Internal vs External Penetration Test Cost (2026)

What external pentests cover

An external pentest treats your internet-facing perimeter as the target. The tester operates from outside your network, with only the agreed scope (IP ranges, domains, hostnames) and a Letter of Authorisation. The methodology aligns with NIST SP 800-115 and covers external attack surface enumeration, vulnerability identification through scanners and manual review, exploitation of identified weaknesses, and limited post-exploitation if a successful breach demonstrates impact.

Common external pentest findings include: VPN misconfigurations that allow brute-force or credential replay, exposed admin interfaces (RDP, SSH, internal web admin panels), default credentials on internet-exposed appliances, unpatched CVE-grade vulnerabilities on internet-facing systems, and information disclosure through verbose error messages or directory listing.

External pentests are easier to scope and cheaper to deliver than internal pentests because the surface is bounded (you have a finite list of internet-exposed hosts) and the testing does not require any coordination with internal IT to provide network access. Most external engagements complete in 5-7 testing days for an SMB scope.

What internal pentests cover

An internal pentest is structurally different because the tester starts inside the perimeter. The most common modern variant is assumed-breach: the tester is given low-privileged credentials and access to a typical user workstation (or a jump-box on the network), simulating an attacker who gained initial access through phishing, malware, or supply chain compromise.

Internal pentest activities typically include: Active Directory enumeration with BloodHound or similar tooling, Kerberos-based attacks (Kerberoasting, AS-REP roasting, Golden Ticket detection), lateral movement across hosts via SMB, WMI, and remote protocols, privilege escalation on individual systems, sensitive data discovery on file shares and databases, and persistence simulation. The mission objective is usually to demonstrate Domain Admin acquisition or equivalent within the engagement window.

Internal pentests cost more than external because the attack surface is larger (every internal host is potentially in scope), Active Directory testing is labour-intensive, and the tester needs more time to map the environment before targeted exploitation.

Cost matrix: scope combinations

Why internal commonly produces more findings

Across our buyer corpus, internal pentests consistently produce 3-5x more high and critical findings than external-only equivalents on the same target organisation. The pattern reflects the modern breach landscape: most successful real-world breaches reach impact through lateral movement after initial access, not through perimeter compromise alone.

Common internal-only findings include: weak Active Directory password policies that allow easy Kerberoasting success, over-privileged service accounts (Domain Admin equivalents on local servers), unpatched internal systems running CVE-grade vulnerabilities, lateral movement paths through forgotten jump-boxes and admin tools, sensitive data exposure on file shares accessible to all users, and privileged group memberships that violate least-privilege intent.

These findings rarely appear in external-only pentests because they are not reachable from the public internet. An organisation that only commissions external testing has limited visibility into the internal-attack-path component of its risk.

Compliance framework requirements

Most compliance frameworks expect both internal and external testing. The specific requirements differ by framework.

• PCI DSS v4.0.1: Both required annually (Req 11.4.2 external, 11.4.3 internal). Plus segmentation testing if applicable.
• SOC 2 Type II: Not formally required, but auditors usually expect both. External alone is increasingly seen as insufficient.
• ISO 27001: Annex A 8.8 requires technical vulnerability management evidence; both internal and external testing satisfies this.
• HIPAA: Risk analysis and risk management requirements imply both internal and external; auditors increasingly expect both.
• FedRAMP Moderate: Both required as part of the annual assessment. Internal testing must include all in-scope systems.
• CMMC Level 2: Internal testing required for in-scope systems. External recommended for organisations with internet-facing components.