Today’s organizations face the growing challenge of ensuring the security of their IT infrastructure in the face of increasingly sophisticated cyber threats. Penetration testing (pentesting) is a key component of defense strategies, allowing the identification of security vulnerabilities through the simulation of actual attacks. Depending on the starting point of the attack, there are two main types of tests: external and internal.
External penetration tests simulate attacks carried out from the perspective of an external intruder who has no prior access to the organization’s network. The goal is to assess the vulnerability of systems accessible from the public Internet, such as web servers, applications or cloud services. These tests identify weaknesses in perimeter security that could provide an entry point for cybercriminals.
Internal penetration tests refer to scenarios in which an attacker gains access to an organization’s network, such as through malware, a lost laptop or the actions of a disgruntled employee. These tests are designed to evaluate the effectiveness of internal security measures, such as network segmentation, access control or user activity monitoring.
In this article, we will outline the key differences between external and internal penetration testing, discussing their goals, methodology and the benefits of conducting them in the context of building a comprehensive IT security strategy.
Shortcuts
- Why is viewing infrastructure security solely through the lens of “paywalls” an illusion in today’s world?
- When is an “outside” look (external test) absolutely necessary to avoid being caught off guard by Internet attackers?
- In what scenarios is it the “inside out” test (internal test) that will expose the greatest weaknesses and potential attack paths?
- What unique types of vulnerabilities and advanced attack techniques are specific to external testing, and which to internal testing?
- Is there a “golden mean,” i.e. how to strategically combine the two approaches to get the fullest picture of risk and optimize investments?
- How does nFlo design infrastructure penetration testing scenarios to provide you with not just a list of vulnerabilities, but a viable strategy for strengthening your defenses?
- External vs. internal penetration testing of IT infrastructure
Why is viewing infrastructure security solely through the lens of “paywalls” an illusion in today’s world?
For years, IT security strategies have been dominated by the fortress approach - a focus on building the highest and thickest possible “walls of defense” at the network perimeter (perimeter security). Firewalls, intrusion prevention systems (IPS), VPN gateways - all were supposed to protect valuable internal resources from threats lurking in the wild Internet. And while robust perimeter defenses are still absolutely essential, viewing infrastructure security solely through this prism is a dangerous illusion today. Today’s threat landscape and the evolution of IT architectures themselves are forcing a much more holistic and multi-layered approach.
First, network boundaries are becoming increasingly fluid and difficult to define. Remote work, mobile devices, cloud services, business partners connecting to our systems - all of these are blurring the traditional, clearly defined “perimeter.” Attackers today have many more potential entry points than just a company’s main Internet gateway. Focusing solely on protecting it is like locking the front door with four triggers, leaving the first floor windows open and the rear entrance unsecured.
Second, insider threats are a significant and often underestimated problem. These can be intentional (e.g., a disgruntled employee stealing data) or, much more often, inadvertent mistakes and negligence by employees (e.g., clicking on a phishing link, using weak passwords, careless handling of confidential information). Even the best-secured perimeter will not protect against a threat that is already inside the network. That’s why it’s so important to monitor and secure what’s going on “behind the walls” as well.
Third, attackers are constantly improving their techniques for bypassing perimeter security. Sophisticated phishing attacks, exploitation of zero-day vulnerabilities in software, and supply chain attacks are just some of the ways cybercriminals can penetrate inside a network, even one seemingly well protected from the outside. The assumption that our “walls” are impregnable is simply naive. One should adopt an “assume breach” strategy - assume that sooner or later an attacker will find a way to get inside, and be prepared for it.
This is why today’s approach to infrastructure security must be based on the concept of “defense in depth.” This means implementing multiple layers of security, both at the perimeter and inside the network, as well as at the level of individual systems and applications. The key is not only to prevent intrusions, but also to quickly detect intruders who have already gotten inside, restrict their ability to move around the network (lateral movement) and minimize potential damage. Penetration tests, both external and internal, play an invaluable role here in verifying the effectiveness of these multi-layered defenses.
