What is the difference between external and internal testing?

External testing looks at what is reachable from the internet. Internal testing starts from a position inside the network and examines what that position leads to. They answer different questions, and an engagement may include either or both depending on the scope you authorize.

Will testing take systems offline?

The intent is to avoid disruption, and testing is bounded by agreed rules of engagement. Some checks carry inherent risk to fragile services, so those are identified during scoping and either scheduled deliberately or excluded.

How is authorization handled?

Nothing is tested without written authorization covering the specific ranges, systems and timing. Where infrastructure is hosted by a third party, their authorization requirements have to be satisfied as well.

How often should network testing happen?

It depends on the rate of change. Networks that change frequently, or that have just undergone a migration, merger or significant infrastructure change, benefit from testing tied to those events as well as periodic validation.

OFFENSIVE SECURITY / NETWORK INFRASTRUCTURE

Network Penetration Testing

Q: How long does a network penetration test typically take?

Duration depends on scope: the number of IP addresses or hosts involved, whether testing covers external infrastructure, internal infrastructure, or both, and whether a retest is included. Timelines are agreed once these factors are known.

Identify weaknesses across authorized network infrastructure, exposed services and segmentation boundaries.

Talk to a Security Expert What we test ↓

Networks accumulate. Services get stood up for a project and stay running, firewall rules get widened during an incident and never narrowed, and a flat internal network quietly becomes the shortest route between a low-value foothold and something that matters.

Network testing asks two questions: what is reachable from outside, and what does reaching one internal system let you reach next.

From outside in

The value of the test is in the transitions — what each layer allows through to the next.

EXTERNALExternalInternet-facing addresses and exposed services
Perimeter controls
PERIMETERPerimeterFirewalls, gateways, remote access, published services
INTERNALInternal networkSegmentation, internal services, lateral reachability
Segmentation boundary
CRITICALCritical systemsSystems whose compromise carries real business impact

Conceptual. Which layers an engagement covers depends on the authorized scope.

// DEFINITION

What is network penetration testing?

Network penetration testing is a manual, engagement-based assessment of authorized network infrastructure, its exposed services and segmentation boundaries. It covers external testing of internet-facing infrastructure, internal testing from a position inside the network, whether segmentation between zones actually holds, service exposure beyond its intended audience, configuration weaknesses, and how individual findings chain into an attack path toward something of value. Where those exposed services include web applications, testing follows application-layer methodology such as the OWASP Top 10:2025 for Penetration Testers.

Who needs it? Enterprises, regulated industries, organizations with on-premise or hybrid infrastructure, managed service providers, and businesses with remote access, most often when an estate has grown by acquisition, segmentation is claimed but untested, new external exposure has been published, or periodic validation is due.

How TMG Security helps. TMG Security scopes authorized ranges and exclusions in writing, discovers live hosts and reachable services, enumerates and assesses configurations, analyses how findings chain into attack paths, and delivers a written report your team can act on.

// WHAT AN ENGAGEMENT CAN COVER

What an engagement can cover

External and internal testing are separate activities. Whether an engagement includes one or both is set during scoping.

// METHODOLOGY

Methodology

01SCOPEConfirm authorized ranges, systems, timing and exclusions in writing.
02DISCOVERIdentify live hosts and reachable services within that scope.
03ENUMERATEEstablish what each service is, and how it is configured.
04ASSESSTest for weaknesses that are relevant to the environment.
05PATHAnalyse how findings connect into routes toward critical systems.
06REPORTPrioritised findings with remediation guidance.

// CONTEXT

Why segmentation is usually the finding

Perimeters have generally improved. What has improved less is what happens after something inside the network is reached — through a phished credential, an exposed service or a third-party connection.

If a workstation subnet can reach management interfaces, backups and databases directly, then the difficulty of the initial foothold is doing all the work. Segmentation testing measures how much is really standing between a foothold and the systems that matter.

// WHAT YOU RECEIVE

A report your team can actually act on.

Exact deliverables and their format are confirmed during scoping.

EXECUTIVE SUMMARY

What was assessed, what was found and what it means, written to be read by people who will not read the technical detail.

TECHNICAL FINDINGS

Each finding described with enough precision for an engineer to locate and understand it.

EVIDENCE

Reproduction detail and supporting evidence, so findings can be verified rather than taken on trust.

RISK CONTEXT

Severity considered against your environment, not only against a generic scoring table.

REMEDIATION GUIDANCE

Practical direction on addressing each finding, including where a change belongs architecturally.

RETEST / VALIDATION

Verification that addressed findings no longer reproduce, within the agreed retest scope.

// WHO THIS IS FOR

Organizations this typically applies to.

EnterprisesRegulated industriesOrganizations with on-premise infrastructureHybrid environmentsManaged service providersBusinesses with remote access

Testing is scoped per engagement. Nothing here implies industry-specific certification or accreditation.

// WHEN THIS APPLIES

When Should Network Exposure Be Revisited?

01SITUATIONThe estate grew by acquisitionNetworks were joined and the combined exposure was never assessed.

02SITUATIONSegmentation is claimed but untestedThe diagram shows zones; nobody has verified the rule base agrees.

03SITUATIONNew external exposureServices were published to support remote work or a partner integration.

04SITUATIONPeriodic validation is dueNothing specific changed, which is usually when drift has accumulated.

// RELATED SERVICES

Adjacent parts of the attack surface.

Cloud Penetration TestingModern cloud environments introduce new identities, services and trust relationships. Assess them before those relationships become attack paths.VIEW SERVICE →Red TeamingSimulate realistic adversarial scenarios to evaluate how people, technology and security operations respond to an attack.VIEW SERVICE →Web Application SecurityIdentify security weaknesses across modern web applications before attackers exploit them.VIEW SERVICE →Offensive Security OverviewHow the seven testing services fit together across the attack surface.VIEW OVERVIEW →

// PRICING & ENGAGEMENT

How pricing and scope are determined

There is no published fixed price for network penetration testing. Each engagement is scoped and priced individually based on factors such as the number of IP addresses or hosts in scope, whether testing covers external infrastructure, internal infrastructure, or both, the complexity of network segmentation, and the testing depth agreed for the engagement. These factors are discussed during scoping before a quote is provided.

// FREQUENTLY ASKED

Questions we get asked before an engagement.

Request a Network Penetration Test

Share the shape of the environment — what is exposed, what is segmented and what matters most — and we will scope the engagement around it.

Talk to a Security Expert Build Your Security Blueprint