.png){kind=small}
Network & Firewall Security Assessment
Firewall rules, segmentation and perimeter exposure.
Endpoint & Infrastructure Security Assessment
Stop one compromised laptop from becoming a company-wide breach.
ThreatGaurd assesses your servers, endpoints, Active Directory and security tooling the way an attacker inside your network would, then shows you how to close the paths that lead to your most critical systems.
Why it matters
Most serious breaches are decided inside the network.
Attackers rarely stop at the first machine they reach. A phished laptop, a weak service account or an unpatched server becomes a stepping stone towards Active Directory, backups and business-critical systems.
An endpoint and infrastructure security assessment shows how far an attacker could get from inside your environment today, and which fixes would stop them earliest.
-
Builds drift and patches slip
Servers and laptops move away from their secure baseline over time, leaving outdated software and weak settings behind.
-
Active Directory attack paths
Excessive privileges, old service accounts and misconfigurations can turn a normal user into a domain admin.
-
Security tools with blind spots
EDR, antivirus and logging that are missing, disabled or misconfigured on some systems let attackers move unseen.
Business outcomes
What the assessment gives your business
-
Attackers stopped earlier
Break the chain at the first steps, before a single device turns into a breach.
-
Stronger ransomware resilience
Protect Active Directory, backups and recovery paths that ransomware groups target.
-
Security tools that see
Know that EDR and logging cover your critical systems, with no silent gaps.
-
A clear fix order
Issues are ranked by business impact, so effort goes where it removes the most risk.
Attack path
How one compromised laptop becomes a full breach.
This pattern appears again and again in real incidents. Our assessment looks for every link in the chain, so you can break it as early as possible.
-
Step 1: Initial access
An employee laptop is compromised through phishing or a malicious download.
Where we break the chain
Endpoint hardening and EDR coverage
-
Step 2: Privilege escalation
Local admin rights, unpatched software or stored passwords give the attacker full control of the device.
Where we break the chain
Least privilege and patch levels
-
Step 3: Lateral movement
Reused credentials and open internal services let the attacker reach servers.
Where we break the chain
Credential hygiene and segmentation
-
Step 4: Domain takeover
An Active Directory weakness hands over control of the whole domain, including backups.
Where we break the chain
Active Directory security review
What we assess
Every layer an internal attacker would use.
We focus on the systems that decide how far an attack can spread. The exact scope is agreed with you during scoping.
-
Servers
Windows and Linux servers that run your business applications and data.
- Secure configuration against CIS Benchmarks
- Missing patches and end-of-life software
- Exposed services and weak local accounts
-
Employee endpoints
Laptops and desktops, the most common starting point for an attack.
- Local admin rights and application control
- Disk encryption, firewall and browser settings
- Stored credentials and insecure software
-
Active Directory and Entra ID
The identity core that controls access to almost everything.
- Privileged groups, delegation and service accounts
- Attack paths to domain and global admin
- Password, Kerberos and legacy protocol settings
-
EDR, antivirus and logging
The tools meant to detect an attacker, and whether they actually would.
- Agent coverage across all systems
- Policies that are disabled or in audit-only mode
- Logging and alert gaps for key events
-
Patch and vulnerability management
How quickly and consistently your teams close known weaknesses.
- Patch levels across operating systems and software
- Critical vulnerabilities left open past your target
- Systems missing from scanning and patching
-
Virtualisation and backups
The platforms attackers target to cause maximum damage, such as in ransomware attacks.
- Hypervisor and management console access
- Backup isolation and immutability
- Recovery credentials kept separate from the domain
Methodology
Choose the approach that answers your question.
We often combine approaches. The right mix is agreed with you during scoping.
-
Build and configuration review
We review representative servers and endpoints against CIS Benchmarks and your own standards.
Best for
Standard builds, golden images and audit preparation.
-
Most common
Assumed-breach testing
Starting from a standard employee laptop or account, we test how far an attacker could get.
Best for
Most organisations. Shows real attack paths, not just settings.
-
Active Directory review
A focused review of Active Directory and Entra ID configuration, privileges and attack paths.
Best for
Organisations where identity is the main concern.
Standards we follow
- CIS Benchmarks
- MITRE ATT&CK
- NIST SP 800-115
- NIST SP 800-123
- Microsoft security baselines
- CVSS scoring
How it works
From scoping call to verified fix, in five steps.
-
01
Scope and agree
We agree systems, sample size, testing windows and how we connect. An NDA is signed before any access.
-
02
Collect and review
We review configurations, patch levels and Active Directory, using read-only data collection where possible.
