NexusSec.Both are penetration tests, but they answer different questions. Knowing which question you need answered decides the scope, the effort and what you will be fixing afterwards.
External penetration testing
An external test starts from what anyone can see on the internet. Testers map your public IP addresses and domain names, find the services that answer, and try to get in through them. A typical scope includes:
- Firewall and VPN gateways, and any admin or user portals they expose.
- Remote Desktop or other remote access reachable from the internet.
- Websites, customer portals and APIs.
- Mail servers and webmail.
- Anything forgotten, such as an old test server or a camera recorder with a public address.
Our guide to finding your internet exposure shows how to start that list yourself.
Internal penetration testing
An internal test starts from inside the network, usually a laptop on an office network port or a VPN account, standing in for a phished employee or a compromised device. It looks at:
- Whether a normal user can reach servers, backups, CCTV recorders and management interfaces.
- Weak, reused or never-changed passwords, and old accounts that were never disabled.
- Unpatched internal systems.
- Whether segmentation between network zones actually blocks traffic.
- How quickly an attacker could gain administrator rights over the domain.
Side by side
| External test | Internal test | |
|---|---|---|
| Question it answers | Can someone on the internet get in? | If someone gets in, how far can they go? |
| Starting point | The public internet | Inside the network, or on the VPN |
| Typical findings | Exposed services, unpatched edge devices, weak web applications | Flat networks, weak passwords, too many admin rights |
| Mostly fixed by | Firewall rules, patching, closing services | Segmentation, account clean-up, patching |
Which to do first
If you can only do one this year, start with external: anything it finds can be reached by anyone, today. But phishing and stolen passwords are common ways in, and they bypass the firewall entirely, so plan the internal test too. That is where problems like a flat network show up.
Assumed-breach testing
Some internal tests start from an ordinary user account rather than a network port. This is often called an assumed-breach test. It answers a very practical question: if one member of staff is phished tomorrow, what could the attacker do with their account?
Scoping both
- List your public IP addresses and domain names, and confirm you own or control each one.
- Tell the testers where applications are hosted. Cloud and hosting providers have their own rules on testing, so check them, and do not test a supplier's platform without its permission.
- Agree the internal starting point: a network port, a VPN account or a user account.
- Agree testing windows, and name any fragile systems that need care.
Our network penetration testing covers both, and the VAPT cost guide explains how scope affects the price.
