​An internal pen test examines the strength of the security controls placed inside your local area network. This includes internal physical networks, switches, routers, internal firewalls, servers, endpoints, and other infrastructure components that sit behind the perimeter. Internal systems are vulnerable due to misconfigurations, malware, weak access controls, unpatched systems, legacy protocols, information leaks, design flaws, unnecessary open ports, insider threats, rogue employees, and the end-user themselves. If vulnerabilities exist, depending on what the attacker's motives are, they can exploit those vulnerabilities to gain control, steal confidential information, obtain unauthorized access, and laterally move and escalate privileges within your network until their objective is completed, or their goals are met. Because of this, it is important to conduct an internal pen test to evaluate and assess your internal network security controls in order to prevent and deter such activities.

The main difference is the perspective of the attacker and the security layer we're attacking. When we conduct an external pen test, we simulate an attack from outside your technology perimeter, attempting to compromise your perimeter systems and services. When we conduct an internal pen test, we are attacking your internal systems from within your network's perimeter, emulating an insider threat or a hacker that has breached the perimeter. External testing is typically conducted using black-box and then gray-box techniques, whereas internal testing is typically conducted using gray-box and then white-box techniques. Except for the strategic and tactical approaches, the activities and processes we employ are based on the methodology we employ for external and other penetration testing.

​Most organizations combine the two and typically conduct an external audit followed by an internal audit. Why start with the external? due to the fact that external has a greater exposure and typically a larger attack vector. You'd want to prioritize areas with a higher exposure and a greater potential for risk to your organization. However, it ultimately depends on the risk level associated with your organization's current state of security. For instance, if, following a cybersecurity risk assessment, it is determined that an internal threat poses a greater risk profile than an external threat. It would be more beneficial to conduct an internal threat assessment first to mitigate the risk associated with that threat. A cybersecurity risk assessment is highly recommended prior to making any security-related decisions. It will prioritize critical areas and ensure that security initiatives are risk and value driven.