If you’re thinking about penetration testing, you’re already doing something many businesses leave too late: getting on the front foot.
A pen test is basically a controlled, legal “try to break in” exercise. The goal isn’t to scare you or catch anyone out — it’s to show you how an attacker could get in, what they could reach, and which fixes will reduce risk the fastest.
In the UK, this matters more than ever. The government’s Cyber Security Breaches Survey found 43% of UK businesses reported a breach or attack in the past 12 months, with average costs that can quickly add up once you include downtime and staff time.
So the big question becomes: do you need internal testing, external testing, or both? Let’s make that decision simple.
What “external” network penetration testing actually checks
An external penetration test focuses on what an attacker can see and touch from the internet — the same way a real criminal would start.
Think of it like walking around the outside of your building, checking doors, windows, and any side entrances you forgot existed.
External testing typically targets things like:
- Public-facing IP addresses
- VPNs and remote access services
- Email infrastructure and exposed authentication portals
- Web apps and login pages linked to internal systems
- Cloud services that are accidentally exposed
If you run a hybrid setup (office + remote working + cloud apps), you’ll often have more “internet-facing” points than you realise — and that’s exactly why external testing is a popular starting point.
If you want a quick overview of how Northern Star approaches this kind of work, start with Penetration Testing.
What external testing is great at spotting
External testing is especially good at finding:
- Exposed services you didn’t mean to publish
- Weak authentication (or missing MFA)
- Misconfigurations (especially around remote access)
- Known vulnerabilities that haven’t been patched
- Simple mistakes that become “big” problems (default settings, open ports, poor segmentation)
What external testing can miss
External testing doesn’t always show what happens after someone gets a foothold.
Because attackers don’t stop at the front door. If they get one password, one infected laptop, or one session token, the real damage usually happens inside the network.
That’s where internal testing comes in.
What “internal” network penetration testing actually checks
An internal penetration test simulates the scenario where the attacker is already inside your environment.
That could be:
- A compromised employee account
- A phished laptop
- A supplier account with access
- Someone on-site plugging into a spare network port
- A malicious insider (rare, but not impossible)
Internal testing is more like: “Right — assume someone is already in the building. How far can they go?”
It typically looks at:
- Lateral movement (can they jump from one machine to another?)
- Privilege escalation (can they become admin?)
- Internal application access (file shares, finance systems, CRM)
- Network segmentation (can they reach sensitive areas?)
- Data access and exfiltration paths
Internal tests often reveal the uncomfortable truth: the first break-in isn’t always the hardest part. Sometimes it’s what your systems let someone do after that.
The simplest way to choose: what are you trying to prove?
Instead of guessing, decide what you want the test to prove.
Choose external penetration testing if you want to prove:
- “From the internet, can someone break in?”
- “Are our remote access tools and public services hardened?”
- “Do we have dangerous exposures we’ve missed?”
- “Are we protected against opportunistic scanning and automated attacks?”
If you’re improving overall security controls, pairing external testing with ongoing protection is a strong combo — have a look at Security Services for the wider picture.
Choose internal penetration testing if you want to prove:
- “If one user gets compromised, can an attacker reach our crown jewels?”
- “Is our network segmented properly?”
- “Are admin privileges too broad?”
- “Would ransomware spread fast inside our environment?”
Internal testing is often the most eye-opening for businesses that have grown quickly, merged teams, or accumulated “temporary” permissions that became permanent.
When you need both (and most businesses eventually do)
In real incidents, attackers often use an external route to gain entry, then behave like an internal threat once they’re in.
That’s why many organisations treat external + internal as a sensible one-two approach:
- External test to reduce entry points
- Internal test to limit blast radius if entry happens anyway
This approach also aligns with what many frameworks and buyers expect when they ask, “How do you test security?”
Even if you’re aiming for basic, practical compliance, it’s worth understanding the difference between scanning and real testing. For example, the hands-on element of Cyber Essentials Plus includes internal and external vulnerability checks.
Common business scenarios: what should you do?
Here are some real-world “you’re probably here” situations.
1) You’re mostly cloud-based with remote staff
Start with external testing, because your risk concentrates around identity, remote access, and misconfigurations.
Then consider internal testing focused on:
- Identity controls (who can access what)
- Device security baselines
- Segmentation of cloud resources and shared data
If your setup includes migrations or shifting platforms, it’s smart to test after changes too — see Migrations (Platform to Platform) if you’re mid-project.
2) You have an office network with shared drives and “it just grew”
Internal testing is often the fastest way to see your true exposure.
You’ll learn:
- Whether one compromised laptop could reach everything
- Whether old accounts still have access
- Whether permissions match job roles (or history)
This is especially important when sensitive data sits on internal shares.
