Since most protocols are well-defined and have standard modes of interaction, network-layer testing is more suitable for automated testing. This makes automation the first logical step in a network-layer test. Because of such standardization, tools may be used to quickly identify a service, a software’s version, test for common misconfigurations, and even identify vulnerabilities. Automated tests can be performed much faster than could be expected of a human.

However, simply running automated tools does not satisfy a pentest needs. They cannot interpret vulnerabilities, misconfigurations, or even the services exposed to assess the true risk to the environment. They only serve as a baseline indication of the potential attack surface of the environment. Therefore, using the documentation provided by the organization during the pre-engagement, we should verify that only authorized services are exposed at the designated perimeter, and attempt to bypass authentication controls from all network segments where authorized users access the segmented network, as well as segments not authorized to access the internal environment.