-
03
Test attack paths
From an agreed starting point, we test how an attacker could escalate and move, without disrupting operations.
-
04
Report and walk through
You receive the reports, followed by a walkthrough with your infrastructure, security and leadership teams.
-
05
Retest and close
Once fixes are made, we retest to confirm the attack paths are closed.
Deliverables
Findings your infrastructure team can act on, and leaders can understand.
- Executive summary A short overview for leadership: overall risk, key issues and what to do next.
- Technical report Every finding with CVSS severity, evidence, affected systems and step-by-step remediation.
- Attack path map How an attacker could move from a single device to your critical systems, and where to break the chain.
- Hardening and remediation plan Prioritised fixes for builds, patching, privileges and tooling, grouped so teams can apply them in stages.
- Retest report Confirms which issues are fixed, for your records and your auditors.
Overall risk
High → Low after retest
- Critical
- 3
- High
- 7
- Medium
- 12
- Low
- 8
Open findings
30before retest,5after retest
Fix first
Helpdesk group can reset domain admin passwords
Owner: Identity team · 2 days
Why ThreatGaurd
Assessments that make your infrastructure harder to attack.
-
Thinks like an internal attacker
We test real attack paths, not just individual settings.
-
Read-only where possible
Data collection and reviews are designed to avoid changes to your systems.
-
Fixes in a sensible order
Recommendations are grouped so teams can apply them safely, without disrupting users.
-
Your data stays protected
NDA before access, collected data handled securely and deleted after the engagement.
Supports compliance evidence for
- ISO/IEC 27001
- SOC 2
- PCI DSS
- HIPAA
- GDPR
- India DPDP Act
Our reports support your compliance evidence. Certification and audit opinions are issued by your auditor or certification body.
How we handle your dataRelated services
Go further after the assessment.
-
-
Security Configuration Hardening
Apply secure baselines across servers and endpoints.
-
IAM Security
Strengthen identity, single sign-on and privileged access.
-
Managed Vulnerability Management
Continuous scanning, triage and retesting between assessments.
FAQ
Questions leaders ask about endpoint and infrastructure assessments
Can’t find your answer? Our team is happy to help.
What does an endpoint and infrastructure assessment cover?
Servers, employee endpoints, Active Directory and Entra ID, security tooling such as EDR and logging, patch management, and virtualisation and backup platforms. The exact scope is agreed during scoping, based on your environment and concerns.
Do you need to test every server and laptop?
No. We usually review a representative sample of each build, plus all critical systems such as domain controllers and backup servers. Issues found on the sample show what is likely to repeat across similar systems.
What is assumed-breach testing?
We start from the position of an attacker who has already compromised a normal employee device or account, then test how far they could go. It shows the attack paths that matter most, without depending on a successful phishing attempt.
Will the assessment affect our users or systems?
Reviews use read-only data collection wherever possible. Testing is planned with agreed windows and controlled techniques, avoids actions that could disrupt users, and we stop and inform you immediately if anything unexpected happens.
Do you cover cloud-hosted servers and Microsoft Entra ID?
Yes. Servers in AWS, Microsoft Azure or Google Cloud can be included, and Entra ID can be reviewed alongside on-premises Active Directory. For cloud platform configuration itself, see our Cloud Security Posture Assessment.
What do you need from us to get started?
A list of the systems and builds in scope, a standard user account and device or virtual machine for assumed-breach testing, read-only access for configuration reviews, and a technical contact. We share a scope document and rules of engagement for sign-off before work begins.
How long does the assessment take?
Most engagements take 1 to 3 weeks, depending on the number of systems, builds and domains in scope.
How is the cost calculated?
Cost depends on the number of systems and builds, the size of your Active Directory environment and the approaches included. After the scoping call you receive a fixed-scope proposal, so the cost is agreed before work starts.
Will your report support ISO 27001, SOC 2 or PCI DSS?
Our reports are structured to support ISO 27001, SOC 2 and PCI DSS evidence, with an executive summary, detailed findings and retest results. The final audit opinion always rests with your auditor, so if a specific format or accreditation is required, tell us during scoping and we will confirm what we can provide.
Get started
Find out how far an attacker could get inside your network.
Tell us what you want to test. We will come back with a clear scope and proposal, with no obligation.
What happens next
- A short scoping callWe learn your goals, environment and timelines.
- A fixed-scope proposalClear scope, approach, timeline and cost, in writing.
- Testing on your scheduleTesting starts on the agreed date, with regular updates.