Many companies rely exclusively on external security scans or believe that their firewall provides sufficient protection. But reality shows: today’s cyberattacks strike across multiple vectors simultaneously. If you only scan from the outside, you miss the risks within your internal network. And if you only look internally, you don’t know what attackers can see from the outside. For an effective security strategy, you need both perspectives.
What Is External Scanning?
External scanning examines your publicly accessible systems from an attacker’s perspective. This includes web servers, mail servers, VPN gateways, DNS records, cloud services, and all other services visible from the internet.
An external scan answers the central question: What does an attacker see when they look at your company from the outside?
Typical findings from external scans:
- Open ports and services that should not be exposed
- Outdated software versions with known vulnerabilities (e.g., unpatched Exchange servers)
- Misconfigured SSL/TLS certificates
- Exposed administration interfaces (WordPress admin, database panels, remote desktop)
- Information leaked through DNS records, HTTP headers, or error messages
- Vulnerabilities in VPN gateways and remote access solutions
External scans are the logical starting point because they show where your attack surface is greatest. Every service reachable from the internet is a potential entry point.
What Is Internal Scanning?
Internal scanning examines your network from the inside. An agent or scanner is deployed within your local network to check systems, services, and configurations that are not visible from the outside.
An internal scan answers a different but equally important question: What happens if an attacker is already inside your network?
This scenario is far from hypothetical. A successful phishing attack, a compromised endpoint, or an infected USB drive is enough to give an attacker a foothold. From this point, the so-called lateral movement phase begins — the attacker moves sideways through the network, searching for additional vulnerable systems and attempting to escalate their privileges.
Typical findings from internal scans:
- Unpatched workstations and servers on the local network
- Open SMB shares with sensitive data and no access controls
- Outdated printer firmware or IoT devices with default passwords
- Missing network segmentation between departments
- Internal services without authentication (databases, management interfaces)
- Active Directory misconfigurations such as overprivileged accounts
Why a Firewall Is Not Enough
The traditional security architecture of many SMEs is based on a simple perimeter model: a firewall separates the “secure” internal network from the “insecure” internet. This model has fundamental weaknesses.
First: The firewall does not protect against threats already inside the network. An employee who clicks a phishing link bypasses the firewall entirely. The attacker now operates within the “secure” zone.
Second: Many SMEs have flat networks without segmentation. If an attacker compromises a single system, they can potentially access every other system on the same network — from the accounting server to production controls.
Third: Cloud services, VPN connections, and remote work dissolve the traditional perimeter. The boundary between “internal” and “external” becomes blurred. Employees access company resources from everywhere, and data resides both locally and in the cloud.
Real-World Examples: When One Perspective Is Not Enough
Scenario 1: The Forgotten Test Server
An SME operates an online shop. The external scan shows everything is in order — the website is up to date, SSL is correctly configured. However, the internal scan reveals that an old test server running an outdated Apache version is still active on the same network. This server is not reachable from the outside, but if an attacker gains access to the network through phishing, they can use this server as a stepping stone to reach the production system.
Scenario 2: The Exposed Admin Panel
An external scan discovers that the administration interface of a NAS system is publicly accessible via port 5000. The IT service provider had opened it for remote maintenance and never closed it again. Without an external scan, this would have remained undetected — from the inside, everything looks normal.
Scenario 3: Lateral Movement After Phishing
An employee catches an infostealer through a phishing email. The attacker now has access to an endpoint. An internal scan would have shown in advance that several systems on the network still have SMBv1 enabled — a protocol with known vulnerabilities such as EternalBlue. The attacker exploits precisely this vulnerability to spread from the compromised workstation to the file server.
The Combination Makes the Difference
External and internal scanning complement each other. Together, they provide a complete picture of your security posture:
- External scans identify your attack surface and show where attackers could gain entry
- Internal scans reveal how far an attacker could get once they are already inside your network
- The combination enables a realistic risk assessment and targeted prioritisation of measures
Only when you know both perspectives can you make informed decisions: Which vulnerabilities must be fixed immediately? Where is additional segmentation needed? Which systems are particularly exposed?
How It Works with ExposIQ
ExposIQ supports both scanning perspectives in a single platform:
External scanning (cloud-based): ExposIQ automatically scans your publicly accessible systems from the cloud. With over 35 scan engines and 11’700 Nuclei templates, web servers, mail servers, VPN gateways, and cloud services are checked for known vulnerabilities. Scans run regularly and require no installation — you simply provide your domains and IP ranges.
Internal scanning (agent-based): For the internal perspective, ExposIQ offers an installable agent. It is deployed on a system within your local network and scans all reachable systems from there. This makes vulnerabilities visible that remain hidden from the outside: unpatched workstations, open shares, outdated internal services.
All results flow into a unified dashboard. Every vulnerability is assessed with the EPSS score (probability of active exploitation) and mapped to MITRE ATT&CK techniques. This way, you not only see what is vulnerable but also understand the actual risk.
Recommendation for SMEs
If you are currently only running external scans, you are taking an important first step. But you are only seeing half the picture. Complement your security strategy with internal scanning to identify lateral movement risks and validate your network segmentation.
Don’t start by trying to solve everything at once. A pragmatic approach:
- Begin with external scans to understand your public attack surface
- Fix critical external vulnerabilities first
- Add internal scans to assess your network from the inside
- Prioritise based on the combined risk picture
- Repeat regularly — your IT landscape is constantly changing
With ExposIQ, Swiss SMEs can cover both perspectives — in a single platform, hosted in Swiss data centres, and available from just CHF 99 per month. Experience the difference a complete security overview makes: exposiq.ch
