Every network penetration test starts from one of two positions: outside your perimeter, or already within it. That single choice, internal vs external penetration testing, changes what the test simulates, what it finds, and what it costs. Buyers mix the two up constantly, and some vendors are happy to leave the confusion in place. Here is the clean version of external vs internal penetration testing, and how to decide which one you need this year.
The short version
- External tests your perimeter from the internet with no access, and answers one question: can an attacker get in?
- Internal starts from a foothold inside the network, an assumed breach, and answers a different one: once someone is in, how far do they spread?
- You will eventually need both. Start with external if you have never tested, since it is the surface every attacker can already reach, then run internal before your Active Directory ages another year. Several compliance frameworks expect both.
What is external penetration testing?
External penetration testing is a security assessment of everything your organization exposes to the internet, performed from the position of an outside attacker with no access and no credentials. The tester sees exactly what a real adversary sees: your public IP ranges, VPN gateways, mail servers, web applications, cloud endpoints, and anything else answering from the outside.
The engagement works through discovery first, mapping your actual internet footprint (which is almost always larger than the one you think you have), then probes and attempts to exploit what it finds: exposed management interfaces, unpatched perimeter systems, weak VPN and portal authentication, misconfigured TLS and DNS, and forgotten hosts from projects past. Some buyers call this external infrastructure penetration testing; the scope is the same.
The question an external test answers: can an attacker on the internet get in?
What is internal penetration testing?
Internal penetration testing starts from the opposite assumption: the perimeter has already failed, which is why it is often called an assumed breach test. The tester begins with a foothold inside your network, the position of an attacker who phished an employee, walked in with a rogue device, or compromised a single workstation, and also the position of a malicious insider.
From there, the test measures blast radius. Can that one foothold spread? Does network segmentation actually hold, or is the network flat once you are past the firewall? Can Active Directory be escalated from a standard user to domain admin through Kerberoasting, delegation abuse, or weak group policy? Where do harvested credentials get reused? How close can an attacker get to the systems and data that would actually end your week?
The question an internal test answers: once someone is in, how bad does it get?
The difference at a glance
| External | Internal | |
|---|---|---|
| Attacker position | Internet, no access | Foothold inside the network |
| Simulates | Opportunistic and targeted outside attackers | Post-phishing compromise, malicious insiders |
| Core question | Can they get in? | How far can they spread? |
| Typical targets | Public IPs, VPNs, mail, web apps, cloud edge | Segmentation, Active Directory, internal services |
| Common critical findings | Exposed services, unpatched perimeter, weak portal auth | Domain privilege escalation, lateral movement, flat networks |
| Access needed from you | Usually none beyond scope approval | A device, VM, or appliance inside the network |
| Invadel fixed price | From $4,200 | From $6,000 |
Why the distinction matters more than it looks
The two tests fail in different directions, and passing one says nothing about the other.
A company with a hardened perimeter can be one phishing email away from total compromise if the internal network is flat and Active Directory is a decade of accumulated misconfiguration. We see this profile constantly: a clean external report, and an internal test that reaches domain admin in a day.
The reverse profile exists too: strong internal segmentation behind a perimeter with one forgotten, exploitable appliance. The attacker only needs the one door.
That is why mature security programs treat them as two halves of one answer rather than competing options, and why frameworks that take testing seriously, such as PCI DSS, NYDFS 23 NYCRR 500, and the enclave scoping behind CMMC Level 2, explicitly expect both internal and external testing rather than letting you pick one.
Which one should you do first?
If you have never had a penetration test, start external. It is the attack surface every adversary on the internet can already reach, it requires almost nothing from your team to set up, and it is the cheaper of the two. An exploitable perimeter is the most urgent kind of finding there is.
Move internal testing up the list when any of these are true:
- You rely on Active Directory and it has never been formally tested (an Active Directory security assessment covers the directory on its own)
- Your workforce is a phishing target (every workforce is), and you want to know what a single compromised laptop costs you (a ransomware readiness assessment asks that question with backups and detection added)
- Compliance applies: PCI DSS requires internal and external testing, NYDFS 500 expects both, and SOC 2 auditors increasingly ask what happens past the perimeter
- A vendor, auditor, or cyber insurer has asked about segmentation and you do not have evidence it holds
Most organizations that run both discover the internal report is the more sobering document. The perimeter gets attention because it is visible. The inside rarely does.
Can they be combined?
Yes, and it is often the efficient buy. A combined engagement tests the perimeter, then continues from an assumed foothold inside, giving you the full attack path in one report: how they get in, and what happens next. We scope combined network engagements routinely, and a full-chain exercise with phishing and objectives on top is essentially a red team engagement. For the broader landscape of engagement types, see our guide to network penetration testing, the internal and external network penetration testing checklist, and our overview of other types of penetration testing.
What each costs
Fixed prices, published, no hourly billing:
- External penetration testing services start at $4,200
- Internal penetration testing services start at $6,000, run remotely through a small appliance or VM in most cases
Both include a free retest of remediated findings, and larger environments are quoted after scoping. The external penetration testing cost and internal network penetration testing cost pages show each tier and what moves a scope between them.
Frequently asked questions
Is external or internal penetration testing more important? Neither is universally more important; they answer different questions. External is the more urgent first test because that attack surface is exposed to everyone on the internet right now. Internal usually produces the more severe findings once run, because internal networks accumulate years of untested trust.
Do I need to be on-site for an internal test? Usually not. Most internal tests run remotely through a small appliance or virtual machine placed inside your network, which keeps logistics and cost down. On-site testing is available when the scope calls for it. Wi-Fi and building entry are separate engagements: see wireless penetration testing and physical penetration testing.
How often should each be run? At least annually for both, plus after significant changes: a new public application or VPN for external, a domain migration or major restructuring for internal. Regulated environments often test more frequently, and some frameworks mandate the cadence.
Is an external penetration test the same as a vulnerability scan? No. A scan enumerates known weaknesses automatically; an external penetration test has a human validate, chain, and exploit them to prove real impact. The difference is covered in penetration testing vs vulnerability scanning.
The bottom line
External testing asks whether an attacker can get in. Internal testing asks what happens once they are in. One tests your doors, the other tests your rooms, and a serious security program eventually needs the answer to both.
Ready for either? Scope your assessment and we will return a fixed quote for external, internal, or a combined engagement within one business day.
Written by
Invadel Team
Senior penetration testers writing from real engagements, the same team that scopes, tests, and reports for our clients. About Invadel →