External network vulnerability
Your network is tested from the outside, to check that the firewall or router is not allowing traffic into your network that it shouldn't be. This is also called penetration testing.
Internal network vulnerability
This tests that your computers are not vulnerable to attack from other devices on the network. This scenario could come into play if one of the machines was compromised, by a hacker or by a virus or ransomware program, for example.
Meets cyber insurance requirements
Many cyber insurance providers now require Cyber Essentials certification, or at least active security controls such as phishing awareness training and MFA, before they'll issue or renew a policy. By achieving Cyber Essentials, your practice not only strengthens its defences but also meets a key criterion for obtaining or keeping affordable cyber insurance cover.