Internal vs External Penetration Testing Explained
An external penetration test starts on the public internet with no credentials and attacks what anyone can reach: your website, your VPN, your mail gateway, your exposed APIs. An internal penetration test starts inside your network, usually from a staff laptop or a device the tester is given access to, and measures how far an attacker gets once they are already in. Most Australian businesses under 100 staff should buy the external test first, and many never need the internal one at all.
That last sentence is the part vendors tend to leave out. Both tests are legitimate, but they answer different questions, and only one is urgent for a company whose systems mostly live in Microsoft 365, AWS and a handful of SaaS platforms. Here is how to tell which situation you are in.
What is the difference between external and internal penetration testing?
The difference between external and internal penetration testing is where the tester starts. NIST Special Publication 800-115, the technical guide most testing methodologies are built on, defines external security testing as testing conducted from outside the organisation’s security perimeter, usually as seen from the internet. It defines internal security testing as work where assessors operate from the internal network and assume the identity of a trusted insider, or of an attacker who has already got past the perimeter defences.
Everything else follows from that starting position. An external penetration test has no credentials and no network access, so it spends its time on what is published to the world. An internal penetration test is handed access on day one, so it spends its time on what happens next: privilege escalation, lateral movement, and whether one compromised laptop turns into domain administrator.
What is an external penetration test?
An external penetration test is an authorised attack on everything your organisation exposes to the internet, performed by a tester who begins with nothing but your company name and an agreed list of targets. In a typical Australian small business the scope is a public website and its login, a customer portal or API, the firewall and VPN endpoints, remote access services, and mail infrastructure.
An external penetration test answers a single blunt question: can a stranger with no inside help get a foothold in your environment? That is what your customers, your insurer and your board are actually asking, and it is why external testing is the standard starting point. If you are new to this, our plain English guide to penetration testing covers the basics, and how to scope a penetration test covers defining the target list before you ask for a quote.
What is an internal penetration test?
An internal penetration test starts from a position inside your network and measures blast radius. The tester is given something an attacker would realistically obtain, most often a standard staff account and a connection to the corporate network, then works out how much further that position can be pushed.
The findings from an internal penetration test tend to be things that accumulate quietly over years: an old file server nobody patches, service accounts with domain administrator rights, flat networks where the reception PC can reach the finance database, and shared local administrator passwords. None of that is visible from the internet, which is why an internal penetration test is the only way to find it.
The catch is that an internal penetration test only pays for itself when there is an internal network worth testing. A twelve person company with laptops, Microsoft 365 and a SaaS product hosted in AWS has almost no traditional internal network. The equivalent risk sits in cloud identity and configuration, which is a different piece of work.
Which penetration test should an Australian business buy first?
Buy the external penetration test first, unless a specific standard or customer contract requires internal testing by name. The reasoning is simple: an internet facing weakness can be found and exploited by anyone in the world at any hour, while an internal weakness requires the attacker to already be inside. Fix the front door first.
One exception is worth naming. If you hold sensitive data on servers you run yourself, in a clinic, a legal practice or a manufacturer with on premises systems, an internal penetration test moves up the list quickly, because that is where the data actually lives.
Does any standard require both internal and external penetration testing?
One standard requires both explicitly. PCI DSS v4.0.1 requirement 11.4 covers external and internal penetration testing, with requirement 11.4.2 setting internal testing at least once every 12 months and after any significant change, and requirement 11.4.3 setting the same cadence for external testing. Requirement 11.4.5 adds segmentation testing at least every 12 months where segmentation is used to isolate the cardholder data environment, and requirement 11.4.4 requires exploitable findings to be corrected and the test repeated to verify the fix.
The other frameworks are softer than most vendors imply. ISO/IEC 27001:2022 does not use the phrase penetration test in its requirements; auditors normally look for testing evidence against Annex A control 8.8 on technical vulnerability management and control 8.29 on security testing in development and acceptance. SOC 2 is similar: the Trust Services Criteria ask for ongoing or separate evaluations under CC4.1, and penetration testing is one accepted way of meeting that, not a named mandatory control. We cover both in detail in what your ISO 27001 auditor expects and whether penetration testing is required for SOC 2.
| Driver | External test | Internal test | Frequency named |
|---|---|---|---|
| PCI DSS v4.0.1 req 11.4 | Required | Required | At least every 12 months |
| ISO/IEC 27001:2022 | Expected as evidence | Only if your scope needs it | Not specified in the standard |
| SOC 2 | Expected in practice | Rarely asked for | Not specified in the criteria |
| Customer security questionnaire | Almost always | Occasionally | Usually annual |
| Cyber insurance application | Sometimes | Rarely | Usually annual |
How is an internal penetration test actually delivered?
