Network Penetration Testing: External vs Internal
Network penetration testing looks at the infrastructure your applications run on: servers, services, firewalls and the paths between them. For cloud-native startups it looks different from traditional office networks, but it still matters.
External network testing
An external test examines everything reachable from the internet:
- Port and service discovery across your IP ranges and domains.
- Service fingerprinting, identifying software and versions.
- Vulnerability matching, comparing versions against known CVEs.
- Exposed management interfaces, such as SSH, RDP, database ports, admin panels and VPN portals.
- TLS configuration on every service.
- Authentication weaknesses, like default credentials on exposed services.
Internal network testing
An internal test assumes the attacker already has a foothold, such as a compromised laptop or server, and looks at what they could reach:
- Lateral movement between hosts.
- Weak internal authentication and shared credentials.
- Active Directory or identity provider weaknesses.
- Unsegmented networks where workstations can reach production.
- Unpatched internal systems.
For cloud-first companies with no office network, the "internal" equivalent is often the cloud VPC and identity layer.
Common findings
| Finding | Example |
|---|---|
| Exposed databases | PostgreSQL, MongoDB or Redis open to the internet |
| Outdated services | Web server or VPN with a known CVE |
| Remote admin exposed | RDP or SSH open to all addresses |
| Default credentials | Admin panels, network devices |
| Weak TLS | Old protocol versions or weak ciphers |
| Forgotten hosts | Old staging or test servers still running |
Version-to-CVE matching
Many network findings start with identifying a service version and checking it against known vulnerabilities. This is useful but prone to false positives, because distributions backport fixes without changing version strings. Good testing verifies exploitability or confirms patch status rather than trusting versions alone.
How network testing fits modern companies
For a SaaS company running on managed cloud services, application and API testing usually find the most serious issues. But network exposure is where forgotten assets and quick fixes come back to haunt you: the database opened "temporarily," the old VM nobody shut down. External network testing catches them.
How often to test
- Continuously for the external attack surface, since one firewall change can expose a service.
- Annually or after major changes for deeper internal testing.
- As required by PCI DSS, which mandates internal and external testing.
Automated network testing
SecurityInfinity's network agent discovers open ports and services across your domains and IPs, matches versions to CVEs from its CVE database, and verifies findings before reporting. Start free.
Frequently asked questions
Is network pentesting still relevant for cloud companies?
Yes, especially external testing. Cloud makes it easy to expose services by accident.
What is the difference between a port scan and a network pentest?
A port scan lists open ports. A pentest identifies services, assesses vulnerabilities and attempts to verify exploitability.
Can network testing disrupt services?
Aggressive scanning can affect fragile services. Good tests use safe techniques and agreed rate limits.