The latest penetration tests reveal that even the most mature and technologically advanced organisations harbour vulnerabilities that attackers can exploit within just a few hours and gain access to the internal network. Weak passwords, outdated protocols, and social engineering remain among the most common entry points. In the era when cloud technologies and digital supply chains are rapidly expanding the attack surface and opening new opportunities for network intrusion, regular security testing is a proven path to cyber resilience.
Why Is Internal Network Security So Critical?
We tend to take the security of our internal network for granted—until a security incident occurs. Companies invest in security solutions and implement recommended security controls, yet they often discover their actual level of cybersecurity and resilience only after conducting a penetration test or cyber exercise. The results of penetration tests and cyber drills show that even technologically advanced organisations are not immune to gaining and abusing administrative access or stealing sensitive data.
The Role of Management in Cybersecurity
Modern frameworks and standards such as NIST and ISO/IEC 27001 emphasise that managing security is the responsibility of management, and not just the cybersecurity department. The new Information Security Act (ZInfV-1), which incorporates the provisions of the NIS2 Directive into Slovenian law, expands the range of organisations that must ensure a high level of security measures. It also requires organisations to recognise themselves as obligated entities under the law. This highlights the importance of being aware of one’s own security posture and its impact on other organisations. The management must ensure that security policies are not just a pile of documents but living practices embedded in daily operations—practices that will stand up even during an inspection. How an organisation approaches cybersecurity management largely depends on its IT management history and security maturity.
How to Recognise a Mature Organisation
Cybersecurity maturity means that a company:
- Follows and implements security controls from frameworks such as NIST, CIS, and ISO/IEC 27001.
- Has management support that sets an example and fosters a security culture.
- Integrates security into all business processes.
- Regularly tests the effectiveness of security controls through security assessments and implements improvements based on recommendations.
Mature companies detect attacks faster, limit damage more effectively, and recover more quickly after an incident. While perfect protection does not exist, resilience and response speed significantly reduce the consequences of incidents.
IT Infrastructure and Security Risks
Risks that an organisation is facing are inevitably associated with the history of IT system management in an organisation and the concept of its infrastructure:
- Older systems often rely on outdated protocols and applications requiring special security measures. More infrastructure is implemented on-premises, which demands more internal IT team activity and consequently greater investment in reliable professionals.
- Younger companies tend to use more cloud services. Cloud services have fewer protocol-related vulnerabilities, update automatically, and require less internal management. However, cloud technologies introduce new risks, such as misconfigurations and potentially weaker oversight.
- Hybrid environments, which can offer organisations greater flexibility, combine the challenges of on-premises and cloud solutions. These environments require advanced integration and are often very demanding to maintain.
Cloud platforms such as Microsoft Entra ID and M365 facilitate easier upgrades but require new skills and adjustments to security strategies.
Social Engineering – The Most Common Entry Point
Organisations usually invest generously in perimeter security, as it is the prime entry point for attackers. Unfortunately, technical defences are powerless when an employee opens the door to an attacker. Social engineering remains one of the most effective methods of gaining unauthorised network access. Here, the informational generosity of the internet, the social network connections, and the lack of awareness of individual users enable increasingly sophisticated attack techniques. By gathering publicly available information about employees and the organisation—such as hierarchy, social connections, and interests—attackers can craft convincing scams to gain access to internal or cloud systems.
Common Vulnerabilities in Internal Networks
Once an attacker gains access to the internal network, security measures within the network become crucial. Unfortunately, penetration test results often show vulnerabilities that hackers would expect to be remediated long before:
- Use of outdated protocols
- Weak or reused passwords
- Unpatched systems
- Outdated operating systems, etc.
Most companies still fail the so-called black-box tests, where an attacker gains privileged access with no prior information.
Regular Security Testing as a Part of the Cybersecurity Strategy
Penetration tests and cyber exercises help identify vulnerabilities and set priorities for remediation. It is essential that penetration tests or cyber drills reports are not just another pile of documents in the folder, but are used by the team to implement improvements. Best practice after testing includes a joint meeting of internal and external experts (e.g., SOC providers) to develop an improvement action plan. When introducing new measures, organisations can also consult experienced ethical hackers for insights from “the other side”.
Testing should not be a one-time project. Cybersecurity management is a continuous process based on the “plan-do-check-act” principle. The security improvement cycle never ends because information systems and their components are constantly evolving.
From Vulnerability to Resilience
Vulnerabilities discovered in security tests should be considered opportunities for improvement. It is therefore essential that information security managers present test results to the IT team as a springboard for strengthening system security—and thus for boosting cyber resilience—not as a “wall of shame”.
Experience from over 100 security tests conducted in the past two years confirms that strong cybersecurity requires:
- Employee education on threat recognition. The most effective approach combines regular phishing and other social engineering simulations, accompanied by workshops that review both theoretical guidelines and test results.
- Advanced security solutions, integrated wisely into the IT environment, with operations and results monitored by skilled personnel. Solutions must be explicitly configured for each environment to deliver the expected protection.
- Collaboration with external experts who provide essential support to internal teams. Just as households typically don’t have their own auto mechanic or chimney sweep, organisations usually cannot cover all cybersecurity service and knowledge needs with internal staff alone. Specialised outsourced professionals bring the latest expertise and ensure that cybersecurity management is as effective as possible.
Such an approach enables organisations to strengthen their cyber resilience steadily and successfully defend against cyberattacks.
The most common vulnerabilities in internal networks will be presented at the NT 2025 Conference through real-life examples by Grega Prešeren and Andrej Gornik. Follow us on LinkedIn to stay updated on the presentation.
