Most compliance frameworks and auditors require both internal and external penetration testing, not one or the other. External tests simulate attacks from the internet against your public-facing infrastructure, while internal tests assume an attacker has already breached your perimeter or is operating as a malicious insider. The specific requirements—frequency, scope, and methodology—depend on your regulatory framework, but the underlying principle is universal: defense in depth demands testing from multiple threat perspectives.
Understanding this distinction matters more than ever in late 2026. CISA just added two PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog, with CVE-2026-109618 and CVE-2026-109619 enabling remote code execution on vulnerable PHP installations. These flaws demonstrate how quickly external attack surfaces can be compromised—and why external testing alone isn't sufficient. Once inside, attackers pivot laterally, which is exactly what internal penetration testing is designed to detect and prevent.
What's the Difference Between Internal and External Penetration Testing?
External penetration testing targets everything visible from the internet: web applications, email servers, VPNs, firewalls, DNS records, and any other public-facing services. The tester operates as an anonymous attacker with no prior access, attempting to breach your perimeter through reconnaissance, vulnerability exploitation, social engineering, or configuration weaknesses.
Internal penetration testing assumes the attacker has already gained a foothold inside your network—either through a successful external breach, a compromised employee device, or malicious insider access. Testers operate from within your internal network, attempting to escalate privileges, move laterally between systems, access sensitive data, and reach crown-jewel assets like databases, domain controllers, or financial systems.
The threat models are fundamentally different. External tests answer: "Can someone break in?" Internal tests answer: "If someone gets in, how much damage can they do?"
This week's headlines underscore both threat vectors. Attackers successfully exploited PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24—a clear external attack vector. Meanwhile, a former penetration tester used the ARTEX AI framework to steal 8.2 million data records from more than 90 organizations in South Korea—demonstrating the insider threat that internal testing simulates.
What Do Specific Compliance Frameworks Require?
Here's what major frameworks mandate:
PCI DSS 4.0 (Payment Card Industry Data Security Standard) requires both internal and external penetration testing at least annually and after any significant infrastructure or application upgrade. Requirement 11.4.1 mandates external testing of the cardholder data environment perimeter, while 11.4.2 requires internal testing. Tests must be performed by qualified internal resources or qualified external third parties, and all high-risk and critical vulnerabilities must be remediated and retested.
SOC 2 Type II audits typically expect penetration testing as evidence for security controls, particularly in the CC7 (System Monitoring) and CC8 (Change Management) categories. While SOC 2 doesn't prescribe specific testing frequency, auditors generally look for annual testing of both internal and external attack surfaces, with more frequent testing for high-risk environments.
NYDFS Part 500 (New York Department of Financial Services Cybersecurity Regulation) requires covered entities to conduct annual penetration testing under Section 500.05. The regulation doesn't explicitly separate internal and external testing, but auditors interpret "penetration testing" to include both perspectives, particularly for institutions handling sensitive financial data.
HIPAA (Health Insurance Portability and Accountability Act) doesn't explicitly require penetration testing, but the Security Rule's risk analysis provisions (45 CFR § 164.308(a)(1)(ii)(A)) are commonly satisfied through regular penetration testing. OCR auditors increasingly expect both internal and external testing as evidence of ongoing security evaluation.
CMMC 2.0 Level 2, required for Department of Defense contractors handling Controlled Unclassified Information, mandates assessment of security controls that typically require penetration testing evidence. Practice CA.L2-3.12.4 explicitly requires security assessments, which DoD auditors interpret to include both internal and external penetration tests.
How Often Should You Test Each Type?
Annual testing is the regulatory minimum for most frameworks, but practical security demands more frequent assessment:
- External penetration testing: Annually at minimum, quarterly for high-risk environments, and after any major infrastructure change or new public-facing application deployment
- Internal penetration testing: Annually at minimum, with additional testing after network architecture changes, merger/acquisition activity, or when new critical systems are deployed
- Continuous validation: Many organizations supplement annual penetration tests with quarterly vulnerability scanning and monthly automated security assessments
The current threat landscape supports more frequent testing. Industrial vendors including Siemens, Schneider Electric, and ABB are scrambling to check products for PHP2Shell vulnerabilities, highlighting how quickly the attack surface evolves. Hackers infected 953 online stores with scanner-evading JavaScript, most running Magento, in a campaign active since July 2025—demonstrating persistent threats that annual testing might miss.
What Should Each Test Include?
External penetration testing scope typically covers:
- Reconnaissance and OSINT gathering
- Network perimeter scanning and enumeration
- Web application testing (OWASP Top 10, business logic flaws)
- Email security testing (SPF, DMARC, phishing susceptibility)
- VPN and remote access security
- Cloud infrastructure configuration review
- Social engineering exercises (with authorization)
- Wireless network security (if in scope)
Internal penetration testing scope typically includes:
- Internal network enumeration and mapping
- Privilege escalation attempts
- Lateral movement and pivoting
- Active Directory security assessment
- Internal application security testing
- Database security evaluation
- Credential harvesting and password policy testing
- Physical security integration (badge access, server room security)
- Data exfiltration simulation
Common Mistakes Organizations Make
The biggest mistake is testing only external attack surfaces. Auditors consistently cite this gap during compliance assessments. Organizations assume their firewall provides adequate protection, but CERT-UA warned of unauthorized remote access to Dahua IP cameras exploiting P2P access and authentication weaknesses—devices sitting inside the network perimeter.
Another common error is treating penetration testing as a checkbox exercise. Tests should be tailored to your specific environment, threat model, and compliance requirements—not generic scanning reports. The University of Copenhagen data breach exposed data of 525,000 people through a compromised test environment, illustrating how non-production systems require security attention too.
Organizations also frequently fail to retest after remediation. Finding vulnerabilities is only valuable if you verify fixes actually work. Energy giant ENGIE disclosed a data breach affecting customers after attackers breached a marketing platform used by business partners—third-party connections that internal testing should evaluate.
How to Plan Your Testing Program
Start by identifying your compliance obligations and mapping them to testing requirements. Document your scope clearly: which systems, applications, and network segments require testing, and which are explicitly excluded.
Budget realistically. External penetration tests for small to mid-sized organizations typically range from $5,000-$15,000 depending on scope complexity. Internal tests run $8,000-$20,000 due to the time-intensive nature of privilege escalation and lateral movement testing. Large enterprises or complex environments can exceed $50,000 for comprehensive testing.
Schedule tests during periods that balance operational impact with realistic simulation. Some organizations prefer off-hours testing to minimize disruption; others insist on business-hours testing to evaluate real-world detection and response capabilities.
Ensure your team is prepared to respond. Testing often reveals vulnerabilities requiring immediate attention—have a remediation process and responsible parties identified before testing begins.
Document everything for auditors: scope agreements, testing methodologies, findings reports, remediation evidence, and retest results. Compliance auditors want to see a complete testing lifecycle, not just a final report.
What Happens During an Audit
Auditors will request penetration testing reports and verify several elements:
- Both internal and external testing were performed
- Testing occurred within the required timeframe (typically past 12 months)
- Qualified testers performed the assessment (credentials, experience, independence)
- Critical and high-risk findings were remediated
- Remediation was validated through retesting
- Testing scope covered all in-scope systems and applications
Auditors may interview your security team about testing methodology, findings, and remediation processes. They'll cross-reference penetration testing results with other security controls—vulnerability management, patch management, incident response—to ensure consistent security posture.
If you're preparing for an audit and need both internal and external penetration testing performed by qualified assessors who understand compliance requirements, Vici Tech Solutions provides comprehensive testing services tailored to your specific regulatory framework and business environment.