Your Perimeter Will Fail. The Real Question Is How Far an Attacker Gets After.

TL;DR: External tests and scanners check your perimeter. Neither answers the question that decides how bad a breach gets: once someone is inside, how far can they go? That is what internal penetration