📚 Read the complete guide: Cyberbezpieczeństwo: Kompletny przewodnik po cyberbezpieczeństwie dla zarządów i menedżerów
When is an “outside” look (external test) absolutely necessary to avoid being caught off guard by Internet attackers?
An external penetration test, simulating the actions of an attacker attempting to penetrate your company’s defenses from the public Internet, is a fundamental element of any mature security strategy. There are situations and moments when conducting such a test is not so much good practice as an absolute necessity if you want to avoid unpleasant surprises and sleep more soundly, knowing that your “first line of defense” is solid.
First and foremost, if your organization provides any online services or resources over the Internet, an external test is mandatory. Whether it’s a company website, e-commerce store, customer portal, API, mail server, or remote VPN access for employees, each of these elements is a potential target for attackers. Regularly (at least once a year, and preferably more often) testing their resilience from the perspective of an anonymous intruder allows you to identify and patch holes before cybercriminals exploit them. It’s like a regular maintenance check of your car - you want to know if the brakes are working before you go on a long trip.
Another key moment is the implementation of a new publicly available service or a significant modification of an existing one. Are you launching a new partner portal? Are you redesigning your main website? Implementing a new remote access system? Any such change, even if carried out with the utmost care, can inadvertently introduce new vulnerabilities or weaken existing protections. A third-party test conducted immediately after such a deployment (or just before it goes into full production) is like a last qualitative test to catch any errors or shortcomings.
Regulatory requirements and industry standards should also not be overlooked. Many of them, such as the PCI DSS (Payment Card Industry Data Security Standard) for companies that process payment card data, or some interpretations of the RODO data protection due diligence, overtly require or strongly recommend regular external penetration testing. Failure to meet these requirements can result not only in financial penalties, but also in the loss of certifications or the ability to conduct certain types of business. The report of a professionally conducted external test is often key evidence of compliance with these obligations.
Finally, an external penetration test is extremely valuable when you want to get an objective, independent assessment of the effectiveness of your perimeter security. Perhaps you’ve invested in a new firewall, IPS system or WAF solution and want to see if they are actually working as they should and are able to fend off viable attack attempts. The perspective of an external, “unprejudiced” pentester, who is not familiar with your internal configuration, can provide invaluable feedback and point out areas for improvement that you may not have noticed from an internal perspective. It’s like inviting an independent expert to evaluate your work - a fresh perspective always brings new value.
In what scenarios is it the “inside out” test (internal test) that will expose the greatest weaknesses and potential attack paths?
While robust perimeter protection is crucial, the assumption that no attacker will ever penetrate our network is unfortunately a pipe dream. Phishing attacks, malware, compromised credentials or even the actions of careless or malicious employees - all of these can put an intruder “behind the walls.” In such situations, it is the internal penetration test, which simulates the actions of an attacker who has already gained some foothold in the local network, that is able to expose the greatest weaknesses and show how disastrous the consequences can be.
Imagine a situation where one of your employees unknowingly clicked on a malicious link in a phishing email, leading to his workstation being infected and taken over by the attacker. What next? Will the attacker be able to move freely throughout the network from this one compromised machine? Will he gain access to shared drives with sensitive data? Will he manage to intercept credentials of other users or administrators? Will it get to the heart of your infrastructure - domain controllers, database servers, financial and accounting systems? An internal penetration test, starting from the perspective of just such a compromised station, will answer these questions, mercilessly showing potential paths of escalation and spread of the attack.
Another key scenario is the need to verify the effectiveness of internal network segmentation and access control mechanisms. Many organizations invest in segmenting their network into different security zones (e.g., server zone, user zone, DMZ zone), hoping that if one zone is compromised, the others will remain secure. An internal test allows you to verify that this segmentation actually works, that rules on internal firewalls are configured correctly, and that there are no unauthorized connections between segments. It often turns out that historical configurations, temporary “workarounds” or simply human error have made segmentation illusory.
