Network Security
Network Penetration Testing Methodology: Internal vs External
How internal and external network penetration tests differ in scope, access, and goals.
LOZULA Senior Security Research Team
2025-11-25
7 min read
Key Takeaways for Security Teams
- External testing answers "can someone break in", internal testing answers "how far can they go once inside".
- A strong perimeter with a flat internal network is still a single-breach-away from full compromise.
- Both tests are commonly scoped together for a full picture of network risk.
External network penetration testing simulates an outside attacker probing your internet-facing perimeter, while internal testing simulates what happens once an attacker, or a malicious insider, already has a foothold inside the network.
External Testing: The Perimeter View
External tests start with zero internal access and work from what any attacker on the internet could see and reach.
- •Enumeration of public IP ranges, open ports, and exposed services
- •Testing VPN gateways, mail servers, and edge routers for known and configuration-based vulnerabilities
- •Attempting to pivot from an initially exposed service into internal systems
Internal Testing: Assume Breach
Internal tests assume an attacker (or compromised employee laptop) already has a foothold, and measure how far they can move.
- •Active Directory misconfiguration review: excessive privileges, weak Kerberos policies, stale accounts
- •Lateral movement testing between network segments and VLANs
- •Testing whether a single compromised workstation can reach domain admin