The directory is the target
Almost every internal compromise ends in the same place. The phishing email, the exposed VPN, the compromised contractor laptop — each is a way in, and what the attacker does next is go after Active Directory, because whoever controls the directory controls everything joined to it.
Most directories were not designed to be attacked. They grew. Service accounts were created for systems long since retired, groups were nested for convenience, and permissions were granted to fix a problem on a Friday afternoon and never taken back. None of it looks dangerous on its own, and that is exactly why it survives.
What we assess
We start as a normal domain user and ask the question an attacker asks: what does this account let me reach, and how many steps is it to domain admin?
Attack paths to privilege
We map the relationships between users, groups, computers, and permissions to find every route from ordinary access to privileged control — not just the first one that works. A path that runs through four forgotten group memberships is still a path.
Credentials and Kerberos
Service accounts with weak or never-rotated passwords, accounts that can be attacked offline without ever touching their owner, credentials left in Group Policy, scripts, and shares, and the places privileged accounts log in where their credentials can be harvested.
Delegation and permissions
Unconstrained and misconfigured delegation, object permissions that let one account take over another, and administrative rights that were granted widely because it was easier than granting them precisely.
Certificate services
Active Directory Certificate Services is a well-documented route to domain compromise, and often the least reviewed part of the directory. We check certificate templates and enrollment permissions for the misconfigurations that let a user request a certificate as somebody else.
Hygiene and structure
Stale and dormant accounts, privileged group membership, password policy, legacy protocols that are still enabled, and whether administrative tiers actually separate the accounts that run the domain from the workstations that browse the web.
Where it sits alongside testing
An internal penetration test answers how far an attacker gets across your network, and the directory is usually part of that story. This assessment is the deeper version of one chapter: it trades breadth across the network for depth in the system that decides who can do what.
If the question is whether your team would notice an attacker doing this, that is a red team engagement.
What you receive
A report that shows each attack path step by step, ranked by how easily it can be walked and what it reaches, with the specific change that breaks each link. Where one fix closes several paths at once, we say so, because that is usually where remediation effort should go first. A debrief walks your team through the findings, and once you have remediated, we retest to confirm the paths are gone.