Internal Penetration Testing: The 80% of Your Servers Your External Test Never Sees
An internal penetration test simulates an attacker who already has a foothold inside your network. Starting from one compromised host, it measures what they can reach without tripping your defenses, mapping the lateral movement paths and trust assumptions that turn a single stolen login into a full breach. External tests never cover this ground.
Here is the part of a breach most external tests will never show you. The attacker is already inside. They have one laptop, one stolen session, and a full afternoon. What they do next decides whether this stays a footnote in your incident log or becomes a ransom note on your CEO's desk.
In October 2026, the SafePay ransomware gang, which CISA, the FBI and international law enforcement agencies flagged in a joint advisory this month, had compromised at least 600 organizations worldwide since August 2024 [4]. The initial access was unremarkable: stolen credentials, brute force, phishing, or an exposed internet-facing system. The damage was not. SafePay moved through victim networks using legitimate administrative tools, copied sensitive data, disabled backups, and encrypted what it could not steal. That is what a foothold becomes when nobody has tested how far it travels.
This is what the internal penetration test is for. Below is what an internal penetration test actually covers, how fast the movement really happens, and how to scope one that answers the questions your external test left open. In our assessments, the pattern is consistent: teams treat the external test as the security test, and when we start from a single compromised host inside the network, the interesting findings are almost never ones an external test could have seen.
What Does an Internal Penetration Test Actually Cover?
An internal penetration test assumes initial access. The tester starts from a compromised host inside your network, a workstation, a server, or a VPN session, and works outward the way a real intruder would: harvesting credentials, escalating privileges, and moving laterally toward the systems that matter.
NIST SP 800-115, the US government's technical guide to information security testing and assessment, treats internal and external security testing as distinct activities with different techniques and different coverage [1]. In practice, the internal test follows a predictable path:
- Credential discovery on the starting host: saved RDP connections, tokens, passwords in scripts, service account secrets
- Local privilege escalation on that host
- Lateral movement over RDP, SMB, SSH, or legitimate administrative tooling
- Access to sensitive data, domain or network administration, backup systems, or production
- Persistence checks, where the scope allows
The reason this work matters is that internal trust is granted far more broadly than anyone intended. In Zero Networks' 2026 Lateral Movement Exposure Report, based on 54 trillion activities across 312 live enterprise environments, 80% of enterprise servers are reachable from anywhere inside the network, 87% accept inbound RDP or SSH from broad internal sources, and 43.2% of internal authentication still runs on NTLM [2]. The report's headline finding: a single compromised host can reach 85% of internal systems on the first hop [2].
Clients are often surprised to learn that the host we choose as the starting point is rarely the most privileged one. A mid-tier workstation in a sales or support team is usually enough to reach the database, because internal trust is granted broadly, not by design.
How Fast Can Attackers Move Laterally After a Foothold?
Slower than you hope. ReliaQuest's 2025 lateral movement data puts the average time to first lateral movement at 34 minutes, down 29% from 48 minutes in 2024, and the fastest documented intrusions moved laterally in as little as 4 minutes [3]. Meanwhile, the Warlock ransomware group exploited a SharePoint exposure in October 2026 to disable security protections on at least 40 hosts and deploy ransomware on at least 33 systems in a single intrusion [4].
When we run an internal test, we time that same journey. From a deliberately unprivileged starting host, the route to domain administration or to the client's most sensitive dataset frequently takes hours, not days, and it uses only the tools the starting host already has. The network is not holding the attacker back. The attacker is being held back by chance.
If you have not tested from inside in the last 12 months, every network, identity, and application change since then has been untested. That is a gap a scanner will not show you, because a scanner measures configuration, not the path an attacker takes through trust relationships.
Our managed penetration testing services run both: automated coverage between manual engagements, and manual depth when you need it. Automated penetration testing starts at a price that fits a quarterly testing cycle: see what $1,995 gets you. If you are comparing providers, see how Clone Systems compares with Intruder before you sign a proposal.
Internal vs External Penetration Testing: What Each One Proves
The two tests answer different questions. They are complementary, not interchangeable.
| External test | Internal test | |
|---|---|---|
| Starts from | The internet | A compromised internal host |
| Proves | Whether an outsider can gain initial access | What that initial access is worth |
| Typical findings | Exposed services, weak edge authentication, unpatched internet-facing systems | Lateral movement paths, credential exposure, over-broad internal trust |
| Misses | Your entire internal network | Your perimeter |
A clean external result does not mean a safe network. It means an outsider cannot walk in the front door. The attacker who arrives through your help desk, your VPN, or your third-party vendor does not use the front door, and NIST SP 800-115 describes the two approaches as separate testing activities for a reason [1].
If your testing is compliance-driven, note that PCI DSS requirement 11.4.2 treats the internal penetration test as a separate obligation from the external test under 11.4.3. A detailed look at that scoping gap is covered in why PCI DSS internal penetration testing finds the systems your scope diagram missed.
