Servicio de Ciberseguridad

Internal & External Pentesting

WHOAMI's Internal and External Pentesting service evaluates the security of your systems from different attack perspectives.

WHOAMI's Internal and External Pentesting service evaluates the security of your systems from different attack perspectives. An external pentest simulates attacks from the Internet, while an internal pentest evaluates security from within your network, identifying vulnerabilities that an internal or compromised attacker could exploit.

Internal and External Pentesting Service

WHOAMI offers its Internal and External Pentesting service to companies that need to evaluate the security of their systems from multiple attack perspectives. Our approach combines advanced pentesting techniques with knowledge of European and international regulatory frameworks relevant to organizations globally.

Internal and External Pentesting for Companies and SMEs

Our Internal and External Pentesting service adapts to both large organizations and SMEs that need to validate their security posture without depending exclusively on automated tools. A manual pentest performed by experts provides insights that automated scanners cannot detect.

Especially for SMEs, our pentests are designed to be efficient and deliver immediate value, identifying critical vulnerabilities that could be exploited in realistic scenarios and prioritizing remediation according to risk and operational impact.

Internal and External Pentesting Objectives

The primary objective of internal and external penetration tests is to identify security vulnerabilities before attackers discover and exploit them. These services provide a comprehensive security assessment from multiple perspectives.

Specific objectives include:

  • Identify vulnerabilities in systems exposed to the Internet that allow initial access or privilege escalation (external pentest)
  • Evaluate the security of internal networks and non-exposed systems that could be compromised after initial access (internal pentest)
  • Test the effectiveness of perimeter security controls against real attack techniques
  • Identify insecure configurations and system weaknesses that facilitate exploitation
  • Assess detection and response capabilities against intrusion attempts in realistic scenarios
  • Provide prioritized recommendations to remediate vulnerabilities according to operational impact

Key Responsibilities of Pentesting Service

The main responsibilities of our Internal and External Pentesting service include identifying security vulnerabilities through advanced manual techniques, evaluating the effectiveness of security controls against realistic scenarios, testing system resilience through controlled exploitation, assessing detection and response capabilities, and providing prioritized recommendations based on operational impact and attack context.

WHOAMI's Approach to Internal and External Pentesting

Unlike purely automated pentests or those based on checklists, our approach focuses on simulating real attacks executed by adversaries with clear objectives. We don't just identify vulnerabilities, we evaluate their real impact and the organization's detection and response capabilities.

Our pentesting service integrates:

  • Real attacker perspective: We use techniques and tools used by real attackers, not just automated scanners
  • Threat intelligence: We adapt our pentests according to active threats relevant to your industry and profile
  • Red Team connection: For deeper assessments, our pentests can scale to Red Team exercises that evaluate the entire response chain
  • Attack context: We don't just report vulnerabilities, we explain how an attacker would exploit them and what impact it would have

WHOAMI Difference

While other pentesting services limit themselves to running automated scanners and reporting vulnerabilities, our approach combines advanced manual techniques with real impact analysis. We don't just find vulnerabilities: we demonstrate how an attacker would exploit them and what impact it would have on your organization.

Pentesting Deliverables

  • Executive summary for leadership (risks, prioritization, next steps)
  • Detailed technical report with evidence and context
  • Risk prioritization based on operational impact
  • Results walkthrough meeting and remediation plan alignment

Internal and External Pentesting Benefits

The benefits of conducting internal and external pentests are fundamental to maintaining a solid security posture:

Comprehensive Coverage

The combination of internal and external pentests provides a comprehensive security assessment from all possible attack perspectives, identifying vulnerabilities that are only discovered from each perspective.

Early Identification

Identifies vulnerabilities before attackers discover them, allowing you to remediate them proactively and avoid costly security incidents.

Regulatory Compliance

Many regulations and standards (ISO 27001, PCI-DSS, etc.) require periodic pentests as part of security requirements, but our approach goes beyond compliance.

Control Validation

Validates that your security controls work correctly and are effective against real attacks, not just against automated scanners.

Internal and External Pentesting vs Automated Scanners

There is a fundamental difference between a manual pentest performed by experts and automated vulnerability scanners:

Manual Pentesting (Our Service)

  • Identifies complex and logical vulnerabilities that scanners do not detect
  • Evaluates the real impact of vulnerabilities in the context of your organization
  • Simulates real attacks executed by experts with clear objectives
  • Provides attack context and prioritized recommendations
  • Assesses detection and response capabilities against real attempts

Automated Scanners

  • Detect known vulnerabilities through signatures and databases
  • Do not evaluate real impact or attack context
  • Generate false positives that require manual validation
  • Cannot identify logical or complex configuration vulnerabilities
  • Do not assess detection and response capabilities

Recommendation: Automated scanners are useful as a complement, but they do not replace a manual pentest performed by experts. A manual pentest provides insights that scanners cannot detect and evaluates the real impact of vulnerabilities.

Internal and External Pentesting Process

Our Internal and External Pentesting service is designed to evaluate the security of your systems from multiple perspectives. The process adapts according to the type of pentest required.

External Pentest

An external pentest simulates attacks from the Internet against your publicly exposed systems:

  • Reconnaissance of external attack surface to identify potential attack vectors
  • Identification of exposed services that allow initial access or privilege escalation
  • Identification of vulnerabilities in web services and APIs that could be exploited for unauthorized access
  • Brute force and weak authentication testing that allows unauthorized access
  • Evaluation of firewall and protection system configurations against evasion techniques
  • Analysis of sensitive information exposure that facilitates targeted attacks

External Pentest Approach: We evaluate security from the perspective of an external attacker with no prior knowledge of your internal infrastructure, simulating a realistic attack scenario that reflects how a real attacker would attempt to compromise your systems.

