External penetration testing assesses internet-facing systems from outside — the perimeter, public apps and exposed services — answering "what can an attacker reach from the internet?" Internal penetration testing assesses what an attacker could do once inside, modelling an insider or compromised device: lateral movement, privilege escalation, and the route to sensitive data. They test different threats, and most organisations need both — the external test checks the front door, the internal test checks the blast radius if it's bypassed. PCI DSS explicitly requires both. This is the perspective axis of a penetration test, delivered through our network testing service.
// 01 Two perspectives, two threats
The internal/external split is about where the tester starts, and each models a genuinely different threat. External testing starts on the public internet with no access, exactly like an anonymous attacker scanning your perimeter. Internal testing starts inside the network — on a segment, or with a low-privilege user — modelling what happens after an attacker gains a foothold through phishing, a stolen device, or a compromised supplier. One measures your exposure; the other measures your resilience once exposed.
| External | Internal | |
|---|---|---|
| Starting point | The public internet | Inside the network |
| Models | Anonymous outside attacker | Insider / post-breach attacker |
| Answers | What can an outsider reach? | What's the blast radius inside? |
| Finds | Exposed services, weak public auth | Lateral movement, privilege escalation |
// 02 External penetration testing
An external test establishes what an attacker can achieve against your perimeter before gaining any internal access. It targets everything reachable from the internet: web and API endpoints, VPNs, mail and remote-access services, exposed admin interfaces, and cloud-facing assets. Typical findings are exposed or misconfigured services, unpatched internet-facing systems, weak authentication on public applications, and leaked credentials. If you only ever run one test, an external one is the usual starting point — it maps the surface an opportunistic attacker sees first.
// 03 Internal penetration testing
An internal test answers the question the external test can't: if an attacker gets inside, how far do they get? Starting from a network foothold or a standard user account, the tester models the post-breach phase — and this is where the well-worn Active Directory attack paths surface almost every time: name-resolution poisoning and relay, Kerberoasting, weak segmentation, over-privileged accounts, credential reuse, and the chain to domain admin. Because most real breaches don't stop at the perimeter, the internal test is often where the genuinely alarming findings live — the ones that turn a single phished laptop into a full compromise.
// 04 Why most organisations need both
Testing only the perimeter tells you whether the front door is locked, but nothing about what's behind it if the door is bypassed — and attackers bypass front doors routinely, via phishing and stolen credentials. Testing only internally tells you the blast radius but ignores how an attacker gets in. Together they cover the whole kill chain: external for the way in, internal for what follows. This is also why PCI DSS v4.0 (requirement 11.4) explicitly mandates both internal and external penetration testing — the standard recognises they are not interchangeable.
// 05 How to scope it
A common, cost-effective pattern is an annual combined engagement: external testing of the perimeter and public applications, plus internal testing of the corporate network and Active Directory, delivered together with one report. Higher-risk or larger organisations run them more often or split them. Perspective is only one of the three axes — combine it with target (network, web, cloud) and knowledge level to define the full engagement. Our network penetration testing service covers both perspectives; use the cadence guide to plan the schedule.
// 06 Frequently asked questions
Internal vs external penetration testing?
External assesses internet-facing systems from outside (perimeter, public apps, exposed services) — "what can an outsider reach?". Internal assesses what an attacker could do once inside (lateral movement, privilege escalation) — the post-breach blast radius. Different threats, different questions.
Do you need both?
Most organisations do. External checks the front door; internal checks what happens if it's bypassed via phishing, a stolen laptop or supply-chain compromise. Real breaches involve both stages, and PCI DSS explicitly requires both.
What does an external test find?
Exposed and misconfigured services, unpatched internet-facing systems, weak public authentication, exposed admin interfaces, leaked credentials, and internet-reachable web/API flaws — what an anonymous attacker could achieve against the perimeter.
What does an internal test find?
Post-foothold paths: Active Directory weaknesses, weak segmentation, over-privileged accounts, credential reuse, and lateral-movement routes to sensitive data. The recurring AD attack paths ending in domain admin usually surface here.
// 07 Related reading
- Active Directory attack paths — what internal tests almost always find.
- The types of penetration testing and black/gray/white box.
- PCI DSS 11.4 — requires both internal and external testing.