External vs Internal Penetration Testing: Which Does Your Australian Business Need?

External vs internal penetration testing comes down to one question: where does the attacker start? An external pentest attacks you from the internet, the way a stranger would. An internal pentest assumes someone is already inside, through a phished laptop, stolen VPN credentials or a rogue insider, and measures how far they can get. Most Australian SMBs should start external, then add internal once staff, file servers, Active Directory or cloud tenancies hold data that matters.

This guide explains what each test covers, what they typically find, how Essential Eight, the Privacy Act and APRA CPS 234 affect the decision, and how to pick your first scope without paying for coverage you don't need. It sits alongside our guides on vulnerability assessment vs penetration testing and how to prepare for a pentest.

What is the difference between external and internal penetration testing?

An external penetration test is run from outside your security perimeter, usually from the internet; an internal penetration test is run from inside your network, as a trusted insider or an attacker who has already got past the perimeter. That is essentially how NIST SP 800-115 defines the two, and it's the split most Australian providers use when they scope.

The difference isn't the tools. It's the starting position, and therefore the question each test answers:

▸External: "Can someone on the internet get in, and what can they reach?"
▸Internal: "If someone is already in, how quickly can they become an administrator, reach sensitive data or move across the network?"

A quick comparison

▸Starting point: External starts from the public internet with no credentials. Internal starts on your network, often with a standard user account or a device plugged into the office LAN or VPN.
▸Typical targets: External covers public IP addresses, firewalls, VPN gateways, remote access portals, email and web servers, and exposed cloud services. Internal covers workstations, file servers, Active Directory, internal web apps, printers and management interfaces.
▸Threat modelled: External models opportunistic scanning, credential attacks and exploitation of unpatched edge devices. Internal models phishing follow-through, ransomware operators, compromised suppliers and insiders.
▸Common output: External reports on exposure you can see and fix at the perimeter. Internal reports on attack paths, privilege escalation and lateral movement.

What does an external penetration test cover?

An external pentest maps everything you expose to the internet and then tries to exploit it: open services, remote access, edge devices, login portals and misconfigured cloud resources. It answers the question insurers and customers usually mean when they ask "have you had a pentest?"

What testers typically do

NIST describes external testing as starting with reconnaissance of public information such as DNS records and registration data, then discovering hosts and listening services, then attacking what is allowed through. In practice that means:

Reconnaissance: finding domains, subdomains, IP ranges and forgotten assets (old staging sites, test servers, legacy mail gateways).
Service discovery: identifying what is listening and what version it is running.
Exploitation attempts: testing for unpatched vulnerabilities, default or weak credentials, exposed admin panels and authentication bypasses.
Validation: proving impact with evidence rather than listing theoretical CVEs.

Why edge devices matter so much right now

Internet-facing edge devices such as firewalls, VPN appliances and remote access gateways are a favourite entry point. ASD's Annual Cyber Threat Report 2024–25 says its ACSC observed more than 120 incidents associated with attacks on edge devices in FY2024–25, and 96% of them were successful. The same report notes ASD responded to over 1,200 cyber security incidents in that year, an 11% increase.

That lines up with the Essential Eight maturity model: even at Maturity Level One, patches for online services and the operating systems of internet-facing servers and network devices are expected within 48 hours when a vulnerability is critical or a working exploit exists, and within two weeks otherwise. An external pentest is a practical way to check whether that is actually happening at your perimeter.

What does an internal penetration test cover?

An internal pentest starts inside your network, usually with a normal user account or a device on the LAN or VPN, and tries to escalate privileges, move laterally and reach the data or systems that would hurt most. It tests the assumption that "once they're past the firewall, we're fine."

Common internal findings

Internal tests tend to find issues that never show up from the internet, such as:

▸Weak Active Directory hygiene: over-privileged service accounts, stale admin accounts and passwords that can be cracked offline.
▸Default credentials on internal appliances, monitoring platforms, printers and management consoles.
▸Legacy protocols that send credentials in cleartext or allow relay attacks.
▸No account lockout, which lets attackers brute-force logins without being stopped.
▸Flat networks, where a single compromised laptop can reach servers, backups and finance systems.
▸Sensitive files on open shares, such as spreadsheets of passwords or customer data.

These aren't hypothetical. Our published case study of an internal black-box test on Azure-hosted Windows servers for a financial services client found default credentials on a live security monitoring platform, a legacy remote access protocol sending credentials in cleartext, and no account lockout policy. A structured remediation validation four days later confirmed fixes with documented evidence for 8 of the 10 findings.

Why "assume breach" is the realistic model

The OAIC received 1,205 notifications under the Notifiable Data Breaches (NDB) scheme in calendar year 2025, the highest since the scheme began in 2018. Malicious or criminal activity accounted for 716 of them. Many of those attacks begin with a phished user or reused credentials, which is exactly the foothold an internal pentest simulates. The perimeter matters, but it won't stop every attack, so you need to know what happens next.

Which should you do first: external or internal?

For most Australian SMBs, start with an external pentest, because it covers the attack surface anyone on the internet can reach and it's what most insurance and customer questionnaires ask about first. Add an internal test when you have a meaningful internal network, on-premises or hybrid Active Directory, or sensitive data that a single compromised account could reach.

NIST also recommends that when both are done, external testing usually happens first, so testers don't pick up insider knowledge an outside attacker wouldn't have.

Start external if:

▸You're mostly cloud-based (Microsoft 365, SaaS apps) with a small office network.
▸A customer, insurer or tender asks for "a penetration test" without further detail.
▸You've never had independent testing and need a first baseline.
▸You run remote access (VPN, RDP gateways, Citrix-style portals) or self-hosted web services.

