If a laptop gets compromised tomorrow, how far does it go?

Perimeter security tells you nothing about what happens after the first compromise.

Most organisations have invested heavily in perimeter defences — firewalls, email filtering, endpoint protection — and reasonably expect that investment to keep attackers out. It does, most of the time. The problem is what happens the small percentage of the time it doesn't: a phishing email gets through, a personal device connects to the office network, or a contractor's laptop arrives already compromised. Once an attacker has any foothold inside the network, the perimeter is irrelevant, and it's the internal environment that determines whether that foothold stays contained or turns into full domain compromise.

Active Directory is almost always the deciding factor. It's the system that governs who can access what, and in practice it accumulates years of small compromises to convenience: a service account with domain admin rights because it was easier at the time, a group policy object with weak permissions, delegation settings configured for a project that ended two years ago. None of these individually look dangerous. Chained together, they routinely provide a direct path from a standard user account to full domain control.

Lateral movement techniques exploit the fact that most internal networks trust devices and accounts far more than they should once they're past the perimeter. Cached credentials on shared workstations, local administrator passwords reused across the estate, and overly permissive file shares all let an attacker move from one compromised machine to dozens more with very little additional effort.

Legacy protocols compound the problem further. LLMNR and NetBIOS broadcasts, SMB signing left disabled, and unencrypted LDAP are still common in environments that have grown organically over years, and each one can be abused to intercept or relay credentials without ever triggering an alert, because from the network's perspective it looks like ordinary traffic.

Segmentation is meant to be the safety net when all of this goes wrong — guest networks, office VLANs and production environments kept apart so a compromise in one doesn't reach the others. In practice, firewall rules drift, VLANs get bridged for a temporary fix that never gets reversed, and the segmentation that appears in the network diagram often doesn't match what actually happens on the wire.

• Service accounts and delegation settings creating unintended admin paths
• Cached and reused local administrator credentials across the estate
• Legacy name resolution and SMB protocols still enabled by default
• Segmentation that exists on paper but not in firewall rules

We start where a real attacker would, and see how far that gets us.

Most engagements begin from an assumed-breach position — a standard domain user account on an ordinary workstation, with no special access. This mirrors the realistic outcome of a successful phishing email or a compromised device far more closely than a hypothetical zero-knowledge external attack, and it lets us focus testing time on the part of the network that carries the most risk: what happens after the initial compromise.

From that starting point, we systematically enumerate the Active Directory environment — trust relationships, group memberships, delegation configuration, group policy permissions and service account behaviour — looking for the specific misconfigurations that turn a low-privilege account into a path towards domain administrator. Where a credible path exists, we follow it to demonstrate genuine impact rather than reporting a theoretical weakness.

Lateral movement is tested directly. We check whether credentials or password hashes captured on one machine grant access to others, whether local administrator passwords are shared across the estate, and whether file shares, print servers or backup systems expose more than they should to a standard user account.

Legacy protocol abuse is tested as standard: LLMNR and NetBIOS poisoning, SMB relay attacks, and unencrypted LDAP binds are all attempted where the environment permits, because these are consistently among the fastest routes to credential capture in real intrusions.

Segmentation is validated by actually attempting cross-segment access rather than reading firewall rulesets in isolation — testing from a guest network, an office VLAN or a lower-trust environment to see what genuinely reaches domain controllers, production servers or sensitive data stores.

Every path we successfully exploit is documented step by step, with the specific misconfiguration responsible identified clearly enough that your team can close it permanently rather than patch the symptom. We agree rules of engagement upfront to avoid account lockouts and unnecessary disruption, and free retesting is included for every critical and high finding.

• Assumed-breach starting point matching a realistic attacker foothold
• Active Directory misconfiguration and privilege escalation paths mapped and demonstrated
• Legacy protocol abuse and lateral movement tested directly, not inferred
• Segmentation validated by attempted cross-segment access, not just rule review