An insider test is also invaluable when you want to assess the risk of insider threats - both intentional and accidental. What can an employee with standard privileges do if he decides to act against the company? Does he have access to data he shouldn’t? Can he easily escalate his privileges? And what about a privileged employee (e.g., a system administrator) who abuses his privileges or whose account is taken over? An internal test, simulating different internal user profiles, will help identify such risks.
Finally, an internal test is extremely important in situations where your company processes particularly valuable or sensitive data (e.g., trade secrets, highly sensitive personal data, financial data) and wants to make sure it is adequately protected from unauthorized access from inside the network. Even if access from the Internet to this data is blocked, vulnerabilities in the configuration of file servers, databases, internal applications or privilege systems can make them easy prey for someone already inside. An internal test will help identify and address these internal vulnerabilities.
Remember that security is an interconnected system. A strong perimeter is important, but without solid internal safeguards and regular verification of those safeguards, your organization is still at serious risk.
Which unique types of vulnerabilities and advanced attack techniques are specific to external testing and which to internal testing?
While both external and internal infrastructure penetration tests aim to identify vulnerabilities, due to their different perspective and starting point, they focus on different types of vulnerabilities and use slightly different, though sometimes overlapping, techniques and tools. Understanding these nuances allows one to better appreciate the comprehensiveness of a security assessment.
External tests - the battle on the foreground: Pentesters conducting external tests focus on anything that is visible and accessible from the public Internet. Their goal is to find a “hole in the wall.” Typical vulnerabilities and techniques include:
-
Outdated software and missing patches on public servers: Web servers (Apache, Nginx, IIS), mail servers (Exchange, Postfix), VPN servers (OpenVPN, IPSec) - if not updated regularly, they become easy targets for known exploits.
-
Network service configuration errors: Publicly accessible administrative panels with default or weak passwords, open proxies, vulnerable DNS services (e.g., allowing zone transfer), unsecured SNMP services.
-
Web application vulnerabilities (often tested in dedicated web tests, but can be part of an infrastructure test): SQL Injection, Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF) on publicly accessible interfaces.
-
Weak password policies and lack of MFA for remote access services: Allowing brute-force or credential stuffing attacks on VPN accounts, RDPs (if exposed to the public, which is bad practice), or administrative panels.
-
Information leaks: E.g., through publicly available metadata, directory listings on web servers, or misconfigured DNS records.
-
Denial of Service (DoS/DDoS) attacks: While the goal is not always to gain access, testing may include assessing resilience to flooding attacks. Techniques often include advanced port scanning, service fingerprinting, automated and manual searches for known vulnerabilities, attempts to forcibly crack passwords, and use of publicly available exploit tools and databases.
Internal testing - operations in the enemy’s rear: Once the pentester is operating inside the network, his capabilities and arsenal of techniques expand significantly. It focuses on escalating powers and moving around the network (lateral movement).
-
Weaknesses in Active Directory configurations: This is often the main target. Vulnerabilities such as Kerberoasting, AS-REP Roasting, unrestricted delegation, weak password policies for user and service accounts, ability to anonymously enumerate AD information.
-
Lack of network segmentation or weak rules on internal firewalls: Allowing free movement between different network segments and access to systems that should be isolated.
-
Unsecured network shares (SMB/NFS) and file servers: Often containing sensitive data or scripts that can be used for further attacks. Looking for shares with anonymous access or weak permissions.
-
Vulnerabilities of workstation and internal server operating systems: Missing patches, unnecessarily running services, weak local administrator passwords, possibility of intercepting NTLM hashes.
-
Man-in-the-Middle (MitM) attacks: E.g. ARP spoofing, DNS spoofing on the local network, allowing the interception and modification of network traffic, including credentials.
-
Exploitation of administrative tools and scripts: Often administrators leave tools or scripts (e.g. PowerShell) on the network that can be used by an attacker to automate actions or escalate privileges.