How to Scope an Internal Penetration Test Worth the Price
A single penetration testing engagement typically runs $10,000 to $20,000, depending on scope and environment size [5]. That number buys you coverage, and coverage is only as good as the scope. Two internal tests at the same price can answer completely different questions.
Costs scale with the number of starting hosts, the size of the network, and whether the test touches web applications or privileged environments. Our penetration test cost guide breaks down what moves the number.
Before you book anything, run this three-question check on your own environment:
- If a mid-tier workstation in your sales team were compromised today, how many hops to your most sensitive system? If you cannot answer, you do not know your lateral exposure.
- How many of your internal services accept RDP or SSH from the entire internal range rather than from a jump host? Zero Networks found 87% of enterprise servers accept broad internal RDP or SSH [2].
- When was the last time you tested from inside? If it is over 12 months, the segmentation assumptions your team relies on are untested.
Then scope the test with the Clone Systems First-Hop Scope Checklist, five questions to ask before you sign:
- Which host is the starting point, and why that one?
- What are the crown jewels: the data, systems, and accounts that make this test a success?
- What is measurable success, for example domain administration or access to a named dataset?
- Which systems are safe harbor, and what is the abort signal?
- Is retest included, and what is the remediation window?
Send the checklist to every vendor you shortlist. A serious testing firm will answer all five before you sign anything.
How Clone Systems Can Help
Clone Systems runs internal penetration tests as part of our managed penetration testing services, with automated coverage between manual engagements so lateral movement paths are tested continuously, not just annually. In our work the pattern is consistent: the external test finds the front door is locked, and the internal test finds the house keys under the mat.
If you are evaluating vendors, start with our guide to choosing a penetration testing vendor. It gives you a five-signal scorecard for comparing proposals line by line, on scope, evidence, testers, retests, and outcomes.
Frequently Asked Questions
What is an internal penetration test? An internal penetration test simulates an attacker who already has a foothold inside your network. Starting from one compromised host, the tester works to move laterally, escalate privileges, and reach sensitive systems without tripping your defenses.
How is an internal penetration test different from an external one? An external test attacks from outside your perimeter, while an internal test starts from inside, as if initial access had already happened. Each proves something the other cannot, and most compliance programs treat them as separate obligations.
How much does an internal penetration test cost? A single penetration testing engagement typically runs $10,000 to $20,000, depending on scope and environment size [5]. Automated testing starts at a lower price point, and manual expert-led tests are scoped to your environment.
How often should we run an internal penetration test? At least once a year, and again after any significant change to your network, identity, or applications that could open new lateral movement paths. If a compliance program applies to you, check whether it defines its own cycle for internal testing.
Can an internal penetration test disrupt production systems? Not if it is properly scoped. A professional engagement defines safe harbor systems, rules of engagement, and abort conditions before any testing begins.
What do we get from an internal penetration test? A report that maps every path the testers used from the starting host to your sensitive systems, with evidence, severity ratings, and remediation guidance for each one. The deliverable is a prioritized list of the trust assumptions that need to be broken.
Conclusion
Your perimeter gets the tests. Your network gets the trust. Test the trust while it is cheap to do so, and you will know exactly what one compromised host is worth in your environment. Book an internal penetration test with Clone Systems and find out how far the first hop really goes.
References
[1] NIST SP 800-115, Technical Guide to Information Security Testing and Assessment, NIST (2008). https://csrc.nist.gov/pubs/sp/800/115/final [2] Zero Networks, 2026 Lateral Movement Exposure Report. https://zeronetworks.com/resource-center/reports/2026-lateral-movement-exposure-report [3] ReliaQuest, Threat Actors Achieve Lateral Movement in as Little as 4 Minutes (2025 lateral movement data). https://reliaquest.com/news-and-press/threat-actors-achieve-lateral-movement-in-as-little-as-4-minutes-reliaquest [4] Cyber Management Alliance, Biggest Cyber Attacks, Data Breaches, Ransomware Attacks: October 2026. https://www.cm-alliance.com/cybersecurity-blog/biggest-cyber-attacks-data-breaches-ransomware-attacks-october-2026 [5] TCM Security, How Much Does a Penetration Test Cost. https://tcm-sec.com/how-much-does-a-penetration-test-cost [6] Clone Systems, Why PCI DSS Internal Penetration Testing Finds the Systems Your Scope Diagram Missed. https://www.clone-systems.com/blog/pci-dss-internal-penetration-testing-scope-gap [7] Clone Systems, How to Choose a Penetration Testing Vendor. https://www.clone-systems.com/blog/how-to-choose-a-penetration-testing-vendor [8] Clone Systems, Managed Penetration Testing Services. https://www.clone-systems.com/managed-penetration-testing-services/ [9] Clone Systems, Penetration Testing Pricing. https://www.clone-systems.com/pricing?mode=pentest