Penetration Testing
External, internal, wireless, and physical penetration testing engagements that demonstrate what an attacker could actually do against the in-scope environment, with findings prioritized by exploitability and remediation a defender can act on.
Penetration testing is the assessment class that produces a defensible read on what an attacker could actually do against the environment in question, not what a scanner reports as theoretically vulnerable. Aegis & Spear runs four operationally distinct penetration tests: external, internal, wireless, and physical. Each one targets a different attack surface and produces different findings, and each is delivered as a fixed-scope, fixed-fee, time-boxed engagement against the Penetration Testing Execution Standard. The four can be run independently or chained, depending on what the organization needs to learn. The deliverable in every case is the same shape: prioritized findings keyed to exploitability and business impact, remediation guidance specific enough that a sysadmin can act on it without the tester present, and an executive summary readable by a non-technical board member.
What’s in scope
Four engagement types fall under penetration testing. The right scope depends on which attack surfaces the organization actually needs to learn about.
External penetration test. Internet-exposed assets only: corporate perimeter, public application surface, externally-reachable infrastructure. The engagement runs PTES phases against the organization’s externally-published IP ranges and domains, validates exploitability manually rather than relying on scanner output, and produces findings keyed to demonstrated impact. Web application testing in scope aligns to the OWASP Web Security Testing Guide. Time-boxed, typically three to ten business days depending on attack surface size.
Internal penetration test. Post-foothold work against the organization’s internal network: lateral movement, Active Directory enumeration, privilege escalation, and demonstration of attack paths to high-value targets. The engagement runs from a remote device or VPN, against client-defined subnets, with a domain user account provided in advance. Tradecraft includes attack-path analysis, Kerberos protocol attacks, credential relay where in scope, and analysis of any credential material observed. Time-boxed, typically five to ten business days.
Wireless penetration test. Onsite RF survey, access point enumeration, wireless segmentation testing, and rogue access point identification. The engagement includes configuration review of in-scope wireless infrastructure, captive portal and EAP method validation, and characterization of how guest network isolation actually performs against the corporate network rather than what the network diagram says it does. Onsite component requires coordination with a client point of contact and a confirmed letter of authorization.
Physical penetration test. Onsite assessment of facility access controls, badge and entry system handling, and the social-engineering vector that frequently bypasses both. The engagement targets specific objectives (sensitive-area access, server-room access, evidence of unauthorized material removal) under explicit rules of engagement, with safe-haven coordination active throughout. Often paired with social engineering scope when the human-layer attack path is in question.
Each engagement runs PTES end to end, with NIST SP 800-115 available as the procedural reference for organizations whose auditors expect that specific cross-walk. Healthcare environments receive findings cross-walked against the HIPAA Security Rule’s technical safeguards at 45 CFR 164.312. Engagements involving cardholder data environments align to PCI DSS pentest guidance. The cross-walks are concrete: an auditor or regulator can trace any finding back to the standard that governs it.
How engagements actually run
Engagements run against the Penetration Testing Execution Standard. Pre-engagement covers scope definition, rules of engagement, escalation contacts, and the explicit timeline. The scope is committed in writing before any active testing begins, and the rules of engagement specify what is in bounds and what is not, including any production-impact thresholds the client wants observed.
Intelligence gathering and threat modeling are concrete deliverables, not procedural decoration. Public-source reconnaissance produces the picture an external adversary would build before targeting the organization, and the threat model is anchored to the organization’s actual risk surface rather than a generic enterprise template.
Vulnerability analysis and exploitation are where commodity testing falls down. Scanner output is the starting point, not the conclusion. Every vulnerability that informs a finding is validated manually against the actual environment, and exploitability is demonstrated rather than asserted. Where exploitation is constrained by rules of engagement (production-system carve-outs, sensitive-data handling restrictions, brittle legacy infrastructure), the engagement documents what was tested, what was not tested and why, and what the constraint means for the confidence on each finding.