-
Weaknesses in the configuration of network printers, IoT devices and other “forgotten” assets: These can provide an easy beachhead for further attacks. Techniques include intensive scanning of the internal network, listening for traffic, using tools such as Mimikatz to extract credentials from memory, exploits for vulnerabilities in network services (e.g., EternalBlue), and advanced techniques to navigate Active Directory.
Understanding these differences allows for more informed planning of test coverage and better interpretation of test results in the context of overall defense strategy.
Is there a “golden mean,” i.e. how to strategically combine the two approaches to get the fullest picture of risk and optimize investments?
The question of whether to choose an external or internal test is often reduced to a false dichotomy. In fact, for a truly comprehensive and reliable picture of an organization’s security posture, the two approaches should not be treated as alternatives, but as complementary elements of a broader strategy. “The golden mean” is not to choose one at the expense of the other, but to intelligently and strategically combine them in a way that maximizes the value of the information obtained and optimizes security investments.
One of the most effective approaches is to conduct an external test as a first step and then, depending on its results and the vectors identified, plan a more targeted internal test. If the external test reveals serious vulnerabilities to penetrate the perimeter, the next logical step is to see what an attacker could achieve by exploiting that very beachhead. This “general to specific” approach allows a realistic simulation of the full attack chain.
Another strategy is to regularly alternate both types of testing as part of an annual security plan. For example, a comprehensive external test might be conducted one quarter and the next quarter focus on an internal test of key segments of the network or systems. This cyclicality ensures that both aspects of security are regularly reviewed, while spreading costs and resources over time.
Also becoming increasingly popular is the Red Team Operations or Assumed Breach scenario approach, which inherently combines elements of both perspectives. In a Red Team Operation, a team of ethical hackers is tasked with achieving specific, defined goals (e.g., gaining access to specific data, taking control of system X), using whatever methods are available - both external and internal. “Assumed Breach” scenarios, on the other hand, assume that the attacker is already inside the network (e.g., via a compromised account) and focus on his detection, response and further escalation capabilities. Such advanced exercises provide extremely valuable information about an organization’s actual resilience.
Optimizing your investment here is about intelligently using the results of one test to target the next. If an external test reveals no easy routes into the network’s interior (which is a good sign, but rarely the case), it may mean that your perimeter defenses are solid, but it’s still worth running an internal test to check for resistance to insider threats or attacks that could bypass those defenses in other ways (such as through phishing). In turn, if the external test reveals weaknesses, those results can be a direct input for planning internal test scenarios.
It is also important not to treat these tests in isolation from other security-related activities, such as vulnerability management, security monitoring (SIEM/SOC), or employee training. Penetration test results should be an integral part of the security improvement cycle, providing feedback to all of these areas. For example, vulnerabilities discovered during the test should make their way into the vulnerability management program, and social engineering techniques that have proven effective should be included in subsequent employee training.
A strategic combination of external and internal testing, supported by a continuous risk management process, is the way to build a dynamic and adaptive defense strategy that can meet the challenges of today’s complex threat landscape.
How does nFlo design infrastructure penetration test scenarios to provide you with not just a list of vulnerabilities, but a viable strategy for strengthening your defenses?
At nFlo, we approach infrastructure penetration testing - both external and internal - as much more than a technical exercise to generate a list of vulnerabilities. Our goal is to provide you with a deep understanding of your actual risk profile and a concrete, practical strategy for strengthening your defenses that is tailored to your specific organization, industry and business objectives. We are not just interested in “what” is vulnerable, but more importantly in “why” and “how” to fix it in the most effective way.
Our process of designing test scenarios always begins with close collaboration with you and your team. We want to understand exactly what is most important to you - what are your “crown jewels” (critical data, systems, processes), what are your biggest security concerns, what are your regulatory requirements, and what are your real capabilities (budget, resources) to implement the recommendations. This “scoping” and “threat modeling” phase is critical for us to design a test that is as relevant and valuable as possible.
