.png){kind=small}
Vulnerability Assessment & Penetration Testing
Test applications, Active Directory, mobile and cloud alongside your network.
Network & Firewall Security Assessment
Know exactly what your network lets in, and what it should not.
ThreatGaurd reviews your firewall rules, network segmentation, VPN and perimeter exposure, then tests them the way an attacker would, so you can close risky paths without disrupting the business.
Why it matters
Firewall rules pile up. Risk quietly piles up with them.
Over the years, firewalls collect temporary rules, broad exceptions and access for projects that ended long ago. Networks also grow flatter as teams add cloud, remote access and new sites, until few people can say with confidence what can reach what.
A network and firewall security assessment answers that question with evidence, and gives you a clear plan to tighten rules and segmentation without breaking the services your business relies on.
-
Rules nobody can explain
Old, unused and overly broad rules leave doors open long after the reason for them has gone.
-
Flat networks let attackers move
Without effective segmentation, one compromised laptop or server can reach critical systems and data.
-
Remote access widens the perimeter
VPNs, remote desktop and third-party connections are frequent entry points when they are exposed or misconfigured.
Business outcomes
What a network and firewall assessment gives your business
-
A smaller attack surface
Close unnecessary ports, services and paths that are exposed to the internet.
-
Cleaner rule sets
Remove risky, redundant and unused rules, so firewalls are easier to manage and audit.
-
Contained incidents
Effective segmentation limits how far an attacker can move if one system is compromised.
-
Evidence that stands up
Reports are structured for auditors, customers and security questionnaires.
Testing scope
Assess every layer of your network, from the perimeter to the core.
Choose the areas that matter to you. Every engagement is scoped to your network, sites and change windows.
Firewall rule review
A line-by-line review of the rule sets on your perimeter and internal firewalls, measured against what the business actually needs.
What we check
- Overly permissive rules and broad port ranges
- Shadowed, redundant and unused rules
- Risky services allowed from the internet
- Rule ownership, documentation and change history
- Perimeter firewall Any-to-any rule on a legacy subnet Critical
- Data centre firewall Database port open to all internal users High
- Branch firewall Dozens of rules with no recent traffic Medium
Firewall and network device configuration review
Firewalls, routers, switches and wireless controllers, reviewed against vendor guidance and CIS Benchmarks.
What we check
- Administrative access, multi-factor and default accounts
- Firmware versions and known vulnerabilities
- Logging, alerting and time synchronisation
- Insecure management protocols such as Telnet and SNMPv1/v2c
- Edge router Outdated firmware with a known exploit Critical
- Firewall admin No multi-factor authentication High
- Core switch Telnet management enabled High
External network penetration testing
Everything reachable from the internet: public IP ranges, VPN gateways, mail servers and exposed services.
What we check
- Open ports and exposed services
- Vulnerable and end-of-life services
- Weak TLS and VPN configuration
- Forgotten hosts and test systems
- VPN gateway Unpatched remote-access appliance Critical
- Test server Admin panel reachable from the internet High
- Mail server Weak TLS configuration Medium
Network segmentation testing
Testing whether sensitive zones, such as payment, production, OT and management networks, are truly isolated.
What we check
- Reachability between user, server and sensitive zones
- PCI DSS cardholder data environment scope
- Management and backup network isolation
- VLAN and access-control list enforcement
- Payment network Reachable from office Wi-Fi Critical
- Backup network Open to all servers High
- Management VLAN Reachable from the guest network High
VPN and remote access review
How employees, administrators and third parties connect to your network, and what they can reach once connected.
What we check
- VPN configuration, encryption and authentication
- Multi-factor authentication for remote access
- Split tunnelling and access after connection
- Exposed remote desktop and admin services
- Remote desktop Exposed directly to the internet Critical
- Vendor VPN Full network access for a support vendor High
- VPN users Password-only login allowed High
Wireless network security testing
Corporate, guest and IoT wireless networks, and how they connect to the rest of your environment.
What we check
- Encryption and authentication settings
- Guest network isolation
- Rogue and unauthorised access points
- Wireless access to internal systems
- Guest Wi-Fi Can reach internal printers and servers High
- Warehouse Unauthorised access point found High
- Corporate Wi-Fi Shared password not rotated Medium
Methodology
Recognised methods, matched to your network.
We combine configuration analysis with live testing, and agree the right mix with you during scoping.
-
Configuration review
We analyse exported firewall and device configurations offline, with no traffic sent to your network.
Best for
Rule clean-up, audits and change-sensitive environments.
-
Most common
Review and testing
Configuration review combined with external and internal testing to confirm what is actually reachable.
Best for
Most organisations. Shows both what rules allow and what an attacker can reach.
-
Segmentation validation
Focused testing from each network zone to prove that sensitive environments are isolated.
Best for
PCI DSS scope, OT networks and regulated data.
Standards we follow
- CIS Benchmarks
- NIST SP 800-41
- NIST SP 800-115
- PCI DSS segmentation guidance
- Vendor hardening guides
- CVSS scoring
How it works
From scoping call to verified fix, in five steps.
-
01
Scope and collect
We agree devices, networks and testing windows, and collect configurations and network diagrams. An NDA is signed before any access.
-
02
Review rules and configuration
We analyse rule sets and device settings for risky, redundant and unused access.
