Internal vs External Penetration Testing: Key Differences and Which to Run First

Internal vs external penetration testing comes down to where the attacker starts: an external test begins on the public internet with no access, while an internal test begins inside your network with a standard user account and measures how far that foothold spreads. Pentestica’s 25 certified senior pentesters run both and price them in tester-days, with no hidden fees.

The difference between internal and external penetration testing also shows in effort: external scales with what you expose online, internal with hosts, sites and Active Directory domains. Either typically takes one to three weeks of testing plus a few days for the report.

Key differences at a glance

External vs internal penetration testing differs in where the attacker starts and what each test answers:

Feature	External penetration test	Internal penetration test
Starting point	Public internet, no credentials or access	Inside the network, with one standard user account
Core question	“Can an outsider get in?”	“How far does a foothold spread?”
Primary targets	Web apps, login portals, VPN, mail, DNS, cloud edge	Active Directory, service accounts, workstations, servers, segmentation between zones
Key objectives	Find exposed weaknesses and prove whether they lead to a foothold	Map lateral movement and privilege escalation; test segmentation
What you provide	In-scope domains and address ranges, plus ownership confirmation before we test anything we discover; no credentials (standard black box test)	A foothold, one standard user account, a testing window, a named technical contact, agreed exclusions
Typical effort and price	Quoted individually; about 3 to 8 tester-days (illustrative estimate)	Quoted individually; about 5 to 10 tester-days (illustrative estimate)

Run together, they form one infrastructure campaign; our published range for complex infrastructure and cloud assessments is $5,000 to $12,000+. See network and infrastructure penetration testing, penetration testing pricing and the average cost of penetration testing by test type.

How an external test works

An external test attacks you like an unauthenticated stranger: in NIST SP 800-115 terms, it’s “conducted from outside the organization’s security perimeter.”

• What it does: Shows what’s reachable online and whether any of it lets an attacker in.
• Techniques used: Reconnaissance and OSINT, subdomain enumeration, credential leak discovery, attacks on exposed portal authentication, unpatched edge services, and TLS and header misconfiguration. More on external penetration testing.
• Value: Tells you which entry points to close first, since attackers see them before anything else.

How an internal test works

An internal test assumes the attacker is already inside, say after a phishing email or with a compromised laptop.

• What it does: Measures how far that foothold spreads. In NIST SP 800-115, internal assessors “assume the identity of a trusted insider or an attacker who has penetrated the perimeter defenses.”
• Techniques used: Domain enumeration from a standard user account, weak and reused service account passwords, Kerberoasting, delegation and certificate services misconfigurations, and paths to domain administrator. See our internal penetration testing services. In one internal test, a standard domain account could reach a legacy certificate template that allowed requester-supplied identities, and privileged authentication was demonstrated in an isolated copy; see our Active Directory penetration testing case study.
• Value: Helps limit breach damage by exposing weak segmentation and excessive privileges.

Which should you run first?

Usually the external test. NIST SP 800-115 notes that when both are planned, “the external testing usually takes place first.”

• Run the external test first: When your perimeter has never been tested, or after new internet-facing systems or perimeter changes.
• Start with the internal test: When phishing or a compromised laptop worries you more; run it alone after an Active Directory migration.
• Plan internal and external penetration testing in one cycle: For PCI DSS, whose requirement 11.4 covers both at least every 12 months and after significant changes (see penetration testing requirements).

Either way, you get an Executive Summary and a Technical Report with exploitation evidence (see our sample penetration test report), and a retest is available after fixes.

If what you need to know is whether your team would catch an attacker who is already inside, rather than a list of weaknesses, see red team vs penetration testing.

Sources: NIST SP 800-115; PCI SSC Penetration Testing Guidance v1.1; PCI DSS v4.0.1 requirement 11.4.