Think about the security of your home. You have two kinds of locks. The first is on the front door, in plain view of every passerby, and every so often someone may test how sturdy it is. The second is on the safe in your bedroom. Passersby have no idea it exists, but a guest who visits and happens to find the key knows all about it.

A company's network security works much the same way. It has two perimeters:

• The external perimeter is reachable from the internet. Anyone with port-scanning tools knows it is there.
• The internal network is the "safe," holding file servers, domain controllers, accounting systems, and the like. Weaknesses in its configuration are hidden from the outside world, but they can be obvious to an intern with guest access to the Wi-Fi.

A pentest is a stress test of these systems. Instead of hoping no one will try to "open" your doors, you bring in experts who will tell you honestly where the weak spots are. The key question for a company is where to run the test from: outside or inside? These are two fundamentally different tests.

Through the eyes of an internet stranger: the external pentest

An external pentest simulates an attack by an adversary who knows only as much about your company as they can find online. They have no badge, no login to your corporate email, no idea what your system administrator is even called (but an hour of digging on LinkedIn, and they have that too).

What gets tested:

• public IP addresses and domains;
• websites, mail servers, VPN gateways;
• open ports, outdated software versions, misconfigured services;
• people, if social engineering and phishing are in scope.

The logic of an external pentest is simple: anything reachable from the internet is reachable by attackers too. A pentester acts a real hacker and works through three key stages:

• Reconnaissance (OSINT): finding subdomains, mining open sources and hunting for credentials in past data leaks.
• Vulnerability discovery: spotting weak points, outdated software or misconfigured services.
• Exploitation: checking whether a flaw can actually be used to get in.

It's important to understand that a good pentest is not just an automated list of CVEs (known vulnerabilities). Its goal is to work out whether a given vulnerability lets an attacker build a real chain all the way to the company's critical resources.

Take a common example. A company forgets about a test VPN server it stood up a few years ago "for a couple of days," and it is still running on the default admin/admin credentials. An external pentest is exactly what surfaces these "forgotten" pieces of infrastructure before attackers do.

Internal pentest: what if the attacker is already inside?

An internal pentest starts from a different and far less comfortable assumption: that the perimeter has already been breached. Maybe through phishing, maybe through an infected employee laptop, maybe because someone simply plugged a personal router into the network. Either way, the attacker (or the pentester standing in for them) is already inside your network with an ordinary user's privileges.

This is where it gets interesting: lateral movement, the sideways spread across the corporate network. An attacker who gains access to one machine does not stop there. They keep moving: from the accountant's computer to the file server, from the file server to the backup server, and from there, with a bit of luck, to the domain controller. Picture it not as a single broken door, but as someone who has slipped into an office corridor and is now trying every next door with whatever tools they pick up along the way.

One of the main focus areas for pentesters during internal assessments is attacks on Active Directory. Active Directory is the "access pass system" of the corporate network, the thing that decides who can reach what. The trouble is that AD has been running in most companies for years. Over time it collects outdated settings, forgotten admin accounts, and misconfigured trust relationships. The result is often a house where half the doors open the moment you find the right key under the doormat.

Pentesters lean on techniques like Kerberoasting (grabbing Kerberos tickets for service accounts and cracking their passwords offline) or Pass-the-Hash (using a stolen password hash instead of the password itself). It sounds complicated, but in practice it comes down to one thing. If your AD runs on typical, dated settings, the path from a marketer's compromised laptop to full control of the domain can take just a few hours.

As you have probably gathered, the most dangerous vulnerability is not necessarily the highest-scoring one on CVSS (the scale that rates vulnerability severity). Sometimes a handful of seemingly minor issues, weak access rights, excessive privileges, reused credentials, or misconfigured trust relationships, line up into a single attack chain that ends at a critical resource. The only way to find risks like these is with a pentest.

So which pentest do you actually need?

The right choice depends on your current network architecture and your business goals. A combined approach is best for full coverage, but you can set priorities using the criteria below.

Choose an external network pentest when:

• you have any service exposed to the internet: a website, an API, a client portal, a VPN;
• you handle payments, customer personal data, or anything else a regulator cares about;
• you can't remember your last perimeter audit, or the honest answer is "never."

You need an internal network pentest when:

• the company runs Active Directory or any centralized access management system;
• employees use laptops outside the office (in other words, always);
• you have a large headcount, which makes you a bigger, more tempting target for phishing and everyday human error;
• you have already tested the external perimeter and want to understand what a breach would actually cost you.

Run both when:

• you are a financial institution, a healthcare company, a critical infrastructure or anyone else audited by regulators or partners;
• you run a hybrid network with both cloud and on-premises components;
• you are preparing for a certification, a tender, or due diligence ahead of an investment. In that case, chances are someone will ask to see a pentest report.

In short: an external pentest measures how well your "front doors" hold up against break-in attempts, while an internal one measures the risk and the potential scale of the damage once an attacker is already inside. And in most cases, that second scenario is the one with the more serious consequences.

How AI is changing network pentesting

Only a few years ago, mapping the perimeter of a large company was a grind. It took weeks of routine work to scan ports, enumerate services, and pick through outdated systems.

AI agents are now changing that scale entirely. During reconnaissance, they can process huge volumes of data far faster than anyone could by hand. They do not remove the work of finding and confirming vulnerabilities; they change its scale. Instead of a pentester manually combing through hundreds of hosts, services, and scan results, AI agents can correlate the collected data faster, find dependencies between services, match configurations against known vulnerabilities, form hypotheses about likely attack vectors and prioritize what to check first.

Take an example. A single exposed service, an outdated software version, and a weak configuration can look like three separate findings. AI agents have already gotten good at combining them into a potential attack scenario and pointing to where the connection might be. But it is the specialist who confirms whether that scenario holds up in a real environment, whether it can be exploited safely, and how dangerous it truly is for the business.

Using AI agents in pentesting is not about replacing the specialist; it is about sharpening their work. AI takes on the routine, freeing the expert to focus on what matters: testing complex hypotheses and weighing business risk. For a business, that means higher efficiency and a lower pentest bill. You are not paying premium rates for a specialist's time spent on routine, because AI clears it faster while the specialist concentrates on the findings that count. Ultimately, the human pentester's role shifts from routine vulnerability checking to oversight, validation, and the hard problems, exactly where human experience is still irreplaceable. That keeps the final report high in quality while the budget stays smaller and the scope grows wider.

If you want to know how ready your perimeter and internal network are for a real incident, without the cost of endless manual checks, order an AI Pentest of your infrastructure: automated reconnaissance and analysis, backed by expert validation of every finding.