-
03
Test what is reachable
We test from the internet and from inside agreed network zones to confirm what traffic actually gets through, without disrupting operations.
-
04
Report and walk through
You receive the reports, followed by a walkthrough with your network, security and leadership teams.
-
05
Retest and close
Once changes are made, we review and retest to confirm the risky paths are closed.
Deliverables
Clear findings for network teams, and a summary leaders can act on.
- Executive summary A short overview for leadership: overall risk, key issues and what to do next.
- Technical report Every finding with CVSS severity, evidence, affected devices and rules, and clear remediation steps.
- Rule clean-up plan Rules to remove, tighten or document, prioritised by risk and safe to apply in stages.
- Segmentation results A clear view of which zones can reach which, compared with your intended design.
- Retest report Confirms which issues are fixed, for your records and your auditors.
Overall risk
High → Low after retest
- Critical
- 2
- High
- 5
- Medium
- 9
- Low
- 7
Open findings
23before retest,4after retest
Fix first
Payment network reachable from office Wi-Fi
Owner: Network team · 7 days
Use cases
When organisations assess their network and firewalls
-
Before a PCI DSS assessment
Validate segmentation and the scope of your cardholder data environment ahead of the audit.
-
After mergers, new sites or network changes
Confirm that new connections have not opened unintended paths.
-
Firewall migration or consolidation
Clean up rule sets before moving them to a new platform.
-
Moving workloads to the cloud
Check that hybrid connections and cloud network controls match your policy.
-
Audit and certification evidence
Support evidence requirements for ISO 27001, SOC 2 and PCI DSS.
-
After a security incident
Confirm the attacker’s path is closed and look for related weaknesses.
Industries we work with
Why ThreatGaurd
Network assessments that improve security without breaking the business.
-
Rules reviewed in business context
We ask what each rule is for, not just whether it looks risky.
-
Safe, staged recommendations
Changes are prioritised so you can tighten access without breaking critical services.
-
Tested, not just reviewed
We confirm what is actually reachable, so you are not relying on configuration files alone.
-
Your data stays protected
NDA before access, configurations handled securely and deleted after the engagement.
Supports compliance evidence for
- ISO/IEC 27001
- SOC 2
- PCI DSS
- HIPAA
- GDPR
- India DPDP Act
Our reports support your compliance evidence. Certification and audit opinions are issued by your auditor or certification body.
How we handle your dataGuides & checklists
Preparing for a network assessment?
Practical checklists and articles to help you gather configurations, scope network zones and get the most from the report.
Related services
Go further after the assessment.
-
-
Endpoint & Infrastructure Security Assessment
Servers, endpoints and Active Directory, assessed together.
-
Security Configuration Hardening
Fix weak configurations against CIS Benchmarks.
-
Cloud Security Posture Assessment
Find misconfigurations across AWS, Azure and Google Cloud.
FAQ
Questions leaders ask about network and firewall assessments
Can’t find your answer? Our team is happy to help.
What is included in a network and firewall security assessment?
A review of firewall rules and network device configuration, combined with testing of your external perimeter, internal segmentation and remote access. The exact mix is agreed during scoping, based on your network and goals.
Which firewalls and network devices do you review?
We review configurations from widely used firewall, router, switch and wireless platforms. Tell us your vendors and versions during scoping and we will confirm the approach for each.
Will the assessment disrupt our network?
Configuration reviews are done offline, using exported configurations, so they send no traffic to your network. Live testing is planned with agreed windows and controlled techniques, and we stop and inform you immediately if anything unexpected happens.
Do you assess cloud network controls as well?
Yes. Security groups, network access control lists and cloud firewalls in AWS, Microsoft Azure and Google Cloud can be included alongside your on-premises network. For a full review of cloud configuration, see our Cloud Security Posture Assessment.
Can you test our PCI DSS segmentation?
Yes. We test whether systems outside your cardholder data environment can reach it, which supports the segmentation testing that PCI DSS requires. Your Qualified Security Assessor makes the final decision on scope.
What do you need from us to get started?
Exported firewall and device configurations, a current network diagram, the IP ranges and network zones in scope, and a technical contact. For internal testing we agree how we connect, for example through a virtual machine or VPN access you provide. We share a scope document and rules of engagement for sign-off before testing begins.
How long does a network and firewall assessment take?
Most engagements take 1 to 3 weeks, depending on the number of firewalls, rules, sites and network zones in scope.
How is the cost calculated?
Cost depends on the number of firewalls and devices, the size of the rule sets, the network zones in scope and whether live testing is included. After the scoping call you receive a fixed-scope proposal, so the cost is agreed before testing starts.
Will your report support ISO 27001, SOC 2 or PCI DSS?
Our reports are structured to support ISO 27001, SOC 2 and PCI DSS evidence, with an executive summary, detailed findings and retest results. The final audit opinion always rests with your auditor, so if a specific format or accreditation is required, tell us during scoping and we will confirm what we can provide.
Get started
Know what your network really allows.
Tell us what you want to test. We will come back with a clear scope and proposal, with no obligation.
What happens next
- A short scoping callWe learn your goals, environment and timelines.
- A fixed-scope proposalClear scope, approach, timeline and cost, in writing.
- Testing on your scheduleTesting starts on the agreed date, with regular updates.