Post-exploitation produces the lateral-movement and privilege-escalation findings that distinguish a real internal pentest from a scanner report. The engagement documents attack paths, the evidence collected at each step, and what the compromised position would have produced for an actual adversary, with operational specifics calibrated to what the deliverable needs and what the client does not need to know about offensive tradecraft.
Reporting delivers an executive summary in business language, a technical findings section with prioritized findings and remediation guidance, an exploitation activities walk-through, and a findings matrix the client can use to track remediation. A letter of attestation confirming engagement completion is available on request. The firm’s approach covers engagement mechanics in more depth across all service lines.
What makes this engagement different
The work runs against the same attack surfaces a real adversary would target, with the offensive tradecraft of someone who has built and defended enterprise-scale networks. That orientation shows up in how findings are prioritized, how remediation is framed, and what the executive summary actually says.
Findings are prioritized by demonstrated exploitability and business impact, not by CVSS-only severity scores that frequently overstate or understate the actual risk in a specific environment. Remediation guidance is calibrated to what the organization’s defensive layer is actually doing today, not to a generic best-practices template. Where a finding’s risk is materially controlled by a compensating control already in place, the report says so rather than padding the executive summary with findings that would generate remediation noise without producing security gain.
The operator brings two decades of building defensive and offensive cyber capability at scale, including standing up the first Defensive Cyber Operations unit in the Marine Corps Reserve. More on the operator. The relevant point on a penetration test: this is a tester who knows what the defender is looking at on the other side, which produces sharper findings, fewer false-positive escalations, and remediation guidance the defender can act on.
What good outcomes look like
At engagement close, the client has a defensible read on what an attacker could actually do against the in-scope attack surface and what would need to change to close the attack paths that matter. Findings are prioritized by demonstrated exploitability and business impact. Remediation guidance is specific enough that a sysadmin can act without the tester present, sequenced by effort and impact rather than by CVSS score alone, and calibrated to controls the organization actually has rather than to generic best practice.
The deliverable includes a written report (executive summary, technical findings with reproduction steps, exploitation activities walk-through, findings matrix for tracking remediation), the underlying evidence the findings are drawn from, and a debrief call to walk findings and remediation with the client team. A letter of attestation confirming engagement completion is available on request, suitable for auditor or regulator interest.
Penetration testing does not make the organization secure. No single engagement does. What it produces is the kind of read on the technical attack surface that lets security and IT leadership make remediation decisions on evidence, justify spend or de-prioritization to executives on demonstrated risk rather than scanner output, and answer the question an auditor or board member is going to ask about whether the organization has been independently tested.
Findings frequently surface specific needs that justify a follow-on engagement: compliance audit work where regulatory exposure becomes clearer, executive tabletop work where the organizational response is in question, or strategic advisory work where the architecture itself is the constraint.
Who this fits, and who it doesn’t
This engagement fits organizations with regulatory exposure (HIPAA, GLBA, SOC 2, ABA cyber guidance, PCI DSS), organizations preparing for an auditor-mandated pentest requirement, organizations that have not been independently tested in twelve months or more, and organizations approaching the engagement with a clear scope already in mind and the operational maturity to act on findings.
This engagement does not fit organizations that have never run a vulnerability management program (basic hygiene needs to exist before penetration testing produces value), organizations seeking the cheapest scan they can find to satisfy an auditor checkbox (the commodity testing market serves that requirement better), or organizations that intend to file the report without remediating findings. Aegis & Spear declines engagements where the operating intent is to produce a deliverable rather than to improve security posture.
Talk to us
If you are considering a penetration test, reach out at contact@aegisandspear.com. Useful context in a first message: the attack surface in question (external, internal, wireless, physical, or a combination), the regulatory environment, the timeline driver (audit, contract, scheduled cadence, breach response), and a rough size of the in-scope environment. Response within two business days. The contact page covers initial outreach in more depth.