External and internal are different engagements
| External | Internal | |
|---|---|---|
| Tester position | Outside, on the internet | Inside, as an attacker with a foothold |
| Question | What can an anonymous attacker reach? | What happens after someone gets in? |
| Scoped by | Live public IPs | Subnets and host count |
| Duration | 3–7 days | 1–4 weeks |
| US market cost | from about $3,600 | $4,800–$35,000 |
| Finds | Exposed services, weak configs, perimeter gaps | Lateral movement, privilege escalation, segmentation failures |
External is the cheapest real engagement available and the most commonly bought first. It answers a narrow question well. Internal answers the question that matters once you accept that perimeters get breached — and it is where the findings that change architecture usually come from.
What external testing finds
Services exposed that nobody intended to expose — a database port, a management interface, a staging environment reachable from the internet. Unpatched services with known exploits. Weak or default credentials on perimeter devices. Certificate and transport problems. Information disclosure through headers, error pages and metadata.
The recurring theme is inventory. Most external findings are not sophisticated; they are things that were stood up temporarily, forgotten, and left reachable. The value of the test is often the asset list as much as the vulnerabilities.
What internal testing finds
The tester starts with a foothold — a workstation, a VPN account, or a compromised low-privilege user — and works outward.
Lateral movement. Moving between hosts using credentials, tokens or trust relationships found along the way.
Privilege escalation. Local and domain, up to administrative control.
Segmentation failures. Whether the network zones you believe exist actually constrain traffic. This is frequently the most valuable finding, because segmentation is usually assumed rather than verified.
Credential exposure. Passwords in scripts, shares, configuration files and ticketing systems.
Cardholder or sensitive data reachability. Which matters directly for PCI DSS, where segmentation testing is an explicit expectation.
Which one does your compliance requirement mean?
This trips people up, because frameworks rarely say "external" or "internal" explicitly.
PCI DSS expects both, plus segmentation testing where segmentation is used to reduce scope. This is the most prescriptive of the frameworks.
ISO 27001 and SOC 2 do not specify. What an auditor is looking for is evidence of technical vulnerability management appropriate to your environment — for a cloud-native SaaS company that is usually application and external testing rather than internal network work.
A practical note for cloud-native companies: if you have no offices with servers and no corporate network holding production data, an internal network penetration test may genuinely not be the right spend. Cloud configuration review and application testing usually answers more. Providers who quote internal network testing regardless of architecture are selling a package, not a scope.
FAQs
What is the difference between external and internal network penetration testing?
External testing is performed from the internet and asks what an anonymous attacker can reach — exposed services, weak configurations and perimeter gaps. Internal testing starts from a foothold inside the network and asks what happens after someone gets in, covering lateral movement, privilege escalation and segmentation failures.
How much does network penetration testing cost?
In the US market external network testing starts around $3,600 and is usually the cheapest genuine engagement available. Internal network assessments run roughly $4,800 to $35,000 depending on subnet count, host count and segmentation complexity.
Which network test does PCI DSS require?
PCI DSS expects both external and internal penetration testing, plus segmentation testing where segmentation is used to reduce cardholder data environment scope. It is the most prescriptive of the common frameworks on this point.
Do cloud-native companies need internal network penetration testing?
Often not. If there are no offices with servers and no corporate network holding production data, an internal network test may not be the right spend — cloud configuration review and application testing usually answer more. Providers quoting internal network testing regardless of architecture are selling a package rather than scoping.
What is segmentation testing?
Verifying that the network zones you believe exist actually constrain traffic between them. It matters because segmentation is usually assumed rather than tested, and because PCI DSS relies on it to reduce audit scope — if segmentation fails, the scope reduction it justified disappears.
Where to go next
See penetration testing services, PCI DSS, or what testing costs.