Internal Pentest

An internal pentest evaluates security from within your network, simulating an attacker who already has access:

  • Network segmentation evaluation to identify lateral movement routes
  • Privilege escalation testing that allows access to critical systems
  • Internal system configuration analysis that facilitates exploitation
  • Identification of vulnerabilities in non-exposed systems that could be exploited after initial access
  • Internal access control evaluation that prevents or allows lateral movement
  • Lateral movement analysis in the network to identify routes to critical systems

Important: An internal pentest requires access to your internal network, so it is performed in a coordinated and controlled manner, with prior approval and following clear rules of engagement to protect your systems.

Threat-Led Methodology

Methodologies such as OWASP, PTES, or NIST serve as a base, but our pentests adapt to the real context of the organization, its sector, and the active threats affecting its environment:

  • OWASP Testing Guide: Base for web applications and APIs, adapted according to relevant threats
  • PTES (Penetration Testing Execution Standard): Standard methodology for pentests, adapted to real attack context
  • NIST SP 800-115: Technical guide for security testing, integrated with threat analysis
  • Custom methodologies according to the type of system evaluated and relevant threats

Threat-Led Approach

Unlike pentests that follow methodologies rigidly, our approach adapts techniques according to active threats relevant to your industry. We don't just follow a checklist: we simulate real attacks that reflect how current attackers would attempt to compromise your organization.

When Do You Need Internal and External Pentesting?

Internal and external pentests are recommended in the following situations:

  • After significant changes: After implementing new systems or making significant infrastructure changes that could introduce new vulnerabilities
  • Regulatory compliance: To comply with requirements from regulations such as PCI-DSS, ISO 27001, or sector regulations that require periodic assessments
  • Periodic assessment: As part of an ongoing security program (recommended at least once a year) to maintain a solid security posture
  • Before launches: Before putting new systems or critical applications into production to identify vulnerabilities before deployment
  • After incidents: To identify and remediate vulnerabilities after a security incident that could indicate systemic weaknesses

Best practices: It is recommended to conduct external and internal pentests periodically and complementarily. While external ones evaluate public exposure, internal ones identify risks from within the organization that could be exploited after initial access.

Do You Need an Internal and External Pentesting Service?

If your organization needs to evaluate the security of its systems from multiple attack perspectives, or validate that your security controls work correctly against real attacks, contact our team to evaluate if internal and external pentesting is right for you.

Our Internal and External Pentesting service provides a comprehensive security assessment from all possible attack perspectives, using advanced manual techniques and real impact analysis that automated scanners cannot provide.

Request Pentesting Information

Preguntas Frecuentes

Preguntas frecuentes

Preguntas frecuentes

What is an External Pentest? +

An external pentest is a security assessment that simulates attacks from the Internet against publicly exposed systems. It evaluates security from the perspective of an external attacker with no prior knowledge of internal infrastructure, identifying vulnerabilities that could be exploited for initial access.

What is an Internal Pentest? +

An internal pentest is a security assessment performed from within the organization's network, simulating an attacker who already has internal access. It evaluates the security of non-exposed systems and the effectiveness of internal controls, identifying lateral movement routes and privilege escalation.

What is the Difference Between a Pentest and a Security Audit? +

While a security audit focuses on verifying compliance with policies and controls, a pentest actively attempts to exploit vulnerabilities to demonstrate the real impact of security weaknesses. A pentest provides exploitation evidence and attack context that an audit cannot provide.

What is the Difference Between Pentesting and Automated Scanners? +

A manual pentest performed by experts identifies complex vulnerabilities and evaluates their real impact through real attack techniques. Automated scanners detect known vulnerabilities through signatures, but cannot identify logical vulnerabilities, evaluate real impact, or provide attack context.

How Often Should I Conduct Pentests? +

It is recommended to conduct pentests at least once a year, or after significant infrastructure changes. For high-risk organizations or those with strict regulatory requirements, it may be necessary to conduct them more frequently. The combination of external and internal pentests provides comprehensive coverage.

What Does a Pentest Report Include? +

A pentest report includes a detailed description of vulnerabilities found, their criticality level, exploitation evidence, potential impact in the context of your organization, and prioritized recommendations for remediation based on real risk.

Can a Pentest Cause Disruptions to My Systems? +

Pentests are performed in a controlled and coordinated manner to minimize impact on systems. We work with you to define appropriate time windows and techniques that do not cause disruptions to critical services, while maintaining the effectiveness of the assessment.

¿Necesitas este servicio?

Contacta con nuestro equipo para evaluar si este servicio es adecuado para tu organización.

Request Consultation
Talk to an expert
Related Services

Other services related

Discover complementary services that can improve your security posture

Security Audit for Banking & Regulated Environments

WHOAMI’s Security Audit for Banking and Regulated Environments validates technical controls with real impact for organizations with strict requiremen...

Learn more

Source Code Audit

WHOAMI’s Source Code Audit service provides a business‑aware secure code review: we identify relevant weaknesses (logic, authorization, dependencies,...

Learn more

Cyber Intelligence

WHOAMI's Cyber Intelligence service provides threat analysis, digital surveillance, and strategic intelligence so your organization can make security...

Learn more

Social Engineering Test

WHOAMI's Social Engineering Test service evaluates your organization's vulnerability to attacks that exploit the human factor. Unlike technical attac...

Learn more

Cloud Security Audit

WHOAMI’s Cloud Security Audit service provides a business‑aware cloud security assessment (AWS, Azure, GCP) to reduce exposure, improve identity gove...

Learn more

WiFi & RF Pentesting

WHOAMI's WiFi and RF Pentesting service evaluates the security of your wireless networks and radio frequency communications. With the exponential inc...

Learn more