Instead of using generic, “out of the box” checklists, we create test scenarios that reflect real-world tactics, techniques and procedures (TTPs) used by cybercriminals targeting organizations like yours. We use our knowledge of current attack trends, specific threats to your industry, and information gathered during the reconnaissance phase (within the limits of the agreed-upon scope, of course). Our goal is to simulate attacks that are not only technically possible, but also likely in your context.
When conducting tests, our experienced and certified pentesters are not limited to simply running automated scanners. Yes, tools are an important support, but the real value lies in human intelligence, creativity and the ability to combine seemingly unrelated information to find non-obvious attack paths. The focus is not only on identifying individual vulnerabilities, but also on the possibility of chaining them (exploit chaining) to achieve deeper penetration or greater impact.
The report you receive from us is much more than just a technical list of problems found. Each identified vulnerability is described in detail, with an assessment of its actual business risk (not just technical CVSS), evidence of exploitability and, most importantly, specific, prioritized and practical recommendations for remediation. We strive to make our recommendations not only “what to do,” but also “how to do it” in the most effective and least disruptive way for your business.
What’s more, we always put the test results and our recommendations into the broader context of your security strategy. We help you understand how the identified issues fit into the overall risk picture, what processes or policies need improvement, and what long-term actions (e.g., training, technology investments, architecture changes) may be needed to build a more resilient organization.
At nFlo, we believe that a penetration test is not the end, but the beginning of the road to a more secure future. We are your partner on that path, providing not only technical expertise, but also strategic support to help you turn your test results into real, lasting improvements to your defenses.
External vs. internal penetration testing of IT infrastructure
| Aspect | Key information |
|---|---|
| Illusion of “Defensive Walls” | The traditional approach based solely on perimeter security is insufficient due to fluid network boundaries, insider threats and advanced security bypass techniques. A “defense-in-depth” strategy is needed. |
| When is an external test necessary? | Ownership of online services/resources, implementation of new public systems or significant modifications to existing systems, regulatory and industry requirements (e.g., PCI DSS), need for objective assessment of perimeter security. |
| When will an internal test reveal the greatest weaknesses? | Risk assessment after account/station compromise, verification of the effectiveness of network segmentation and internal access control, protection of sensitive internal data, after changes in internal architecture, mergers or acquisitions. |
| Unique vulnerabilities and attack techniques | External: outdated public server software, service configuration errors (DNS, SMTP), web application vulnerabilities, weak passwords/lack of MFA for remote access. Internal: Active Directory weaknesses, lack of segmentation, unsecured shares, OS vulnerabilities, MitM attacks. |
| Strategic combination of both approaches (“Golden Mean”) | External test as the first step, followed by a targeted internal test; regular, alternating execution of both types; Red Team / Assumed Breach scenarios; intelligent use of the results of one test to plan the next; integration with other security activities. |
| nFlo’s approach to designing infrastructure test scenarios | Close collaboration with the client (scoping, threat modeling), scenarios reflecting real-world TTPs of cybercriminals, a combination of automated tools and advanced manual techniques, a report with a business risk assessment and practical, prioritized recommendations, embedding the results in the broader context of the security strategy. |
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- IT Infrastructure Penetration Testing — IT infrastructure penetration testing is a controlled and ethical process of…
- Wi-Fi Network Penetration Testing — Wi-Fi network penetration testing is the process of assessing the security of…
- Penetration Testing — Penetration testing, also known as pentesting, is a controlled process of…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
Learn More
Explore related articles in our knowledge base:
- Common Security Vulnerabilities Detected During Penetration Testing
- Network Penetration Testing - Security Testing Process, Vulnerability Identification, and Threat Detection
- Penetration Testing vs Security Audit: What Are the Differences?
- Differences and Similarities Between Penetration Testing and Security Audits
- Physical security testing - effective infrastructure protection
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
