Not all penetration tests are created equal. A company that orders a "pentest" without specifying the type is like booking "surgery" without telling the surgeon which body part. You might end up with a perfectly executed procedure that solves the wrong problem.
The types of penetration testing break down along two axes: how much information the tester has before starting (black box, white box, grey box) and what system they're targeting (network, web app, cloud, mobile, API, or even people). Picking the right combination determines whether you get actionable security insights or an expensive PDF that collects dust.
This guide covers every major penetration testing type in plain language, with real-world scenarios, honest pros and cons, and a decision framework to help you choose. Whether you're a CISO building a testing program or a practitioner scoping an engagement, you'll walk away knowing exactly which test fits your situation.
Why the Type of Pentest Matters
Choosing the wrong type of penetration test is one of the most common — and most expensive — mistakes organizations make. Here's what goes wrong:
- Black box when you needed white box: You pay for a tester to spend three days doing reconnaissance that you could have eliminated by sharing documentation. The result is surface-level findings that miss deep business logic flaws.
- External when you needed internal: Your perimeter is solid, but an attacker who phishes one employee owns your entire Active Directory in hours. The external test comes back clean, and you feel a false sense of security.
- Web app when you needed API: Your front-end is secure, but the API behind it has broken object-level authorization on every endpoint. The web app tester never looked at the raw API calls.
Every dollar spent on the wrong test type is a dollar not spent finding the vulnerabilities that actually threaten your business. The cost of penetration testing ranges from $3,000 to $150,000+ — that's too much money to leave to guesswork.
The bottom line: Before comparing vendors or requesting quotes, determine which type of penetration test you need. The rest of this guide will help you make that decision with confidence.
Black Box Penetration Testing
Black box penetration testing means the tester starts with zero knowledge about the target. No credentials, no documentation, no source code, no network diagrams. They know only what a real external attacker would know: your company name and maybe a domain.
How It Works
The tester begins with open-source intelligence (OSINT) gathering — scanning for subdomains, identifying technologies, mapping the attack surface from scratch. They then probe for vulnerabilities the same way a motivated attacker would, discovering and exploiting weaknesses without any insider advantage.
Real-World Scenario
A fintech startup wants to know if a skilled attacker could breach their systems from the outside. They hire a black box tester who discovers an exposed staging environment, finds default credentials on it, pivots to the production database through a shared network, and exfiltrates customer records — all without any prior knowledge of the infrastructure.
Pros
- Most realistic: Simulates a genuine external attack scenario
- Tests detection capabilities: Reveals whether your SOC or monitoring tools catch the intrusion
- No bias: The tester can't unconsciously skip areas based on architecture knowledge
Cons
- Time-consuming: Significant time spent on reconnaissance that adds cost but not always findings
- Surface-level depth: May miss complex business logic flaws that require authenticated access to discover
- Higher cost: Typically 10-20% more expensive than grey box for similar scope due to longer engagement time
When to Use Black Box Testing
- You want to validate your perimeter security from a real attacker's perspective
- Your security team wants to test their detection and response capabilities simultaneously
- You need a realistic assessment for board-level reporting
- Red team exercises or adversary simulations
Typical Cost
Black box testing typically costs $5,000 to $25,000 for a single application or network segment, and up to $50,000+ for broader scope. The premium over grey box reflects the additional reconnaissance time. See our full penetration testing pricing guide for detailed breakdowns.
White Box Penetration Testing
White box penetration testing (also called crystal box or clear box testing) gives the tester complete access: source code, architecture diagrams, network maps, credentials for all user roles, API documentation, and database schemas. It's the most thorough approach available.
How It Works
The tester combines manual source code review with dynamic testing. They read the code to understand how authentication works, then test whether those implementations can be bypassed. They analyze data flows, review cryptographic implementations, and look for vulnerabilities that no amount of external probing would uncover.
Real-World Scenario
A healthcare SaaS company processes patient data and must meet HIPAA requirements. They provide their pentest team with full source code access. The testers discover a race condition in the appointment booking system that allows one patient to access another patient's medical records during a 200-millisecond window — something a black box test would almost certainly miss.