Add internal if:

▸You have on-premises servers, file shares or Active Directory (including hybrid setups).
▸Ransomware is your biggest business-continuity risk.
▸You handle health, financial or large volumes of personal information.
▸Your board, insurer or auditor wants evidence about lateral movement and privilege controls, not only perimeter exposure.
▸You're APRA-regulated or supply APRA-regulated entities (more on that below).

If you're unsure, a discovery call is quicker than guessing. We'll usually recommend the smallest scope that answers the question your buyer, insurer or board is actually asking.

How do Australian compliance frameworks affect the choice?

No Australian framework says "you must do an internal pentest", but several expect you to test controls in a way that only makes sense if you look both outside and inside. Here's how the common ones play out.

Essential Eight

The Essential Eight is a maturity model, not a pentest standard. External testing checks perimeter patching and exposure; internal testing helps show whether controls like restricting administrative privileges, MFA and application control hold up once an attacker is inside. Neither replaces a control-by-control maturity assessment. If maturity evidence is the goal, you need an Essential Eight assessment as well. See our ML1 vs ML2 guide for the difference in expectations.

Privacy Act and the NDB scheme

Under APP 11, organisations covered by the Privacy Act must take reasonable steps to protect personal information. Since the Privacy and Other Legislation Amendment Act 2024, the OAIC's APP 11 guidance makes clear those reasonable steps include both technical and organisational measures. Independent testing of where personal information actually lives, which is usually internal, is one way to show you've taken those steps seriously. It doesn't guarantee compliance, and it isn't legal advice.

APRA CPS 234

CPS 234 requires APRA-regulated entities to test the effectiveness of information security controls through a systematic testing program, run by appropriately skilled and functionally independent specialists. APRA's CPG 234 adds that controls protecting assets exposed to "untrusted" environments would typically be tested throughout the year. In practice that points to regular external testing plus internal testing of critical assets. Suppliers to banks, insurers and super funds are often asked to show similar evidence.

SOCI Act

If you're a responsible entity for a critical infrastructure asset under the Security of Critical Infrastructure Act 2018, your risk management program obligations will shape how often you test and how deeply. Treat pentesting as evidence that feeds that program, not a substitute for it.

How much do external and internal pentests cost in Australia?

Cost depends mostly on scope (how many IP addresses, applications and network segments) and depth, not on the label "external" or "internal". Aussie Pentest publishes fixed-fee starting points so you can budget before a call:

▸Basic, from $5,000 + GST: external network penetration test, up to 25 IP addresses, delivered in 5–10 business days.
▸Standard, from $12,000 + GST: external and internal network penetration test, up to 50 IPs and 2–3 web applications, with an executive summary and debrief.
▸Advanced, from $20,000 + GST: full-scale external and internal, web applications and APIs, plus social engineering.

If you aren't ready for a human-led engagement, an automated security assessment ($80 to $2,000) gives you an analyst-reviewed baseline of your external exposure. It's a scan with expert triage, not a penetration test, and we don't pretend otherwise. Our penetration testing cost guide breaks down the scope drivers in more detail.

What should you have ready before either test?

Before an external test, have an accurate list of domains and public IP ranges plus written authorisation from anyone who hosts them. Before an internal test, agree how testers get access (VPN, on-site device or a supplied laptop) and which systems are off-limits.

Asset list: domains, IP ranges, cloud tenancies and critical internal systems.
Authorisation: sign-off from your MSP, hosting provider or cloud provider where required.
Rules of engagement: testing windows, fragile systems, and who to call if something breaks.
Access method (internal): a standard user account, a VPN profile or a device on the network.
Remediation owners: who will fix findings, whether that's internal IT, your MSP or a developer.

Our pentest preparation checklist covers this step by step.

Frequently asked questions

Is an external pentest enough for cyber insurance?

Often it's what an insurer's questionnaire is asking about, but acceptance is always the insurer's decision. Many underwriters focus on MFA, backups, patching and remote access, which an external test helps evidence. Check the exact wording of your proposal form. Our cyber insurance and pentesting guide explains what insurers commonly look for.

Can an internal pentest be done remotely?

Yes. Many internal tests are delivered remotely through a VPN connection or a small device or virtual machine placed on your network, so testers don't need to be on site. The access method is agreed in the rules of engagement before testing starts.

Will a pentest disrupt our systems?

A well-scoped test is designed to avoid disruption. Fragile systems, testing windows and emergency contacts are agreed in writing beforehand, and destructive testing is excluded unless you specifically approve it. Internal tests on older infrastructure deserve extra care, so say so during scoping.

How often should we repeat external and internal testing?

Many organisations test at least annually and after significant changes such as a new VPN, a cloud migration or a major application release. Exposure changes faster than internal architecture, so some businesses test externally more often. See how often you should get a penetration test.

Is a vulnerability scan the same as an external pentest?

No. A scan identifies potential issues automatically; an external pentest has a human validate, chain and exploit them to prove real impact. Scans are useful for coverage and regular monitoring, but they don't give the same evidence.

Who should own the ongoing testing program?

Someone has to decide scope, track remediation and report to the board. If you don't have a security lead, a vCISO retainer provides advisory oversight of the program. That's advisory, not implementation or incident response.

The bottom line

External testing tells you whether strangers can get in; internal testing tells you how bad it gets when someone does. Start external if you've never been tested or a buyer simply asks for "a pentest". Add internal once you have on-premises or hybrid infrastructure, sensitive data or regulatory pressure to show controls work beyond the perimeter. Scope to the question you actually need answered, insist on proof-of-concept evidence, and plan remediation before the report lands.

Ready to scope yours? Explore our penetration testing services or book a 1-on-1 scoping call with the Aussie Pentest team.

This article is general information, not legal or compliance advice. Regulatory references are current as of September 2026.