To put it simply: in an external pentest, the penetration tester is a normal internet user with no
other rights. In an internal pentest, the tester is virtually "in the company"
and can access resources that
are not accessible from the internet. As a rule, this
means that the penetration tester is located in the company via VPN or directly.