UNDERSTAND YOUR RISK WITH AN INTERNAL PENETRATION TEST

An internal penetration test is the best way to determine if an attacker who gains a foothold on your network can elevate their permissions and steal sensitive information. An internal penetration test is also the best way to test your organization’s resilience to ransomware attacks. At Triaxiom we emulate the real-world attacks your organization is likely to face to quantify the risks of your network perimeter.

YOUR TRUSTED CYBERSECURITY PROVIDER

crest-lg

PENETRATION TESTS WE OFFER

Click the menu icon to browse the tests we offer!

Internal Penetration Test

An internal penetration test emulates an attacker on the inside of your network. This could be either an attacker who is successful in breaching the perimeter through another method or a malicious insider. The goal of the engineer in this module is to gain root and/or domain administrator level access on the network, and gain access to sensitive files. Activities include:

Active and Passive network reconnaissance including traffic sniffing, port scanning, LDAP enumeration, SMB enumeration, etc.
Vulnerability scan on all in-scope targets
Spoofing attacks such as ARP cache poisoning, LLMNR/NBNS spoofing, etc.
Manual and automated exploit attempts
Shared resource enumeration
Password attacks
Pivoting attacks

An external penetration test emulates an attacker trying to break into your network from the outside. The goal of the engineer performing this assessment is to breach the perimeter and prove they have internal network access. This test includes:

Open source reconnaissance against the organization
Full port scan covering all TCP ports and the top 1,000 UDP ports of the targets in scope
Full vulnerability scan of the targets
Manual and automated exploit attempts
Password attacks

A wireless penetration test is a comprehensive evaluation of the wireless networks in your organization using automated and manual methods. Areas covered include:

Password attacks
WEP/WPA cracking
Guest wireless segmentation checks
Traffic sniffing attacks
SSID spoofing
Rogue access point discovery

A web application penetration test is an in-depth penetration test on both the unauthenticated and authenticated portions of your website. The engineer will test for all of the OWASP Top-10 critical security flaws, as well as a variety of other potential vulnerabilities based on security best practice. Activities include:

Website mapping techniques such as spidering
Directory enumeration
Automated and manual tests for injection flaws on all input fields
Directory traversal testing
Malicious file upload and remote code execution
Password attacks and testing for vulnerabilities in the authentication mechanisms
Session attacks, including hijacking, fixation, and spoofing attempts
Other tests depending on specific site content and languages

This assessment is designed to target and take advantage of the human-element to gain access to your network. This is done using a variety of methods to get an employee to click on something they shouldn’t, enter their credentials or otherwise provide them when they shouldn’t, or divulge information that may assist an attacker in breaching your network. The goal for the engineer performing this assessment is to gain information that may assist an attacker in future attacks, gather credentials, or gain a foothold on the internal network. This assessment will include:

Phone-based attacks
Spear phishing attacks
Bulk phishing attacks

A physical penetration test is an assessment of the physical security of your premises. Our engineers will attempt to gain access to your facility by identifying weaknesses and/or using social engineering. Once inside, our engineers will attempt to gather sensitive information, gain access to sensitive areas such as the data center, and attempt to gain internal network access.

Vulnerability scanning is a regular, automated process that identifies the potential points of compromise on a network. A vulnerability scan detects and classifies system weaknesses in computers, networks and communications equipment and predicts the effectiveness of countermeasures. Our engineers will conduct this scan for you and use our expertise to remove false positives and produce a risk-prioritized report.

An API penetration test emulates an attacker trying to exploit vulnerabilities within your API that may allow him to bypass authentication controls, access sensitive data, or otherwise disrupt the service. The goal of the engineer performing this assessment is to comprehensively review your API for OWASP Top 10 vulnerabilities and exploit any vulnerability that may allow the engineer to bypass security controls. Our API Penetration Testing includes:

Method and parameter fuzzing
Injection attacks, such as SQLi, XSS, XPath, Command
Authentication bypass and privilege escalation attempts
Authorization testing to assess the security of data in multi-tenant configurations including:
- Direct object references
- Client or user impersonation
- Authorization bypass
- Information Leakage between clients
Analyzing headers and error messages for information disclosure
Identification of unnecessary information returned or data leakage
Analysis of server-level transport encryption for security best practice

CHARLOTTE, N.C.-BASED PEN TEST PARTNER FOR 650+ ORGANIZATIONS

At Triaxiom Security, we specialize in penetration testing. Our engineers have industry-recognized certifications and a wealth of experience performing penetration tests for Fortune 500 companies, small start-ups, Government agencies, Higher Education, Regional and Metro Hospitals, Payment Processors, Top US Financial Institutions, and everything in between.

