External vs Internal Penetration Test: Which Comes First?

A food distributor on Montréal's South Shore asks three vendors to quote on "a pentest." The first one replies with a question: external or internal? The second quotes both. The third sends a price without asking anything. The CFO just wanted to know whether the company was well protected.

The distinction is actually simple. An external test answers: "Can a stranger on the internet get in?" An internal test answers a different question: "If someone is already in, how far can they go?"

Both are useful, but rarely at the same time or on the same budget. Here is how they differ and which one to start with for your situation.

External testing: what an attacker sees from the internet

An external test simulates an attacker who knows only your company name and domain. It starts with reconnaissance: public IP addresses, subdomains, exposed services, employee email addresses found online. Then the tester tries to exploit what turns up, following the phases described in recognized guides such as NIST SP 800-115: planning, discovery, attack and reporting.

Typical findings at a small business:

• Remote Desktop (RDP) opened directly to the internet "temporarily" three years ago;
• the firewall's admin interface reachable from outside;
• a VPN or firewall missing a critical security patch;
• a forgotten subdomain still pointing to a former hosting provider;
• a web portal whose login doesn't require multi-factor authentication.

External tests are relatively short and light on your operations. Your staff barely notice; you mainly provide the list of in-scope addresses and domains.

Internal testing: when the attacker is already inside

Most serious attacks don't begin with a spectacular firewall exploit. They begin with an employee clicking a link, or with stolen credentials. An internal test reproduces that scenario: the tester gets the equivalent of an ordinary workstation, sometimes a standard user account, and tries to become a domain administrator.

On a Windows network with Active Directory, they often find:

• legacy name-resolution protocols (LLMNR, NBT-NS) that let them capture credentials;
• weak or reused passwords, including on service accounts;
• the same local administrator password on every workstation;
• file shares readable by everyone, with payroll files or password spreadsheets inside;
• no separation between office PCs, servers and, at a manufacturer, production equipment.

What makes internal testing valuable is time. According to a 2025 CDW study, the time it takes small Canadian organizations to detect an incident rose from 4.0 days in 2024 to 6.8 days in 2025. That is plenty of time for an intruder moving freely through your network to reach your backups before anyone notices.

A common variant is the assumed breach test. Instead of spending days trying to phish an employee, the tester starts from credentials you provide for a standard user account. It is a pragmatic shortcut: you are not paying to prove that someone, someday, will click a link. You are paying to find out what happens next, and how quickly your team or your MSP notices.

External vs internal: side by side

Canadian vendors publish very wide ranges, from a few thousand to several tens of thousands of dollars depending on scope (for example, Packetlabs, August 2026). Retesting is often billed separately. To see what drives the price up, read our article on penetration testing cost in Québec.

Two grey areas are worth flagging. Wi-Fi is usually tested on site and belongs with the internal side: a poorly isolated guest network often leads straight to the servers. Cloud services (Microsoft 365, Google Workspace, SaaS apps) are neither truly "external" nor "internal." Their main risk is configuration, which is better checked through a dedicated audit.

Where to start: three small-business profiles

An accounting firm in the West Island, 15 people, everything in Microsoft 365. No servers in the office, laptops and cloud accounting software. The internal network is basically Wi-Fi and a printer. Here, a focused external test combined with a Microsoft 365 configuration review delivers more value than an internal test.

A manufacturer in Kitchener, 60 employees, servers on site. Active Directory, a file server, production management software, a few PLCs on the shop floor. Internal testing comes first: that is where ransomware would do its damage. External can follow, or be part of the same engagement to simplify coordination.

A physiotherapy clinic in Halifax with remote staff. Patient records, a VPN for admin staff, an online booking portal. Both tests make sense, because the VPN bridges outside and inside. If budget is tight, start external and plan internal within the year.

Still unsure whether you need a pentest, an audit or a simple scan? Our comparison of a security audit vs pentest vs vulnerability scan will help you decide.

Preparing for the test: checklist

A well-prepared test costs less and produces better results. Before day one:

• Sign a written authorization that defines scope, dates and permitted techniques. Without it, testing is unauthorized use of a computer under section 342.1 of the Criminal Code.
• Confirm you have the right to authorize testing of every target, especially anything hosted by a third party.
• List the exact IP addresses, domains and networks in scope, and those excluded.
• Name an emergency contact who is reachable for the whole test.
• Notify your IT provider or MSP so they don't block the tester thinking it's a real attack.
• Check that backups are recent and restorable.
• Agree on test windows, especially for sensitive production systems.
• Block time in the calendar for fixes, then for the retest.

After the test: from report to action

A penetration test is only worth what you do with it. The report ranks vulnerabilities by severity, explains how they were exploited and recommends fixes. To get the most out of it, read our guide on how to read a penetration test report without being a technician.

Our team performs both external and internal tests, with a report written for leadership as much as for IT. Details are on our penetration testing page.