Guide · networks
External and internal network testing.
An external test attacks what the internet can reach. An internal test starts inside, as a compromised laptop would, and shows how far an attacker can move. PCI DSS requires both every year; most others start external and add internal when there is an internal network worth protecting.
External: your internet-facing edge
Public IP ranges, VPN and remote-access gateways, mail and web servers, exposed admin panels and forgotten hosts. Give the firm your ranges and domains, and ask them to look for assets you didn’t list: those are often the finding.
Internal: what happens after the first foothold
Starting from one machine on your network, the tester looks for weak credentials, unpatched servers and Active Directory misconfigurations that let them move laterally and escalate. Reports usually describe the path step by step, often mapped to MITRE ATT&CK techniques.
Firms that list network testing
| Firm | Type | Pricing | Retest | Sample report |
|---|---|---|---|---|
| Astra Security | Hybrid | Published | Published | Open |
| Synack | PTaaS platform | Published | Published | Open |
| Bugcrowd | PTaaS platform | Not stated | Published | Open |
| Cobalt | PTaaS platform | Published | Published | Not stated |
| Horizon3.ai | Autonomous / AI | Published | Published | Not stated |
| Pentera | Autonomous / AI | Not stated | Published | Open |
| Praetorian | Hybrid | Published | Published | Not stated |
| Raxis | Consulting firm | Published | Published | Not stated |
| Bishop Fox | Consulting firm | Not stated | Published | Not stated |
| BreachLock | PTaaS platform | Not stated | Published | Not stated |
| HackerOne | PTaaS platform | Not stated | Published | Not stated |
| IOActive | Consulting firm | Not stated | Published | Not stated |
| Kroll | Consulting firm | Not stated | Published | Not stated |
| NCC Group | Consulting firm | Not stated | Not stated | Open |
| NetSPI | PTaaS platform | Not stated | On request | Open |
| Packetlabs | Consulting firm | Not stated | Published | Not stated |
| Secureworks (Sophos) | Consulting firm | Not stated | Published | Not stated |
| Terra Security | Hybrid | Not stated | Published | Not stated |
| TrustedSec | Consulting firm | Not stated | Published | Not stated |
| Trustwave SpiderLabs (now LevelBlue) | Consulting firm | Not stated | Published | Not stated |
| Black Hills Information Security | Consulting firm | Not stated | On request | Not stated |
| Coalfire | Consulting firm | Not stated | Not stated | Not stated |
| Mandiant (Google Cloud) | Consulting firm | Not stated | Not stated | Not stated |
| Optiv | Consulting firm | Not stated | On request | Not stated |
| Rapid7 | Consulting firm | Not stated | Not stated | Not stated |
| Rhino Security Labs | Consulting firm | Published | On request | Not stated |
From each firm’s own service pages, checked November 8, 2026.
Questions
What is the difference between an external and an internal penetration test?
An external test attacks what the internet can reach: your public IP ranges, VPN, email and web servers. An internal test starts inside, as a compromised laptop or a malicious insider would, and looks at how far an attacker can move, usually toward domain admin.
Do I need both?
PCI DSS 4.0 requires both, at least once every 12 months and after significant changes (requirement 11.4). Outside PCI, most organizations start external and add internal once they have an internal network worth protecting.
How is an internal test done remotely?
Most firms ship a small device or a virtual machine you plug into your network, and test through it. Agree in advance where it sits and when it is removed.
Sources for this page
- NIST SP 800-115 — External and internal testing in the standard methodology.
- PCI DSS document library — Requirement 11.4: external and internal testing every 12 months and after significant change.
- MITRE ATT&CK — The technique catalogue internal test reports often map to.
How firms are chosen, what counts as "published" and how to send a correction: methodology.
Cite this page
Pentesting Firms. "Network penetration testing: external and internal, explained." Updated November 8, 2026. https://pentestingfirms.com/network/