Internal vs External Penetration Testing: Differences, Scope and Cost (2026)

External penetration testing measures what an attacker on the public internet can reach before authenticating; internal penetration testing measures how far an attacker gets once they are already inside the network. They test different halves of the same estate, they find different classes of weakness, and a clean result on one tells you almost nothing about the other.

Quick answer: An external penetration test starts on the internet with no credentials and assesses your perimeter: edge devices, remote access, mail, DNS and exposed services. An internal penetration test starts on your network as an unauthenticated device or an ordinary user and assesses lateral movement, privilege escalation, Active Directory and segmentation. Organizations assessed against PCI DSS Requirement 11.4 or covered by New York's DFS cybersecurity rule (unless exempt under 500.19(a)) need both, at least annually. In Stingrai's own data, internal tests produced a median of 11 findings per test with 92% rated High or Critical, against a median of 1 and 48% for external tests. Both are quoted to scope, against a 2026 market benchmark of about US$5,000 to US$40,000 for a network test.

The perimeter matters more than ever. Verizon's 2026 Data Breach Investigations Report, released on 19 May 2026, found that nearly a third (31%) of breaches start with vulnerability exploitation, which has now surpassed stolen credentials as the number one breach entry point. That is the external question. What happens after the entry point is the internal one, and it is where the damage is decided.

Internal vs external penetration testing at a glance

What is external penetration testing?

External penetration testing is a security assessment run from outside your perimeter, normally from the public internet, with no credentials and no insider knowledge. NIST's SP 800-115, Technical Guide to Information Security Testing and Assessment, describes external testing as a view of "the environment's security posture as it appears outside the security perimeter", usually as seen from the internet, "with the goal of revealing vulnerabilities that could be exploited by an external attacker."

In practice the tester first discovers what you actually expose, because the inventory you supply is rarely complete. Forgotten subdomains, a test server someone stood up for a vendor, a management interface left reachable after a firewall change: these are the findings an external test exists to surface. The tester then enumerates services, checks versions against known vulnerabilities, assesses authentication on remote access and portals, and attempts to prove impact where a weakness is real. NIST notes that externally accessible servers "are tested for vulnerabilities that might allow access to internal servers and private information."

External testing identifies internet-facing web applications and checks their exposure, but it does not replace a full web application penetration test, which spends its time on authentication, authorization and business logic across every user role. Our guide to external penetration testing scope and cost covers the perimeter in depth.

What is internal penetration testing?

Internal penetration testing is a security assessment that starts inside your network and measures what an attacker with a foothold can reach. NIST SP 800-115 puts it plainly: "assessors work from the internal network and assume the identity of a trusted insider or an attacker who has penetrated the perimeter defenses." The same section notes that internal testers are "often granted some level of access to the network, normally as general users," and work upward through privilege escalation, "increasing system administrator privileges to domain administrator privileges."

Internal testing deliberately does not model how the attacker got in. Real footholds arrive through a phished user, a contractor's unmanaged laptop, a reused VPN password or an application that was never meant to reach the core, so the test starts from an assumed-breach position and asks what happens next. Our explainer on assumed-breach engagements covers the reasoning.

The start position is the most important scoping decision. Common options are an unauthenticated device on the user VLAN, a standard domain account provisioned like a new joiner, a managed workstation from your own build, a server or DMZ host, or a vendor or branch segment. Each one is a separate run of the methodology and proves something different. A structure that works well is to start uncredentialed and hand over a standard domain account at a fixed checkpoint, so the report covers both whether a device alone yields credentials and how far an ordinary identity reaches. Our guide to internal penetration testing scope and cost walks through each start position.

Attacker position: the internet versus assumed breach

The cleanest way to see the difference is through MITRE ATT&CK, the public knowledge base of adversary tactics and techniques that most reports now use as a shared vocabulary.

An external test concentrates on the Initial Access tactic. The techniques it most often evidences are Exploit Public-Facing Application (T1190), where a flaw in an internet-facing system gives an attacker a way in; External Remote Services (T1133), covering VPNs, remote desktop gateways and similar services that let users connect from outside; and Valid Accounts (T1078), where weak or reused credentials open a legitimate door.

An internal test starts after Initial Access and concentrates on what follows: Discovery, Credential Access, Privilege Escalation and Lateral Movement. Typical techniques it evidences include Name Resolution Poisoning and SMB Relay (T1557.001) and Kerberoasting (T1558.003), both of which turn presence on a network into authentication material, and both of which have well-documented configuration fixes.

