The types of penetration testing that matter most to your business depend on what you expose to the internet, how your network is structured, and what compliance requirements apply to you. Most UK SMEs need an external network test and a web application test to begin with. From there, internal network testing, API testing, cloud testing, and more specialised assessments like social engineering or physical security follow depending on your environment and risk profile.
Table of Contents
Why the Type of Test You Commission Matters
A penetration test is not a single, generic exercise. Each of the different types of penetration testing has a defined scope and methodology. Commission the wrong one and your actual risk areas go untested. An external network test, for example, will not find a misconfigured customer login page. A web application test won’t assess your internal Active Directory configuration.
Getting clear on the differences also helps you understand what you are paying for and challenge a proposal that doesn’t match your needs.
External Network Penetration Testing
External testing starts from the internet and targets any system reachable from outside your network: firewalls, VPN gateways, publicly accessible servers, and remote access tools. The tester has no prior knowledge of your internal setup and attempts to breach the perimeter using the same starting point a real attacker would have.
This is usually the right first test for an organisation that hasn’t tested before. It answers the most direct question: can someone get in from outside?
Common findings include unpatched firewall software, exposed management interfaces, outdated VPN software, and weak or default credentials on internet-facing services.
Web Application Penetration Testing
Web application testing focuses on the security of a specific application, rather than the network hosting it. Testers work through the application methodically, probing authentication, session handling, input validation, access controls, and business logic. The most common vulnerabilities found include SQL injection, cross-site scripting, broken access controls, and insecure API exposure.
This test type is relevant for any organisation with a customer-facing web application, an employee portal, an e-commerce site, or an in-house tool that handles personal data. The National Cyber Security Centre describes this as “bespoke software vulnerability identification”. It notes the approach gives developers “feedback on coding practices that introduce specific vulnerability categories”.
Web application testing should happen before launch for new applications, after significant code changes, and at least annually for live systems.
API Penetration Testing
APIs are the connective tissue of modern software. They pass data between web interfaces and mobile apps, handle third-party integrations, and increasingly carry sensitive customer and financial data. API testing examines REST, SOAP, and GraphQL endpoints for broken authentication, excessive data exposure, insecure direct object references, and rate-limiting failures.
If your web application test doesn’t specifically include your APIs in scope, the testing firm should tell you. APIs are often listed as separate work because the methodology differs from browser-based web application testing.
Internal Network Penetration Testing
Internal testing starts from inside your network. It simulates an attacker who has already crossed the perimeter through phishing, a stolen VPN credential, or physical access. The tester then explores lateral movement: which systems they can reach, whether they can escalate privileges to domain administrator, and whether they can access sensitive data.
Internal tests often produce uncomfortable findings for organisations that have invested heavily in perimeter security but have flat internal networks with weak segmentation. Common results include: Windows domain misconfigurations that allow privilege escalation, unpatched internal servers, overly permissive file share permissions, and the ability to capture credentials from the network.
The UK Cyber Security Council found that the average penetration test spans approximately seven working days, with roughly 60% of companies using at least two testers per project. Internal network tests tend toward the higher end of that range because the environment is larger and more complex.
Cloud Penetration Testing
Cloud testing looks at how you have configured AWS, Azure, or Google Cloud. Misconfiguration is the dominant risk. Publicly accessible storage buckets, overly permissive identity and access management roles, exposed admin panels, and inadequate logging are consistently among the most common findings in cloud assessments.
Cloud providers do permit penetration testing against your own assets. However, some require advance notification for specific test types. Your testing firm should be familiar with each provider’s acceptable-use rules.
Wireless Penetration Testing
Wireless testing checks your Wi-Fi infrastructure for weak encryption, rogue access points, and whether an attacker within range could reach your wired systems. This matters more than many organisations assume. Anyone in a shared office building, a car park, or an adjacent floor is within range of your access points.
If your guest Wi-Fi network is not properly isolated from your corporate network, it is also a potential entry point. Wireless testing often surfaces this kind of misconfiguration and is, consequently, worth considering even for businesses that are not high-profile targets.
Social Engineering and Physical Testing
Social engineering tests evaluate human rather than technical defences. Phishing simulations, pretexting calls, and impersonation exercises reveal which staff groups are susceptible to manipulation and where training should be directed. These work well alongside a security awareness programme and can, additionally, be repeated quarterly to track improvement over time.
Physical penetration testing checks whether an attacker could gain physical access to your premises, server rooms, or network ports. Testers may attempt to tailgate through doors, clone access badges, or plug devices into accessible network points. This is less commonly commissioned than network or web application testing but is relevant for organisations where physical access to systems carries high risk.
Red Team Exercises
Red team exercises are different in character from the test types above. Rather than scoping a specific system and cataloguing its vulnerabilities, a red team runs a realistic attack scenario over weeks or months. The exercise combines external attack, social engineering, physical intrusion, and lateral movement in a single simulation. The objective is to test whether your organisation can detect and respond to an active intrusion, not simply to confirm that weaknesses exist.
Red team exercises suit organisations with a mature security programme that want to pressure-test their detection and response capability. They are more expensive and, consequently, less appropriate as a first engagement for smaller businesses.
How to Decide Which Types of Penetration Testing You Need
A straightforward starting framework:
- Internet-facing systems: start with an external network test.
- A web application handling customer data: add a web application test.
- Distinct API endpoints: consider API testing as a separate scope.
- Concerns about insider threats or lateral movement: run an internal network test.
- Cloud workloads: run a cloud configuration assessment after any migration.
- Compliance obligations (PCI DSS, ISO 27001, Cyber Essentials Plus): check what scope the relevant standard expects and match the test type to it.
A credible testing firm will scope the engagement with you and explain exactly what each test covers. So if you’re not sure where to start, speak to the team at Aardwolf Security and we can help you work through your risk priorities before a quote is produced.
What About the Knowledge Level Given to Testers?
Across all test types, engagements are described by the information given to the tester at the start. Black box means no prior knowledge, which models an uninformed external attacker. White box means full access to documentation, network diagrams, and sometimes source code. Grey box sits in the middle, typically supplying valid user credentials without further detail. Grey box is the most common approach for web application and internal network tests, since it balances realism with efficiency.
Aardwolf Security offer penetration testing covering all the types described in this guide. Whatever your environment, the right test is the one that maps to where your risk actually sits.
