CISA's BOD 26-04, issued on 10 June 2026, makes public exposure the first of four factors that set how fast a vulnerability must be fixed. It defines publicly exposed as accessible to unauthenticated or untrusted entities via public networks. That idea is the dividing line between an external and an internal penetration test, and it is why a customer's request for "an internal and external pen test" needs unpacking before you answer.
What's affected
Any SaaS company whose questionnaire or contract asks for both an internal and an external test. The terms come from network-era standards, and they do not map cleanly onto a cloud product with no office network.
How to check if you're exposed
Read the exact wording. Two definitions show up most often:
- NIST SP 800-115. External testing is conducted from outside the organization's security perimeter, usually from the internet, to find what an external attacker could exploit. Internal testing works from inside, assuming the identity of a trusted insider or an attacker who got past the perimeter, and covers system configuration, authentication, access control and privilege escalation.
- PCI DSS v4.0. Internal testing means testing from both inside the cardholder data environment and into it from trusted and untrusted internal networks. External testing means testing the exposed external perimeter of trusted networks and critical systems connected to or accessible to public networks. Requirements 11.4.2 and 11.4.3 each call for the test at least once every 12 months and after any significant infrastructure or application upgrade or change.
If neither standard is named, ask the customer which definition they mean.
What to do now
- Map the terms to your product. For a SaaS app, "external" usually means the internet-facing app, API, login, DNS and mail. "Internal" often means what a logged-in user or a compromised employee laptop can reach: the admin console, the cloud account and the corporate network.
- Test in the right order. NIST notes that external testing usually goes first, and that this keeps testers from gaining insider knowledge that a real outsider would not have.
- Give internal testers a realistic start. NIST says internal testers are often granted general user access and attempt privilege escalation from there. Provide a standard employee account and a standard customer admin account.
- Include the cloud account if "internal" means infrastructure.
- Write down your reading of the customer's terms in the scope sheet and send it for agreement before the test starts.
- Plan the cadence. If PCI applies, annual and after significant change. Otherwise match what the contract says.
- Keep results and fix records. PCI DSS asks for retention of test and remediation results for at least 12 months.
How to avoid this trap
- Do not assume the customer wants an office network test if your company is fully remote.
- Do not pay for two separate tests when one engagement can cover both views, as long as the report separates them.
- Ask whether an internal team or a vendor will test. PCI allows a qualified internal resource or qualified external third party with organizational independence.
Why it matters
The labels carry very different workloads. An external test of one web app may take days. An internal test of a corporate network and cloud estate may take weeks. Answering "yes, we do both" without defining them either overpromises or overpays.
Exposure also drives the fix order. BOD 26-04 puts the most urgent clock on issues that are exposed, on the KEV list, easy to automate and high impact. Your test report should say which findings are reachable from the internet, so the fix order follows.
Try it yourself
List your assets in two columns: reachable from the internet, and reachable only after login or from the corporate network. That list is the draft scope for your external and internal tests.
Click through it at your own pace, or open it full screen.
Quick check
Which test usually goes first when both are done?
The external test. NIST says this keeps the testers from gaining insider knowledge an outside attacker would not have.
How often does PCI DSS v4.0 require internal and external tests?
At least once every 12 months and after any significant infrastructure or application upgrade or change.
