External penetration tests aim to conduct a security assessment of your connected devices, generally those exposed on the internet. This includes, for example, your edge defense (e.g. firewalls), but also all the services with external access such as the mail system, web servers, gateways, etc. In most cases, our teams will conduct these penetration tests without being given any privileged access in order to replicate the behaviour of a potential attacker as closely as possible.
Internal penetration tests aim to ascertain the security of your information system and assess the impact of an internal attacker on this system. In this test, often called the "intern test", the auditor will most often be provided with access rights equivalent to those of an ordinary user. It is also possible that the auditor is given no entry point apart from an unauthenticated connection to the internal network, or, conversely, privileged access such as administrative rights.
For companies that wish to challenge their defense against a targeted attack in real operating conditions, immunIT also proposes "red team" type penetration tests. Unlike conventional penetration tests, the purpose of the audit won't be to uncover the highest possible number of vulnerabilities on the targeted systems, but to check if an intrusion is feasible by all technical and non-technical means available to an attacker. Due to the sensitive nature of this type of mission, we invite you to contact us for additional information.