External vs Internal Penetration Testing

Modern cyber‑security assessments take two distinct perspectives: testing from outside your network and testing from inside. An external penetration test treats your organisation as a “black box” and simulates an adversary on the internet. An internal penetration test assumes the attacker has already breached your perimeter (through phishing, stolen credentials or insider collusion) and shows what they could do next. Both views are needed to understand your true risk.

What is an external penetration test?

External testing is carried out from outside your organisation's security perimeter and shows how your environment appears to attackers on the internet. The National Institute of Standards and Technology (NIST) explains that external tests begin with reconnaissance to collect publicly available information such as domain names, IP addresses and WHOIS records, then use discovery and scanning to identify exposed hosts and services. Because testers have no internal credentials, they must evade firewalls and intrusion‑detection systems like a real attacker.

Typical objectives of an external test include:

• Identifying exposed internet‑facing systems (web servers, VPN gateways, mail servers and remote access portals).
• Confirming that firewall and access‑control rules prevent unauthorised connections.
• Testing web applications for SQL injection, cross‑site scripting, authentication bypass and other common flaws.
• Attempting to exploit misconfigurations in remote access services or virtual private networks.
• Validating that security controls such as intrusion detection/prevention systems (IDS/IPS) detect malicious traffic.

What is an internal penetration test?

Internal testing assumes the identity of a trusted insider or an attacker who has already breached the perimeter. NIST notes that assessors are granted user‑level access to the internal network and attempt to gain additional privileges, focusing on system configuration, authentication, access controls and network segmentation. Unlike an external test, internal testers are behind the firewall, so they can use a wider range of tools and techniques to probe the local environment:contentReference.

An internal penetration test typically looks for:

• Weaknesses in local services and network shares, including unpatched software and default credentials.
• Opportunities to harvest and reuse credentials (e.g., pass‑the‑hash, credential dumping).
• Misconfigurations in Active Directory or other identity systems that allow privilege escalation.
• Lateral movement paths that could lead to sensitive systems (e.g., domain controllers or payment systems).
• Gaps in network segmentation that allow attackers to move from less sensitive systems to those handling critical data.

Key differences

The following points summarise how external and internal penetration tests differ:

• Starting point – External testers have no access and rely on publicly available information. Internal testers start with user‑level access to the network.
• Scope – External tests focus on internet‑facing systems such as web servers, email gateways and remote access services. Internal tests assess internal servers, workstations, databases, directory services and network segmentation.
• Objective – External testing reveals how well your perimeter prevents unauthorised entry. Internal testing reveals how far an attacker could go once inside and what data they could access.
• Techniques – External testers use reconnaissance, port scanning and application‑layer exploits, working through firewalls and IDS. Internal testers use credential harvesting tools, privilege‑escalation techniques and lateral movement to pivot through the network.
• Controls exercised – External tests validate firewall rules, patching of internet‑facing services and public‑facing application security. Internal tests validate internal hardening, patching, privilege management, segmentation and monitoring.

Why do you need both?

Relying solely on an external test leaves blind spots. An attacker who successfully phishes an employee or exploits a misconfiguration could bypass perimeter controls entirely. Internal testing reveals how quickly such an attacker could compromise sensitive systems. Some standards explicitly require both perspectives. For example, the PCI Security Standards Council's penetration testing guidance states that the cardholder data environment (CDE) perimeter and critical systems must be tested from both external and internal viewpoints at least annually and after significant changes. NIST also recommends performing external tests before internal tests to ensure assessors do not inadvertently gain insider knowledge that could bias the external assessment.

When to perform each test

• Compliance mandates – Frameworks such as PCI DSS require both internal and external penetration tests at least annually and whenever there are significant changes to the environment.
• Risk‑based triggers – Conduct external tests whenever you deploy new internet‑facing services or cloud infrastructure. Perform internal tests after major changes to internal systems, such as network redesigns, operating‑system upgrades or mergers.
• Combined assessments – Ideally, run an external test first and immediately follow with an internal test to capture the full attack chain. This sequence reflects NIST's recommendation to avoid giving testers internal insights before the perimeter is assessed.

Frequently asked questions

Do I need an internal test if we have strong perimeter defences?
Yes. Attackers often bypass perimeter defences through phishing, stolen credentials or compromised third‑party software. Internal testing shows how far they could go once inside.

Which is more expensive?
Internal tests usually cost more because they cover a broader scope—multiple hosts, domains and user groups. They also require more time for credential harvesting and privilege‑escalation attempts.

How do penetration tests differ from vulnerability scans?
Vulnerability scans automatically identify known flaws. Penetration tests actively exploit those flaws to demonstrate real‑world impact. They involve manual techniques and creative problem solving that automated scans cannot replicate.

How often should we perform external and internal tests?
At minimum, annually and after significant changes. Organisations with complex or rapidly changing environments may need quarterly or more frequent testing. See the separate guide on testing frequency for more detail.