An internal penetration test rarely means a tester sitting in your office for a week. In practice there are three delivery models, and the choice affects cost and disruption more than it affects results:
- VPN access. The tester connects to your corporate network over a VPN account created for the engagement. Cheapest and fastest, and suitable for most small environments.
- A jump box or virtual machine. You stand up a machine on the target network segment and the tester works from it. Useful when VPN access would not reach the systems in scope.
- A physical device shipped to site. A small appliance is posted to you, plugged into power and ethernet, and reached remotely. Common when the network in scope is a factory, warehouse or clinic with no practical remote access.
All three are grey box arrangements, meaning the tester is given partial information and access rather than starting blind. Many internal engagements are also framed as assumed breach: the exercise starts from the premise that an attacker already has a foothold.
How long does each penetration test take?
Duration is driven by scope, not by company size. As a rough planning figure for a small Australian business, an external penetration test of a handful of internet facing systems commonly runs three to five testing days, and an internal penetration test of a single small network commonly runs five to ten. Internal work takes longer because Active Directory, file shares and segmentation give a tester more surface to walk than a short list of public IP addresses.
Add reporting time on top, plus your own remediation window, plus a retest if you want the findings verified as fixed. For what drives the number on the quote, see our Australian penetration testing pricing guide, and how often you should test for cadence.
When is an internal penetration test not worth buying?
An internal penetration test is not your best next dollar when there is little internal estate to test and nothing is forcing your hand. Concretely, hold off if all of the following are true: you are not in scope for PCI DSS, your data and applications live in SaaS and cloud platforms rather than on servers you run, you have no on premises Active Directory of any size, and no customer or auditor has asked for internal testing by name.
If that describes you, the money is better spent finishing the external findings, tightening identity and multi factor authentication, and running a cloud configuration review. A vulnerability scan covers different ground at a much lower price: see penetration testing versus vulnerability scanning.
One more piece of advice. If a supplier or auditor asks you for internal testing, ask which requirement they are quoting before you buy anything. Often the request turns out to be a template question rather than a real obligation.
Common questions
What is the difference between external and internal penetration testing?
External penetration testing is performed from outside your perimeter with no credentials, against internet facing systems such as websites, VPNs, mail and APIs. Internal penetration testing is performed from inside your network with a starting foothold, against servers, Active Directory, file shares and network segmentation. External testing measures whether a stranger can get in. Internal testing measures how far they get once inside.
What is external penetration testing used for?
External penetration testing is used to find and prove exploitable weaknesses in anything your organisation publishes to the internet, before someone else does. It is the test customers, insurers and auditors most often ask to see, and it is the usual first purchase for an Australian business, because internet facing systems are exposed to every attacker on the planet, all day, every day.
What is internal penetration testing used for?
Internal penetration testing is used to measure blast radius. Starting from a standard staff account or a device on your network, the tester attempts privilege escalation and lateral movement to show how much of the business one compromised laptop would expose. It is most valuable where you run your own servers, Active Directory or file shares, and where sensitive data sits on internal systems.
How much does an external penetration test cost in Australia?
Australian penetration testing is normally quoted on tester days, so the price follows the scope rather than the size of your company. A short external test against a small number of internet facing systems sits at the low end, and cost rises with the number of applications, user roles and environments included. Ask for fixed price scoping so the number cannot move mid engagement.
How often should penetration testing be done?
Annually is the common baseline, plus a test after any significant change to the systems in scope. PCI DSS v4.0.1 requires internal and external testing at least once every 12 months and after significant changes. ISO 27001 and SOC 2 do not name a frequency, so auditors judge it against your own risk assessment, which in practice usually lands on annual testing as well.
Do I need both internal and external penetration testing?
Only if a standard, contract or your own risk assessment says so. PCI DSS v4.0.1 requires both. Outside PCI DSS, most Australian businesses under 100 staff get more value from an annual external test plus remediation than from splitting the same budget across two tests. Add internal testing when you run your own servers or hold sensitive data on premises.
Where to go next
If you are buying your first test, start with the external scope, insist on a fixed price, and check the tester’s accreditation. Siege Cyber is CREST accredited and quotes penetration testing on a fixed price basis, so the cost is agreed before work starts. See what is included on our penetration testing services page, or get in touch and we will tell you which test you need and, just as often, which one you do not.