or access path.

Black-box or grey-box?

Black-box: start without supplied login credentials and test the reachable, authorized surface.

Grey-box: use supplied test accounts and context to test authenticated web and API workflows.

Network and server infrastructure assessments currently use black-box testing.

Not sure where to start? We'll help you define targets, access and permitted activities before testing begins.

Scope your assessment

Evidence you can hand to engineering and your assessor.

Each finding carries its reproduction evidence, demonstrated impact and limitations, approved by a named consultant before release. With scope agreed and access ready, the report can arrive in 48 hours, and retests of fixed findings run for 12 months under your engagement terms.

Planning a PCI DSS internal or external test, or a wider enterprise scope? We agree the targets and evidence with you and your assessor first.

Common questions

Tell us the targets and where they sit. We will agree the rest with you.

Can you test internal systems as well as public targets?

Yes. External testing reaches internet-facing applications, APIs and services from ManticoreAI infrastructure. Internal testing reaches private applications, APIs, networks and servers through an approved connector or access path. Location and access mode are separate: an internal target may still be tested without login credentials.

What is the difference between black-box and grey-box testing?

Black-box testing starts without supplied login credentials and tests what an attacker can discover and reach within the authorized scope. Grey-box testing uses supplied test accounts and context to examine authenticated web or API workflows and permission boundaries. Web and API assessments support both modes. Network and server infrastructure assessments currently support black-box only.

Start with the exposed services you already know about.

We will scope the rest of the network and server test with you.

Scope your network test