Identity, Security & Compliance
Penetration testing services.
Where breaches actually spread.
Our penetration testing services look at how an attacker would move once inside: the internal network, Active Directory, Microsoft 365 and Entra ID, and what you expose to the internet. Always authorized in writing. Findings in plain English, a fix list in order, and a retest to prove it.
Penetration testing from Pro IT NW, a Seattle-based security and Microsoft consultancy, is an authorized test of how an attacker could get in and move through your environment. It covers the internal network, Active Directory, Microsoft 365 and Entra ID, and external exposure, for mid-sized organizations and their IT teams. Every test is signed off in writing first. It is not a compliance certificate, and no test promises you won't be breached.
Scope
What does a penetration test from Pro IT NW cover?
We test the four places where an intrusion in a mid-sized organization can turn into a serious incident. You choose which are in scope.
01
Internal network
Starting from an ordinary workstation or user account, the way an attacker would after one phished password: what can be reached, which systems trust each other, where shared or reused admin passwords open the next door, and whether network separation holds.
02
Active Directory attack paths
The routes from one account to control of the domain. This is the same work as the attack-path and hybrid tiers of our Active Directory security assessment, which also offers a read-only health audit if you are not ready for active testing.
03
Microsoft 365 and Entra ID
Privileged roles and standing admin access, Conditional Access gaps and the accounts it misses, high-privilege app consents, and the paths that cross between on-premises Active Directory and the cloud through the sync server.
04
External exposure
What the internet can see: remote access, exposed admin portals, forgotten services and old systems still answering, tested against the addresses and names you list in the signed scope.
How does an authorized penetration test run?
Every test follows the same order, and nothing is touched until the paperwork is signed.
- Scope. We agree in writing what is in scope, what is out, and which accounts we start from.
- Rules of engagement. Testing windows, stop conditions, what we will not do, and emergency contacts on both sides. Signed by someone with authority over the systems before any testing.
- Testing. Inside the agreed windows, without destructive actions, coordinated with whoever runs your environment. If anything behaves unexpectedly, we stop and call.
- Findings. Each one explained in plain English with proof of what was possible, ranked by what to fix first.
- Fixes. The complete findings are handed over to you. Your team or any provider you choose can make the fixes, or we can, as labor, if you ask us to.
- Retest. We re-run the tests and show which findings are closed.
What do you get at the end?
You get evidence you can act on, written for two readers.
- A one-page plain-English summary for the owner, CFO or board
- A technical report for your IT team, with proof for each finding
- A prioritized fix list: what to do first, and why
- A retest after the fixes, showing what is closed and what is still open
- The raw results, in your hands, so you can review or repeat the work yourself
What is a penetration test not?
A penetration test is a point-in-time check of an agreed scope, nothing more.
- Not a compliance certificate or an audit opinion
- Not a promise that you will never be breached
- Not legal advice: this is technical and operational work
- Not testing anything outside the signed scope, ever
- Not a sales pitch: we resell nothing, so the fix list recommends what you need, not what carries a margin
Who is penetration testing for?
It is for organizations that want to know how far one compromised account would really get. That is often an owner or practice manager asking whether the IT is actually secure, a CFO facing an insurance renewal questionnaire, or an IT manager who wants independent proof before asking for budget. You don't need to know the technical terms to ask: tell us what worries you and we'll suggest a scope. The work is senior-led, labor-only and vendor-neutral, and delivered across the US from Seattle.
Related: Active Directory security assessment · Entra ID and hybrid identity · Virtual CISO · Identity, Security & Compliance
FAQ
Common questions about penetration testing.
What do your penetration testing services cover?
Pro IT NW penetration testing focuses on where breaches in mid-sized organizations actually spread: the internal network, Active Directory attack paths, Microsoft 365 and Entra ID configuration, and what you expose to the internet. Every test runs under a written scope and rules of engagement that you sign before any testing starts. You get findings in plain English with proof, a prioritized fix list, and a retest after the fixes.
Do you ever test without written permission?
No. Nothing is tested until a written scope and rules of engagement are signed by someone with authority over the systems. That document names the systems and accounts in scope, what is out of scope, the testing windows, the stop conditions, and the emergency contacts on both sides. If something is not in the signed scope, we do not touch it.
Is penetration testing safe to run in production?
It is planned to be. We test inside agreed windows, avoid destructive actions, coordinate with whoever runs your environment, and stop and call your emergency contact if anything behaves unexpectedly. If you would rather not test actively at all, a read-only Active Directory health audit is the lower-risk starting point.
How is this different from your Active Directory security assessment?
The Active Directory security assessment is the deep version of one part of a penetration test. Its attack-path and hybrid tiers test the routes from an ordinary account to control of the domain and into Entra ID and Microsoft 365. A penetration test can include that work and also covers the wider internal network and your internet-facing exposure. We scope whichever one matches the question you are asking.
Will a penetration test make us compliant or prevent a breach?
No. A penetration test is a point-in-time technical test of the scope you agreed. It is not a certification, an audit opinion or legal advice, and no test can promise you will never be breached. What it gives you is evidence of which weaknesses are real today, in what order to fix them, and proof after the retest that the fixes worked.
Can you fix what you find?
Yes, if you ask us to. The findings are yours in full whether or not we do the fixes: we never hold anything back to win the remediation work. You can hand the fix list to your own IT team or any provider you choose. We would be glad to do the work, as labor in a safe order through your change process, and either way we can retest afterwards to show what is closed.
How is it priced?
It is scoped on a call. The work depends on how many sites, systems, domains and internet-facing services are in scope, and whether Microsoft 365 is included, so we agree a fixed scope in writing before anything starts.
Free checks
Not ready to talk yet? Start with one of these.
10 questions
Could you take back the keys?
Ten yes / no questions: could you remove your IT provider's access without their help and keep control? Admin accounts, domain, licenses, backups, contract dates.
Open →
Runs in your browser
Who controls your domain?
See who runs your domain's DNS, where your email goes, whether you publish DMARC, and whether on-prem Exchange is still visible. Nothing stored.
Open →
Sample report
See a Copilot readiness report
A sanitized sample assessment: findings scorecard, readiness ratings and remediation roadmap, so you can see what you would get.
Open →
Find out how far one compromised account would get.
Tell us what you want tested and what prompted the question: an insurance renewal, a board ask, or just not knowing. We'll come back with a written scope before anything is tested.