External vs. Internal Penetration Test

External Penetration Test

An external penetration test simulates an attack originating from the internet from the perspective of an attacker with no prior access to the organization's internal systems. The assessment focuses exclusively on the publicly exposed attack surface — web applications, mail systems, public services, DNS, cloud endpoints, and network interfaces.

Typical test phases include:

• Reconnaissance – gathering information about domains, subdomains, IP ranges, technologies, and publicly available information (OSINT)
• Enumeration and vulnerability discovery – identifying and prioritizing exposed services, APIs, and applications
• Exploitation – attempting to gain initial access, bypass security controls, or escalate privileges on exposed systems
• Post-exploitation – assessing the value of an initial foothold, e.g., whether critical systems are reachable from it

The objective is to identify vulnerabilities in the external attack surface and to evaluate the effectiveness of security controls such as firewalls, gateways, web application firewalls, MFA, and access restrictions. Typical findings include vulnerable web applications (injection, broken access control), exposed services (e.g., unencrypted RDP or database endpoints), misconfigured DNS or mail settings, weak TLS configurations, and information disclosure through public interfaces.

An external test requires comparatively little cooperation from the client: typically only a defined scope (domains, IP ranges) and a communication channel for coordination.

Internal Penetration Test

An internal penetration test assumes that an attacker already holds a foothold within the environment — for example through a compromised employee account, a successful phishing attack, an implanted malware, or physical access. The goal is to determine how far an attacker can advance from this starting point: which systems are reachable, where privileges can be escalated, and which business-critical assets can be compromised.

Typical test areas include:

• Lateral movement across the network via SMB, RDP, VPNs, or shared file systems
• Privilege escalation at the local and domain level, including Active Directory attacks
• Credential harvesting (e.g., Kerberoasting, Pass-the-Hash, session token theft)
• Access to critical assets such as database servers, file servers, management systems, or cloud identities

Common weaknesses include insufficient network segmentation, weak authentication mechanisms (e.g., reused local admin passwords, missing MFA), outdated local administrator accounts, misconfigured group policies, and over-privileged service accounts.

Compared to external tests, an internal test requires significantly more cooperation: a defined test window, test accounts, network access, and usually an agreed "crown jewel" target (e.g., a specific file, server, or data sample) to validate reachability of business-critical assets.

Comparison at a Glance

When to Choose Which

• External only is sufficient for a baseline assessment of the public attack surface, for example for a first security test or to fulfill a regulatory requirement.
• Internal only makes sense when the perimeter is already well protected and the organization wants to understand the impact of a successful compromise — for example after a phishing incident or for cyber-insurance due diligence.
• Combining both delivers the most realistic picture: the external test identifies how an attacker gets in, the internal test shows what they can achieve afterwards. Many engagements combine both, e.g., an external foothold followed by an internal simulation.

Summary

External and internal penetration tests address different attack scenarios and complement each other. External tests evaluate perimeter protection and the public attack surface; internal tests evaluate the potential impact of a successful initial compromise. For a realistic security assessment, both approaches should be combined — ideally with clearly defined objectives, because the value of the results depends directly on the quality of the scope definition. Methodological frameworks such as PTES, OSSTMM, and NIST SP 800-115 use the same fundamental distinction between externally and internally conducted assessments.