GettyImages-2156387160-min

Serving Since 2017

Serving Since 2017

Perform Over 500 Penetration Tests Per Year

Perform Over 500 Penetration Tests Per Year

Over 650 Clients Served

Over 650 Clients Served

9-removebg-preview

PCI-1-e1615481607357-no-bkgd

eCPPTv2

6-removebg-preview

5-removebg-preview

4-removebg-preview

3-1-removebg-preview

gwapt-gold

offsec-student-certified-emblem-rgb-oswe

1*RsWtbuY8uvRDNqWSfedVtw

what certifications should penetration testers have

PCI-1-e1615481607357-no-bkgd

CREST accredited

TRUSTED BY ORGANIZATIONS ACROSS ALL VERTICALS

As a trusted security partner for organizations ranging from small start-ups to the Fortune 500, we pride ourselves on providing what you need to make data-driven decisions to optimize your resources and navigate the current cybersecurity landscape. With clients in every major vertical, we understand the unique challenges you face and how to tailor our assessments to meet your needs.

Triaxiom Security are experts at their craft. We have partnered with them on a multi-year engagement to identify our security weaknesses throughout our environment. Additionally, we are engaged with them to help us maintain PCI compliance on an annual basis. Their engineers have been extremely responsive and helpful every time we reach out, even if it is not part of an ongoing assessment. They truly are a part of our security team!

Chief Information Security Officer
Fortune 300 Retailer

We are extremely happy with the depth and breadth of the test Triaxiom performed, their attention to detail, and the great write-up of vulnerabilities that were discovered. They found vulnerabilities that were overlooked by other companies we used in the past. In today’s challenging and evolving security environment, getting a clean bill of health is great, but being able to keep up with best practices and quickly remediate vulnerabilities is absolutely critical. I’m very happy that we have an even more secure system and that we signed a three year commitment with Triaxiom Security.

CTO
SaaS Provider

We were pleasantly surprised by the penetration test, the professionalism and, more so, the effectiveness of the team. Regardless of the difficulty in securing the funds, the results were exceedingly thorough and we’re busily working on remediations, thanks to the helpful report. The results from their penetration test are the most useful tool to discover high-value actionable tasks which can keep us safe.

CISO
Higher Education University

OUR INTERNAL PENETRATION TEST PROCESS

Scoping Call

Our first step is to jump on a quick call with you and one of our lead engineers to understand your organization’s needs and to scope the penetration test. Within a few hours following this call, you will have a proposal with pricing information and next steps.
Proposal
Contracts

Should you choose to move forward with Triaxiom, we will provide the required contracts to get the project started. Once contracts are signed, we will assign a project manager to your account that will work with you to schedule the kick-off call and execution of the assessment.
Kick Off Call

On the kickoff call, we will review the Rules of Engagement document that will govern the project. It will include all project contracts, the rules the team will follow during testing, the testing schedule, and allow you to provide the necessary technical details to facilitate your assessment.
Execution
Documentation & Quality Assurance

All of our assessments go through two rounds of Quality Assurance to ensure our reports and tests meet the highest standards. This includes a technical QA process to ensure our methodology was followed and all evidence was properly collected/analyzed. This is followed by a thorough documentation QA to ensure our reports are consistent and actionable.
Report Delivery
Retest

At Triaxiom Security, our primary goal is to make your organization more secure. As part of that, any findings identified during our test that you wish to remediate can be included in a one-time retest within 90 days of report delivery, free of charge. The team will validate that your remediation efforts were effective and will update the reports to reflect your heightened security posture.

GET A QUOTE NOW

Deliverables

Each internal penetration test concludes with a comprehensive report that clearly outlines your organization’s security posture and testing results. Key features of the report include:

Executive summary highlighting strengths, risks, and takeaways
Detailed results from the internal penetration testing
Clear descriptions of risks, affected systems, evidence, and prioritized remediation recommendations
Visual summaries and a risk rating scale
Roadmap to gradually improve security posture

Internal Penetration Test – LP

GET A QUOTE NOW

Find and fix vulnerabilities that ACTUALLY impact your business and compliance goals faster.