Web penetration test vs. internal network test: what is the difference and which one you need

A web test asks whether an attacker can get in from outside. An internal network test asks how far the attacker gets once already inside. Both questions make sense and each usually has a different fixer: flaws in code are fixed by a developer, flaws in the network and its services by an administrator. In the higher-obligations regime, Decree No. 409/2025 Coll. requires penetration testing from the internal and the external network (§ 24(5)), so there you cannot avoid either. Decree No. 410/2025 Coll. does not mention a penetration test.

One clarification that gets lost in test names. "Web" says what is tested. "Internal" says where the tester attacks from. That is why the PCI SSC guide wants both the external and the internal test to cover the program and the network. Once you know this, suppliers' offers read better.

Two positions, two different jobs

Testing the web and applications from outside

NIST describes the external test as the view from the internet. The tester starts with public data, such as about domains, and then tries the services the firm lets out. The common ones first: web, mail, file transfer. For testing your own software NCSC adds that the result must give developers feedback on how to avoid producing similar flaws next time.

What exactly is looked for is shown by the OWASP Top 10:2025 list, which OWASP calls a standard awareness document for developers and for protecting the web. At the top is Broken Access Control, that is, flaws in who may see what. Next comes Security Misconfiguration, and Injection is in the top five. The list has 10 items in all.

One thing will please firms with a ready-made web shop or content system. The PCI SSC guide says that for a ready-made program whose code the firm is not responsible for, a network test is usually enough. The tester checks that the program runs correctly, is set up properly and has fresh patches. A full code test belongs to programs that the firm wrote or had written. If you sign in to the program, PCI SSC says all roles are tested, and in a system for multiple customers the test tries whether one customer can see another's data.

Testing the internal network from inside

An internal test starts where the first defence has failed. NIST says the tester acts as a trusted user or as an attacker who got past the perimeter and tries to raise rights: from user to administrator, from administrator to administrator of the whole domain. It focuses on how programs and services are set up, on login, access control and hardening of systems.

Professionally this is called lateral movement. MITRE ATT&CK describes it as the attacker jumping between systems and accounts and often using valid passwords and ordinary system tools, which can be less conspicuous than a foreign program. One small flaw next to another then leads further than any of them would alone (NIST: linked weaknesses reach further than one).

NCSC recommends choosing scenarios based on what has already happened to you. It names, for example, a lost laptop, an unauthorised device plugged into the internal network or a compromised server in the zone between the internet and the internal network. For each scenario you ask: what would the attacker get there?

Which test and in what order

If you do both and the same people test them, NIST advises starting from outside. Otherwise the tester would know the inside of the network in advance and the result would be kinder than what an outside attacker sees. If you pick only one, ask where the damage would be greater. Web shop revenue argues for the web, sensitive data on shared drives for the internal test. NIST notes that, given the cost and impact, a test once a year may be enough.

In the higher-obligations regime Decree 409/2025 Coll. decides: a penetration test from both sides at least once every 2 years, and a vulnerability scan from both networks at least once a year. The article on the retest covers this in detail, including the retest. A scan does not replace a penetration test: according to NIST a scanner only finds that a flaw may exist, whereas a test exploits it and confirms it. What the tester gets at the start is shown in the article on black, grey and white box.

What a firm of twenty people does

1. List what is visible from the internet: website, web shop, API, remote access, mail. That is the scope of the external test.
2. For each item find out whether the firm wrote it or it is a ready-made program. A ready-made program mainly needs a check of how it is set up and whether it has patches (PCI SSC).
3. Pick two or three NCSC scenarios: a lost laptop, an unknown device in the network, a compromised server. That is the brief for the internal test.
4. Check whether you fall into the higher-obligations regime under Act No. 264/2025 Coll. If so, plan for both.
5. Start with the external test and add the internal one after it. The preparation is the same for both and is described in the article on preparation.

Mistakes that keep repeating

• Only the web is tested. An attacker who gets in some other way bypasses the web. The internal test shows what awaits them afterwards.
• A ready-made program gets a code test. PCI SSC writes that a test of the network and of how the program is set up is usually enough for it.
• An internal test without a scenario. The tester then tries everything and nothing specific. NCSC advises choosing scenarios based on earlier incidents.
• A scan is mistaken for a test. A scan finds a possible flaw, a test exploits it. Decree 409/2025 Coll. distinguishes the two.

Sources

• PCI SSC, Information Supplement: Penetration Testing Guidance, version 1.1, September 2017, sections 2.2 and 2.3: https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf
• NIST Special Publication 800-115, September 2008, sections 2.4.1, 5.2.1 and 5.2.2: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
• NCSC, Penetration testing, published 8 August 2017, reviewed 10 January 2022: https://www.ncsc.gov.uk/guidance/penetration-testing
• OWASP, Top 10:2025, viewed 25 October 2026: https://owasp.org/Top10/2025/
• MITRE ATT&CK, Lateral Movement (TA0008), modified 11 August 2025: https://attack.mitre.org/tactics/TA0008/
• Decree No. 409/2025 Coll., § 24, effective from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-409
• Decree No. 410/2025 Coll., effective from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-410
• PCI DSS v4.0, SAQ D for Merchants, April 2022, requirements 11.4.2 and 11.4.3: https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-D-Merchant.pdf