Pros
- Most thorough: Finds deep, code-level vulnerabilities that other approaches miss
- Efficient: No wasted time on reconnaissance — testers go straight to testing
- Catches logic flaws: Source code review reveals architectural weaknesses, race conditions, and cryptographic failures
- Best for compliance: Satisfies the most demanding regulatory requirements
Cons
- Requires highly skilled testers: Not every pentester can effectively review source code across languages
- Higher cost: Typically 20-40% more expensive than grey box due to the source code review component
- Less realistic: An actual attacker rarely has source code access (though supply chain attacks are changing this)
- IP concerns: Some organizations are uncomfortable sharing source code with external testers
When to Use White Box Testing
- You handle highly sensitive data (financial, healthcare, government)
- Your application has complex business logic that needs deep analysis
- You want to find vulnerabilities before your first release (shift-left security)
- Compliance requires source code-level security assessment
Typical Cost
White box testing runs $8,000 to $35,000 for a single application, depending on codebase size and complexity. Enterprise-scale engagements with multiple codebases can reach $60,000+.
Grey Box Penetration Testing
Grey box penetration testing is the sweet spot — and the industry default. The tester receives partial information: typically user credentials, basic documentation, and an understanding of the application's architecture. They know enough to test efficiently but not so much that the test becomes a pure code review.
Why Grey Box Is the Industry Default
There's a reason roughly 70% of penetration testing engagements use a grey box approach. It eliminates the wasteful reconnaissance phase of black box testing while keeping the test grounded in realistic attack scenarios. The tester has credentials (like a real user or a compromised account would), but they still need to discover and exploit vulnerabilities through testing, not just reading code.
For most organizations, grey box testing delivers the best findings-per-dollar ratio. You're paying testers to find vulnerabilities, not to rediscover your sitemap.
Real-World Scenario
An e-commerce platform gives their pentester standard customer credentials and admin credentials. The tester discovers that by manipulating order IDs in API requests, any authenticated customer can view and modify other customers' orders, access their payment history, and change shipping addresses. The penetration testing checklist for this kind of engagement focuses on authorization and business logic — exactly where grey box testing excels.
Pros
- Best ROI: Eliminates wasted reconnaissance time, maximizes vulnerability discovery
- Realistic attack model: Simulates a compromised user account or insider threat scenario
- Tests authorization: With credentials, testers can thoroughly test privilege escalation and access control
- Faster turnaround: Results delivered sooner because less time is spent on discovery
Cons
- Doesn't test perimeter from scratch: Won't reveal whether an unauthenticated attacker can find a way in
- Dependent on what's shared: If the provided documentation is incomplete, testers may miss areas
- Not the deepest option: Won't find source code-level vulnerabilities that white box testing catches
When to Use Grey Box Testing
- First-time penetration testing (best starting point for most organizations)
- Annual compliance testing (SOC 2, ISO 27001, PCI-DSS)
- Testing web applications with user roles and business logic
- When you want thorough results without the premium cost of white box
Typical Cost
Grey box testing is the baseline for pentest pricing: $5,000 to $20,000 for a web application, $8,000 to $25,000 for internal network testing. It's the standard that other approaches are priced relative to.
Comparison Table: Black Box vs White Box vs Grey Box
Here's how the three knowledge-based approaches compare side by side:
| Factor | Black Box | Grey Box | White Box |
|---|---|---|---|
| Knowledge Level | None (zero knowledge) | Partial (credentials, docs) | Full (source code, architecture) |
| Realism | Highest — mimics external attacker | High — mimics compromised user | Low — no real attacker has this access |
| Testing Depth | Surface to moderate | Moderate to deep | Deepest possible |
| Vulnerability Coverage | External-facing issues | Auth, authz, business logic | Code-level, crypto, race conditions |
| Cost (Relative) | 10-20% above grey box | Baseline | 20-40% above grey box |
| Duration | Longest (recon phase) | Moderate | Moderate to long (code review) |
| Best For | Perimeter validation, red teaming | Annual compliance, web apps, first pentests | Sensitive systems, pre-release, healthcare/finance |
VulnSkill recommendation: If you're unsure, start with grey box. It gives you the most actionable findings per dollar spent. You can always add a black box perimeter test or white box code review as your security program matures.
Network Penetration Testing (External vs Internal)
Network penetration testing is where the profession started, and it remains one of the most critical testing types. It splits into two distinct categories with very different goals.