For a defender, this mapping is the practical value. An external report tells your network and infrastructure teams which doors to close or narrow. An internal report tells your identity, endpoint and network teams which hops in an attack path to break, and which detection rules should have fired at each hop.

What each test finds: Stingrai's data

Stingrai published the findings from its own engagements in The State of Penetration Testing 2026, covering 55 penetration tests and 1,206 verified findings between October 2024 and August 2026. Split by test type, internal and external network testing look nothing alike.

Source: Stingrai penetration testing platform data, published in The State of Penetration Testing 2026.

Three readings follow. First, a well-run perimeter is often narrow: a median of one finding per external test means most external estates in this sample exposed little, which is exactly the result an organization wants and exactly why a clean external report should not be read as a clean bill of health. Second, the inside is where severity concentrates. Outdated or unpatched software alone made up 56.9% of internal findings, and 92% of internal findings were rated High or Critical. Third, the two tests are not substitutes. An estate with a clean perimeter and a flat internal network is one phished laptop away from a serious incident.

Two cautions keep the numbers honest. They come from 14 network tests at one firm, so treat them as a direction rather than a market benchmark. And they count findings, so a large internal estate with hundreds of unpatched hosts weighs more than a small one.

The classes of finding also differ by kind, not only by volume:

In a Windows-heavy estate, scope Active Directory security testing as a named component of the internal test rather than hoping it is implied.

Typical scope items for each test

A good scope names assets and positions, not just address ranges.

External penetration test scope usually includes: the public IP ranges and domains you own, with independent discovery by the tester and a reconciliation against your list; edge appliances such as firewalls, VPN concentrators and load balancers; remote access services; mail and DNS infrastructure; exposed management interfaces; and internet-facing web portals, identified and checked for exposure. Cloud-hosted public endpoints belong here too when they are internet-facing.

Internal penetration test scope usually includes: named CIDR ranges and VLANs with a live-host estimate; one or more start positions; Active Directory domains and forests, named explicitly; file shares; infrastructure services such as databases, backup, virtualization and printing; certificate services where present; and a segmentation matrix that lists source and destination pairs with the intended policy for each.

Out of scope by default for both: denial-of-service testing, social engineering and physical entry (separate engagements), third-party systems without the owner's written authorization, and operational technology without an agreed safety plan. Our guide on how to scope a penetration test covers the discipline in depth.

Methods and standards: PTES, NIST SP 800-115 and MITRE ATT&CK

Both tests follow the same core methodology; what changes is the starting position and the techniques in play.

PTES. The Penetration Testing Execution Standard organizes an engagement into seven main sections: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post exploitation and reporting. For an external test, intelligence gathering and vulnerability analysis dominate. For an internal test, post exploitation, meaning what an attacker can do with the access gained, is where most of the value sits.

NIST SP 800-115. Published in September 2008 and still a standard public reference on technical security testing, SP 800-115 treats internal and external as viewpoints of the same assessment and gives one piece of sequencing advice buyers should follow: "If both internal and external testing is to be performed, the external testing usually takes place first." NIST's reason is that it keeps the same testers from "acquiring insider information on network architecture or system configuration that would not be available to an adversary."

MITRE ATT&CK. ATT&CK is not a testing methodology but a common language for findings. A report that maps each finding and each attack path step to an ATT&CK technique lets your security operations team check whether their detections cover the same techniques, which turns a list of weaknesses into a detection backlog.

Box type. Either test can be black box (no information), grey box (some information or credentials) or white box (full architecture detail). External tests are usually black or grey box. Internal tests are usually grey box, because handing over a standard account at a checkpoint is the most informative structure.

Which compliance programs ask for which

Requirements differ more than vendor summaries suggest. The table below reflects the primary text of each program as of October 2026.

PCI DSS v4.0.1. Requirement 11.4.1 requires a documented methodology that includes "testing from both inside and outside the network" and "testing to validate any segmentation and scope-reduction controls." Requirement 11.4.2 covers internal and 11.4.3 external penetration testing, each at least once every 12 months and after any significant infrastructure or application upgrade or change, by a qualified internal resource or qualified external third party with organizational independence. Requirement 11.4.5 adds segmentation testing at least every 12 months and after any changes to segmentation controls, 11.4.6 moves service providers to every six months, and 11.4.4 requires that exploitable findings are corrected and penetration testing is repeated to verify the corrections. The text is in the PCI Security Standards Council document library, and our PCI DSS penetration testing guide walks through Requirement 11.4.

