Internal penetration testing

An internal penetration test starts from a position inside your organisation. Common starting points are a standard staff laptop and account, a device plugged into the office network, or a remote worker’s VPN connection. From there, the tester works out how far that foothold could spread and what it could reach: file shares, business systems, administrator accounts and sensitive data.

It complements an external test rather than replacing it. A strong perimeter with a weak interior is a common pattern, and an internal test is how you find out whether you have one.

• Separation: whether parts of the network that should be kept apart, such as user devices and critical servers, really are.
• Accounts and permissions: whether everyday accounts have more access than they need, and how well administrator accounts are protected.
• Updates and configuration: whether internal systems are as well maintained as the ones facing the internet.
• Sensitive data: what an ordinary user, or a compromised one, could read or change.
• Detection: whether your monitoring noticed the test, and how quickly.

These line up with the NCSC’s 10 Steps to Cyber Security and its network security fundamentals, which recommend separating networks, restricting access to what each user needs, and limiting administrative interfaces. An internal test shows whether that design holds up in practice.

• After an external test, to understand the impact if the perimeter is ever breached.
• After significant change: a merger, a new office, a network redesign or a move of key systems.
• When a standard requires it, as PCI DSS does for the cardholder data environment, including any segmentation you rely on to reduce scope.
• As evidence for ISO 27001 or a customer’s security review.

• Starting point: agree what the tester begins with, such as a standard user account and laptop, or network access only.
• Delivery: on site, or remote through a device, virtual machine or VPN you provide.
• Ranges and sites: list the networks and locations in scope, and anything that must not be touched, such as fragile production or operational systems.
• Timing: testing hours, change freezes, and who to call if something is affected.
• Objectives: name the systems or data you most want to protect, so the test answers the question that matters.

The NCSC’s penetration testing guidance covers how a good engagement runs from scoping to follow-up, and that findings should carry a severity rating. For public sector systems, check the NCSC’s CHECK guidance for buyers.