External penetration tests, internal penetration tests and social engineering