NYDFS. The amended 23 NYCRR Part 500 requires covered entities to conduct, at a minimum, "penetration testing of their information systems from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually." Limited exemptions under section 500.19 remove some smaller entities from section 500.5. Our NYDFS penetration testing requirements guide covers the detail.

SOC 2. No trust services criterion requires a penetration test. The AICPA's 2017 Trust Services Criteria with revised points of focus (2022) lists penetration testing in a CC4.1 point of focus as one of the "different types of ongoing and separate risk and control evaluations" management uses, and the same document notes, citing COSO, that points of focus "represent important characteristics of the criteria" and that some may not be suitable or relevant to a given entity, which makes them guidance rather than a list of required tests. Internal and external tests are common evidence for this criterion; see SOC 2 penetration testing.

ISO/IEC 27001:2022. No clause of the standard names penetration testing. Internal and external tests are common evidence for Annex A 8.8, management of technical vulnerabilities, and an application test supports A.8.29, security testing in development and acceptance. Our ISO 27001 penetration testing requirements guide maps the controls.

HIPAA. The current Security Rule does not name penetration testing. It requires a periodic technical and nontechnical evaluation under 45 CFR 164.308(a)(8). A proposed rule published at 90 FR 898 on 6 January 2025 would require penetration testing by a qualified person at least once every 12 months, or more often if the risk analysis calls for it, but it is not final: the Unified Agenda entry for RIN 0945-AA22 lists it as a long-term action with final action projected for July 2027. Our HIPAA penetration testing requirements guide tracks it.

Stingrai's penetration testing produces the evidence these programs reference: separate internal and external results, segmentation results where tested, a statement of scope, and retest evidence. Our breakdown of penetration testing versus vulnerability assessment explains which frameworks accept a scan and which ask for a test.

How long each test takes

Duration follows scope, and field time is not calendar time. The planning ranges Stingrai publishes on its network penetration testing service page are:

Add scheduling lead time, access provisioning for the internal start positions, reporting and quality review, the readout, then remediation and the retest window. Internal tests are more often delayed by preparation than by testing: a missing network drop, an account that was not provisioned, or a segmentation matrix nobody can produce. When both tests run in one engagement, follow NIST's advice and run external first.

What drives the cost of each

Network engagements are quoted to scope, and the two tests are driven by different things.

Stingrai's 2026 market benchmark puts a network penetration test, internal or external, at about US$5,000 to US$40,000, with host count and internal scope moving it most; the full breakdown is in our penetration testing cost guide. The internal end of a combined engagement usually carries more effort, because identity, start positions and segmentation all add work. The internal and external scope-and-cost guides set out what to put in a request for proposal so quotes are comparable, and our guide on comparing penetration testing quotes helps line several up.

Stingrai's published prices on the pricing page, US$3,000 (Autonomous) / US$6,800 (Hybrid) per assessment for one web application and associated APIs, are application prices, not a proxy for a network test. Internal and external network engagements are quoted through Get a Quote.

How to choose: internal, external or both

Most mature programs run both, at least annually and after significant change. When the budget or the calendar forces an order, these rules of thumb hold.

Start with external when your exposure is mostly at the edge: VPN concentrators, firewalls and remote access appliances, a large or poorly inventoried internet footprint, recent acquisitions whose perimeter you have not mapped, or a customer or insurer asking specifically about internet exposure.

Start with internal when you run a Windows domain, have had a phishing or ransomware incident, rely on segmentation to reduce compliance scope, or have an auditor asking for segmentation evidence. If you have never had an internal test, it is usually the larger risk reduction per dollar, because the inside is where the High and Critical findings concentrate.

Buy both in one engagement when PCI DSS or NYDFS applies, when you need a single report for a customer security review, or when the same team will remediate both. Run external first, and agree the internal start positions and account handover checkpoint before kickoff.

Choose something else when the real question is different. Whether your security operations team would detect an intrusion is a red team question; whether a web application leaks one customer's data to another is a web application test. Our comparison of red team versus penetration test versus continuous validation draws the boundaries.

Whichever you choose, ask every vendor for a redacted sample report and check for a discovery delta on the external side, attack path narratives on the internal side, named testers, and retesting in the fee. A report that is a scanner export with a cover page is a scan, whatever the proposal called it.

