A misconfigured firewall on a production VLAN, an ACL rule forgotten after a server migration, a still-active VPN access for a contractor who left six months ago: these blind spots turn a corporate network into a playground for an attacker. The network security audit serves to uncover them before an incident does it for you.
Network segmentation and allowed flows: the first point of friction
On paper, most companies have network segmentation. In practice, it is often observed that the filtering rules between zones have not been reviewed since commissioning. Temporary flows opened for a project become permanent due to forgetfulness.
Read also : Practical tips for organizing a stress-free move and successfully settling in
Before launching a vulnerability scan, we start by mapping the actually active flows between each segment. We then compare this snapshot to the theoretical diagram provided by the infrastructure team. The gap between the two reveals the first vulnerabilities: open ports without justification, unencrypted protocols passing between the office network and the DMZ, test machines accessible from the guest Wi-Fi.
This work of confrontation between the declared and the real is detailed in this guide on network security auditing, which describes the prioritization logic to apply once the discrepancies are identified.
Further reading : Essential Checks After a Battery Change on Your Peugeot 208
Feedback varies on this point depending on the size of the network, but a network of a few hundred workstations already generates enough flows for the exercise to take several days.
Inventory of network assets: why automated tools are not enough
A network scanner retrieves IP addresses, machine names, and exposed services. What it does not say: who owns this equipment, what its business role is, and who is responsible for it. Without this layer of information, we obtain a list, not an exploitable inventory.
The audit requires cross-referencing automatic discovery with interviews with IT and business teams. We particularly look for:
- Unmanaged devices (shadow IT): connected printers, IoT sensors, personal NAS devices plugged into the local network without validation from the IT department
- High-privilege service accounts whose exact usage and passwords are no longer known
- Interconnections with partners or suppliers, often configured via site-to-site VPN tunnels whose filtering rules on the remote side escape the company’s control
An unlisted asset is an unprotected asset. This is a simple rule, but it conditions the entire rest of the audit.
Vulnerability analysis and network penetration testing: two complementary approaches
The vulnerability scan identifies known flaws (published CVEs, outdated versions, default configurations). It is executed across the entire defined perimeter, scheduling intensive scans outside production hours to limit performance impact.
The penetration test goes further. An auditor attempts to exploit the detected vulnerabilities to measure the depth of access that can actually be achieved. The question is no longer “is this port open,” but “from this entry point, how far can we go into the information system”.
Specifically, we distinguish two approaches:
- The black box test, where the auditor has no prior information and simulates an external attacker
- The gray box test, where the auditor receives a standard user account to assess privilege escalation and lateral movement possibilities within the network
- The white box test, rarer, where the auditor has access to complete documentation and source code for an in-depth review
The scan detects vulnerabilities, the penetration test measures their real impact. Both are necessary to produce an audit report that goes beyond a simple list of fixes.
NIS2 compliance and detection capability: a now central audit criterion
The NIS2 directive requires affected entities to notify incidents to ANSSI within 24 hours. This constraint changes the very nature of the network audit. We no longer just check if systems are up to date: we assess whether the company can detect an intrusion, log it, and raise the alert within this timeframe.
The audit must therefore examine the complete detection chain: log collection (firewalls, servers, Active Directory directory), centralization in a SIEM or equivalent tool, active correlation rules, and formalized notification procedures. Without centralized logging, the 24-hour notification remains theoretical.
Regulatory compliance goes beyond NIS2. Depending on the sector, we also check alignment with GDPR for the processing of personal data passing over the network, or with standards like ISO 27001 if the company aims for certification.
From the audit report to the remediation plan: turning findings into actions
A report that lists vulnerabilities ranked by severity level (critical, high, medium, low) without operational prioritization ends up in a drawer. The useful deliverable is the one that prioritizes corrections based on the actual business risk, not just the CVSS score.
A critical flaw on an isolated server without sensitive data takes a backseat to a medium flaw on the Active Directory domain controller. Prioritization is based on business impact, not just the technical score.
The remediation plan specifies for each finding: the corrective action, the responsible party, the deadline, and the means of verification. It also includes tracking indicators (rate of applied fixes, MFA coverage, average detection time) to measure progress over time.
The one-time audit remains a snapshot. Companies that make the most of this exercise integrate it into a continuous cycle: evaluate, correct, monitor, reevaluate. This shift from annual control to a continuously managed posture is the underlying trend that separates reactive organizations from those that truly anticipate threats to their network.