If One Laptop on Your Network Were Compromised Tomorrow, How Far Could It Get?

You’ve spent years hardening the perimeter, and it worked. In 83% of the external penetration tests we ran last year, our testers got nothing: no password, no hash, no foothold. MFA on every login, a small attack surface, patches applied. That’s a real achievement and you should take credit for it.

But an external test only tells you whether an attacker can get in. It says nothing about what happens after one person clicks a phishing email, a contractor plugs into a conference-room port, or somebody’s personal laptop joins the wireless. One of those happens in just about every organization, every year.

We know, because we start every internal test exactly there: a device on the network and no credentials. In 43% of those tests our testers took control of the domain, which means every account and every computer in it. In 57% they reached a crown jewel, the data or system the client said mattered most. They came away with nothing in 6%.

Do unpatched systems cause most domain takeovers?

No. In 88% of the domain takeovers our testers pulled off, they didn’t leverage a missing patch at all. Unpatched software is the finding we report most often, because it’s what a scanner is built to find, but our testers actually used one to move toward a takeover in only 5% of internal tests. What actually enabled our testers to take the domain was a different list: weak domain passwords (23% of tests), logins our testers captured and relayed to servers that didn’t require signing (19%), decades-old broadcast protocols answering a question nobody should answer (18%), and certificate services nobody had reviewed since they were set up for the VPN (16%, and our testers exploited them 93% of the time we found them).

In one takeover out of four, our testers got there by cracking a single password, and they captured that password through broadcast protocol poisoning. Here’s how it works. When a Windows computer can’t find a server by name, it asks the whole local network, and it trusts whoever answers. Our testers answer. The computer then tries to log in to them, and that login attempt carries a hashed form of the user’s password. The testers take the hash offline and crack it; a weak password falls in minutes.

Why didn't my vulnerability scanner catch this?

It did, partly — but it underrated the risk. Scanners flagged the missing signing requirement in 76% of the tests they scanned, and rated it Medium. They noted the broadcast protocols in nearly half, as “informational.” They rated a default SNMP string, which our testers used to move toward a takeover in only 1% of tests, as a weakness in most of those same reports. If you fix findings in scanner order, you’ll spend most of your effort on things that rarely got our testers anywhere.

Five changes stop 94% of takeovers

None of these changes requires that you buy a new software license or tool. (The percentage is the share of takeovers each change would have stopped on its own.)

• A strong password policy, with existing passwords changed to meet it (53%)
• Turn off the legacy broadcast protocols: LLMNR, NetBIOS, mDNS and WPAD, and block rogue IPv6 (50%)
• Require signed connections for SMB and LDAP, with Extended Protection on the certificate service (44%)
• Harden the certificate services configuration (38%)
• Unique local administrator passwords, with admin accounts kept off everyday machines (21%)

Two of them alone, signing and the legacy protocols, stop 74%. Every one is a Group Policy or configuration change with an owner on your team.

What should every IT leader do this month?

Make the two changes that are yours alone, then measure. The password policy change and the Group Policy change need no budget. Then track a different number than open criticals: how far an internal test gets, starting from one device on your network. If you have never had an internal test, or your last one started with credentials handed to the tester, you don’t know that number yet.

Download Patched and Still Breached, LMG Security’s 2026 Penetration Testing Report, and join the Nov 12 webinar with Tom Pohl. If you’d like help putting the five changes in place, or want to see how far a tester could get in your environment, contact us about a penetration test.

Questions people ask

How often does an internal penetration test reach Domain Admin?
In our 2025 data, our testers took control of the domain in 43% of internal tests and reached a crown jewel in 57%, starting from a single device on the network with no credentials. Only 6% came away with nothing.

What is the difference between an internal and an external penetration test?
An external test starts on the Internet and measures what an attacker can do with what you expose; in 83% of ours the tester gained no access. An internal test starts from a device already on the network and measures what an attacker can do after one phishing click or one reused password.

Is patching still worth it if it rarely stops domain takeovers?
Yes. Patching and perimeter hardening are why the perimeter held, and our testers still exploited a software vulnerability in 12% of takeovers. The report argues for adding identity and configuration work, not for doing less patching.