How Stingrai runs internal and external network tests

Stingrai's internal and external network work is human-led: two named penetration testers from a team holding OSCE³, OSEP, OSWE, CREST CRT and CISSP certifications, at a firm CREST-accredited as a penetration testing service provider, with each engagement reviewed by the team lead and an engagement partner. External tests begin with passive and active reconnaissance to map your internet footprint: live hosts, open ports and exposed services, reconciled against the inventory you supply. Internal tests are scoped by start position, Active Directory and named segmentation pairs, and the team maintains StingAD, an open-source toolkit for authorized Active Directory assessments. Findings are posted to the PTaaS portal as they are confirmed, each with proof of concept and remediation guidance, with live chat with the assigned penetration testers, retesting of remediated findings, and an attestation letter with every human-led report. Engagements run one-time (annually) or as a continuous program.

Snipe, Stingrai's autonomous AI agent, tests web applications and associated APIs only, so it is not part of a network engagement. Network testing scope, start positions and timing are agreed on a scoping call before anyone signs.

Frequently Asked Questions

What is the difference between internal and external penetration testing?

An external penetration test starts on the public internet with no credentials and assesses what an attacker can reach before authenticating: edge devices, remote access, mail, DNS and exposed services. An internal penetration test starts inside the network, as an unauthenticated device or a standard user account, and assesses lateral movement, privilege escalation, Active Directory and segmentation. In Stingrai's data, internal tests returned a median of 11 findings with 92% rated High or Critical, against a median of 1 and 48% for external tests.

Which is more important, internal or external penetration testing?

Neither replaces the other, because they answer different questions. External testing shows whether your front door is narrow; internal testing shows how much damage follows once anyone gets through it. If you have never had an internal test and run a Windows domain, it is usually the larger risk reduction per dollar, because High and Critical findings concentrate on the inside.

Does PCI DSS require both internal and external penetration testing?

Yes. PCI DSS v4.0.1 requires internal penetration testing under Requirement 11.4.2 and external penetration testing under Requirement 11.4.3, each at least once every 12 months and after any significant infrastructure or application upgrade or change. Where segmentation isolates the cardholder data environment, Requirement 11.4.5 adds segmentation testing at least every 12 months and after any changes to segmentation controls, and service providers move to every six months under 11.4.6.

How often should you run internal and external penetration tests?

At least annually is the baseline in both PCI DSS v4.0.1 and NYDFS 23 NYCRR 500.5(a)(1), which asks for testing from both inside and outside the information systems' boundaries at least annually. PCI DSS also requires a new test after any significant infrastructure or application upgrade or change. Organizations with frequent infrastructure change, acquisitions or segmentation changes usually test more often or move to a continuous program.

How much does an internal or external penetration test cost?

Both are quoted to scope. Stingrai's 2026 market benchmark puts a network penetration test, internal or external, at about US$5,000 to US$40,000. External cost is driven by live internet-facing hosts and exposed services; internal cost is driven by live host count, sites, Active Directory footprint, the number of start positions and the segmentation pairs to prove.

How long does an internal or external penetration test take?

An external-only test of one entity with fewer than 50 live hosts typically takes 3 to 5 tester days across one to two weeks. External plus internal on a single site and single domain takes one to two tester weeks across two to four weeks, and internal testing across multiple sites and a multi-domain forest runs four to eight weeks.

Should external testing happen before internal testing?

Usually, yes. NIST SP 800-115 states that if both internal and external testing is to be performed, the external testing usually takes place first, so the testers do not carry insider knowledge of the network into the external assessment.

Is an internal penetration test the same as an assumed breach test?

They overlap. An internal penetration test starts from an assumed-breach position, already on the network, and aims for coverage of what that position reaches. An assumed-breach red team engagement starts from the same position but aims at a specific objective while testing whether your security operations team detects and responds.

Related reading

• Internal penetration testing: what it is, scope, cost and what it finds

• External penetration testing: what it is, scope, cost and what it finds

• The State of Penetration Testing 2026: an analysis of 1,206 verified findings

• Active Directory security assessment: what it covers and what it finds

• PCI DSS penetration testing: Requirement 11.4 explained

• Penetration testing report sample, walked through page by page

Talk to Stingrai

Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified penetration testers, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements. The internal and external network penetration testing team will tell you which start positions, segmentation pairs and perimeter assets belong in your scope before anyone signs. Book a free scoping call, get a quote, or read the published pricing.