Internal vs External Penetration Testing: Differences and When You Need Each

External penetration testing attacks your internet-facing systems from outside, the way an anonymous attacker would. Internal penetration testing starts inside your network, the way a phished employee or a rogue device would, and measures how far an attacker can move. External testing asks “can someone get in?” Internal testing asks “what happens when they do?” Most organisations need both internal and external penetration testing, at least once a year.

This guide explains each test and what it typically finds, then helps you decide which to run first.

Key takeaways

• External testing targets the perimeter; internal testing assumes a breach and targets lateral movement and privilege escalation.
• Many breaches start with a stolen credential or phished user, so internal testing covers a very likely attack path.
• PCI DSS v4.0.1 requires both: internal under 11.4.2 and external under 11.4.3.
• External tests are scoped by live IPs and domains; internal tests by sites, subnets and Active Directory size.
• Run both together as one infrastructure test where you can. It is usually more efficient.

Internal vs external penetration testing: what is the difference?

The difference is the starting point. An external tester begins on the internet with no access; an internal tester begins on your network, often with a standard user account. That changes the targets, the techniques and what the results tell you, as the comparison table at the top of this guide shows. In short, external vs internal penetration testing is perimeter versus “assumed breach”: one proves whether the door is locked, the other what an intruder could reach once inside.

What is external penetration testing?

External penetration testing is an authorised attack on everything you expose to the internet. The tester builds a picture of your footprint from public sources such as DNS records, certificate transparency logs and search engines, then probes each service for weaknesses and attempts safe exploitation to prove impact.

For most organisations the perimeter is no longer one firewall. It includes cloud workloads, VPNs and remote desktop gateways, single sign-on portals, customer APIs, marketing sites hosted by third parties, and old test servers nobody remembers. Forgotten assets are often the easiest way in, so discovery is a real part of the test.

What is internal penetration testing?

Internal penetration testing is an “assumed breach” test. It starts from the position of someone who has already got past the perimeter and tries to reach the systems and data that matter most: domain controllers, finance systems, customer databases and backups.

In most Windows estates the route runs through Active Directory. Legacy name-resolution protocols, weak service account passwords and over-generous permissions can take a tester from a standard account to domain administrator. Our guide to Active Directory penetration testing walks through the common attack paths and fixes.

What does each test typically find?

External tests commonly find:

• Remote access portals and VPN gateways missing security updates.
• Administration interfaces exposed to the internet.
• Default or reused credentials on forgotten services.
• Weak TLS configuration and expired certificates.
• Subdomains pointing at decommissioned cloud resources.
• Application flaws on customer-facing sites and APIs.

Internal tests commonly find:

• LLMNR and NBT-NS enabled, allowing password hashes to be captured.
• Service accounts with weak passwords that never change.
• The same local administrator password on many machines.
• Passwords in scripts, file shares and group policy.
• Flat networks where user devices can reach servers and management interfaces.
• Monitoring that does not notice the tester’s activity.

Do you need internal or external penetration testing?

You need both eventually. What differs is which comes first and how often each is repeated.

If budget allows only one test this year, think about your likeliest attack. For many organisations that is a phished user, which makes internal testing the more revealing of the two. If your perimeter has never been tested, or you have just exposed something new, test the outside first.

What does PCI DSS require?

PCI DSS v4.0.1 requires both tests at least once every 12 months and after any significant infrastructure or application change. Internal testing sits under Requirement 11.4.2 and external under 11.4.3, both following a documented methodology (11.4.1). Exploitable vulnerabilities must be corrected and retested (11.4.4).

If you use segmentation to reduce scope, it must be tested at least every 12 months under 11.4.5, and every six months for service providers under 11.4.6. Our PCI DSS penetration testing service scopes all three together, including segmentation testing of the boundaries around the cardholder data environment.

External penetration testing is separate from the quarterly external vulnerability scans in Requirement 11.3.2, which must be performed by a PCI SSC Approved Scanning Vendor. A passing ASV scan does not replace a penetration test, and the reverse is also true.

What about Cyber Essentials Plus and ISO 27001?

Cyber Essentials Plus includes an external vulnerability scan and internal checks of a sample of devices by the certification body. It is a useful baseline, but it is not a penetration test and does not attempt exploitation or lateral movement.

ISO/IEC 27001:2022 does not name either test, but Annex A control 8.8 expects you to identify and manage technical vulnerabilities. Auditors commonly accept annual internal and external tests as evidence. Our page on ISO 27001 penetration testing explains what auditors look for.

How do internal and external tests differ in cost?

External tests are usually quicker and cheaper for the same organisation, because the attack surface is smaller. Internal tests take longer because there is more to explore once inside. In published prices from UK providers we reviewed in September 2026, fixed-scope external network tests ran from £550 for 1 to 5 IPs to £3,500 for 50+ IPs, and internal network tests started at about £1,800.

The drivers differ:

• External: number of live IPs, exposed services, web applications and whether authenticated testing is needed.
• Internal: number of sites and subnets, Active Directory size, whether segmentation testing is included, and remote or on-site delivery.

Our guide to penetration testing cost sets out typical ranges for every test type.

Should you test both together?

Yes, where you can. Testing internal and external infrastructure in one engagement shares scoping, rules of engagement, reporting and retesting, and shows complete attack chains, from an exposed service on the perimeter through to domain compromise. This combined engagement is often called infrastructure penetration testing.

If your systems are mostly cloud-hosted, add a cloud configuration review, because many “internal” attack paths now run through identities rather than networks.

Why Sovereign Secure

Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified. When we test, we write the report with the assessor’s evidence requirements in mind, so the same test can support PCI DSS, ISO 27001 and customer assurance.

Next step

Tell us which systems you want tested and why. Our penetration testing quote form collects the few details we need, such as live IPs, sites and Active Directory size, to price internal and external testing together or separately.