3) You’re in a regulated industry or deal with sensitive client data
You’ll usually want both, because you need to demonstrate:
- Strong perimeter posture (external)
- Strong internal controls and containment (internal)
And you’ll likely want to connect findings to practical improvements — that’s where ongoing guidance helps, not just a report. If you want that support style, Consulting is the natural follow-on.
4) You’ve had a near miss (or a real incident)
If you already know something went wrong, don’t just test the same area. A good approach is:
- External test to make sure the original entry route is shut
- Internal test to confirm the attacker couldn’t easily repeat the same spread
The UK government’s research on economic impact puts the average cost of a significant cyber attack at around £195,000 (across firm sizes and sectors). Once you’ve seen how quickly costs rise, it’s easier to justify doing testing properly.
What penetration testing is (and isn’t)
Penetration testing is incredibly useful — but it’s not magic, and it’s not the same as “you’re now secure”.
A pen test can tell you:
- Which vulnerabilities are exploitable in your setup
- What an attacker could access if they exploit them
- How far they can move (especially in internal tests)
- What to fix first for the biggest risk reduction
A pen test can’t tell you:
- That you’ll never be breached
- How every attacker will behave in the future
- Whether your staff will always spot social engineering
- Whether your environment will stay secure after major changes
That’s why the best outcomes come when pen testing feeds into a wider security plan: patching, hardening, monitoring, training, and repeat testing on a sensible cycle.
How often should you do internal and external testing?
There’s no single “right” schedule, but a good rule of thumb is:
- External testing: after major changes (new VPN, new firewall, new public services) and at least annually
- Internal testing: after network redesigns, major growth, mergers, or changes to identity/admin access — and again on a regular cycle
If you operate across sites or countries, network complexity rises fast, and repeatable testing matters even more — see Global Support and International Projects if you’ve got multiple offices in play.
What you should prepare before a pen test (so it’s actually useful)
You don’t need to overthink prep, but you do want the test to reflect reality.
Before you start, get clear on:
- Scope: what’s in and what’s out (systems, IP ranges, offices, cloud environments)
- Risk areas: what would hurt most if compromised (finance, customer data, operations)
- Critical times: avoid peak trading windows where disruption would be painful
- Success criteria: are you testing “can we be breached?” or “can we contain a breach?”
If you’re refreshing kit or standardising endpoints, it’s also worth making sure your estate is consistent — mixed hardware and half-updated software can create weird weak spots. Hardware and Software can help you tidy that up strategically, not just reactively.
The “most businesses need this” recommendation
If you want a simple, sensible recommendation that fits most UK SMEs:
- Start with an external network penetration test to reduce exposure.
- Follow with an internal test to check segmentation, access controls, and how well you’d contain an incident.
- Turn results into a practical fix plan (prioritised, not overwhelming).
- Retest after meaningful changes.
And if you’re unsure what you actually have exposed, or how your environment is structured today, it can help to begin with an IT and security review through your core provider relationship — IT Support and Management is designed around exactly that kind of ongoing visibility.
FAQs: Internal vs External Pen Testing
What’s the main difference between internal and external penetration testing?
External testing checks what an attacker can reach from the internet. Internal testing checks what happens after an attacker is inside your network (for example, through a compromised account or device).
Is vulnerability scanning the same as penetration testing?
Not really. Scanning identifies potential weaknesses, but a pen test goes further by validating what can actually be exploited and what impact that exploit could have in your real environment.
We’re a small business — do we really need internal testing?
Often, yes. Smaller businesses can have flatter networks (less segmentation) and broader permissions “because it’s easier,” which can make internal spread faster if a single account is compromised. The UK Cyber Security Breaches Survey shows breaches remain common across businesses, not just big enterprises.
Does external testing include websites and web apps?
It can. If your website, portal, or web app is part of your external attack surface (or links into internal systems), it’s a common part of scope — especially where login and authentication are involved.
How long does a pen test take?
It depends on scope: number of IPs, sites, cloud services, and whether you’re doing internal, external, or both. What matters most is agreeing scope clearly so the result is meaningful.
Will penetration testing disrupt our business?
A properly planned test should minimise risk of disruption, but any realistic testing can create load or unexpected behaviour — which is why good scoping and timing matter.
Should we do internal or external testing first?
If you’re unsure, start with external testing to reduce obvious exposure, then follow with internal testing to assess containment. If you’ve had an incident where an internal account or device was compromised, start internal first.
Ready to choose the right test (and get clear answers)?
If you want to know whether you should run an internal test, an external test, or a combined approach, the quickest way is a short scoping chat based on your setup, your risk areas, and what you need to prove.
Take a look at Penetration Testing and then get in touch via the Contact page — we’ll help you map the right option to your business, without drowning you in jargon.
