Internal vs external penetration testing
External tests the internet edge. Internal assumes someone is already inside. You usually need both, in that order.
ITSIGN Administrator · January 15, 2025 · 2 min read
External testing answers: what can a stranger on the internet do with your public hosts, VPN and mail edge? Internal testing answers: what happens after a laptop is stolen, a phish succeeds, or a contractor is plugged into a spare switch.
Most incidents we see in Ontario and B.C. start on the outside and finish on the inside. A clean external report and a rotten internal estate is a common, expensive combination.
Which to book first
If you have never been tested, start external. Close the holes that face the world. Then book an assumed-breach internal test. That is the order insurers understand and the order that matches how attackers work.
Read more about how we run both on our penetration testing page.
Related reading
When a pentest is really for the insurance form
Be honest about the audience. Then still do the work so the form is not the only thing you get.
2 min read
Why the retest is the part you should not skip
A finding list without a retest is homework you never marked. Insurers and customers notice.
2 min read
Scoping a pentest without wasting money
Narrow the crown jewels. Write rules of engagement. Budget the retest. Everything else is theatre.
2 min read
Want this applied to your environment?
A short conversation, an honest assessment of your current setup, and a clear proposal. No obligation and no pressure.