External Penetration Testing
External penetration testing targets everything visible from the internet: your public IP addresses, web servers, VPN gateways, email servers, DNS infrastructure, and cloud-hosted services. The tester works from outside your network, just like an attacker scanning the internet for targets.
What's typically tested:
- Open ports and exposed services (SSH, RDP, FTP, database ports)
- VPN and remote access vulnerabilities
- SSL/TLS configuration weaknesses
- DNS misconfigurations (zone transfers, subdomain takeover)
- Email security (SPF, DKIM, DMARC, open relays)
- Firewall and IDS/IPS bypass techniques
Common findings: Exposed management interfaces, outdated software with known CVEs, weak SSL configurations, and forgotten services running on non-standard ports.
Internal Penetration Testing
Internal penetration testing simulates what happens after an attacker gets past the perimeter — through phishing, a compromised VPN, or a malicious insider. The tester operates from inside the corporate network and tries to escalate privileges, move laterally, and access sensitive data.
What's typically tested:
- Active Directory misconfigurations (Kerberoasting, AS-REP roasting, DCSync)
- Network segmentation effectiveness
- Lateral movement paths between systems
- Privilege escalation from standard user to domain admin
- Credential harvesting (LLMNR/NBT-NS poisoning, password spraying)
- Access to sensitive file shares, databases, and internal applications
Common findings: Weak Active Directory configurations that allow domain admin compromise within hours, flat networks with no segmentation, shared local admin passwords, and unencrypted sensitive data on file shares.
Important: Most breaches start externally (phishing, exposed services) but the real damage happens internally. A comprehensive network testing program should include both external and internal assessments. If you can only afford one, and your perimeter is reasonably hardened, internal testing often reveals more critical findings.
Web Application Penetration Testing
Web application penetration testing is the most commonly requested type of pentest, and for good reason — web apps are where most businesses store their crown jewels: customer data, payment information, and proprietary functionality.
A thorough web application pentest covers the full OWASP Top 10, but goes well beyond automated scanning into manual business logic testing:
- Injection attacks: SQL injection, XSS, command injection, SSTI, LDAP injection
- Broken authentication: Session management flaws, credential stuffing resilience, MFA bypass
- Broken access control: IDOR vulnerabilities, privilege escalation, missing function-level access controls
- Business logic flaws: Price manipulation, workflow bypass, race conditions in checkout flows
- Security misconfiguration: Verbose error messages, default credentials, exposed admin panels
- Cryptographic failures: Weak hashing, improper key management, insecure data transmission
Real-World Scenario
A SaaS company's automated scanner finds zero critical issues. A manual pentester discovers that by changing a single parameter in the API request, any user can download any other user's invoices — a classic IDOR vulnerability that scanners cannot detect because it requires understanding the business context.
For a detailed methodology, see our penetration testing checklist which covers the step-by-step approach for web app assessments.
Cloud Penetration Testing
Cloud penetration testing evaluates the security of your AWS, Azure, or GCP infrastructure. It's fundamentally different from traditional network testing because the attack surface includes IAM policies, storage configurations, serverless functions, and cloud-native services that don't exist in on-premise environments.
What's Tested
- IAM misconfigurations: Overly permissive roles, unused credentials, lack of MFA on privileged accounts, cross-account access issues
- Storage exposure: Public S3 buckets, Azure blob containers with anonymous access, GCP Cloud Storage ACL misconfigurations
- Serverless security: Lambda/Azure Functions with excessive permissions, vulnerable dependencies, insecure environment variables containing secrets
- Container security: Vulnerable base images, exposed Kubernetes dashboards, pod-to-pod lateral movement, RBAC misconfigurations
- Network controls: Security group rules, VPC peering misconfigurations, public-facing resources that should be private
- Secrets management: Hardcoded API keys, exposed credentials in metadata services, improper use of secrets managers
Real-World Scenario
A pentester discovers that a company's EC2 instance metadata service (IMDSv1) is accessible from a web application, allowing them to retrieve IAM credentials. Those credentials have excessive permissions, granting access to every S3 bucket in the account — including one containing database backups with unencrypted customer PII.
Cloud provider rules: Each cloud provider has specific rules about penetration testing. AWS allows most testing without prior approval. Azure requires filling out a notification form for certain test types. GCP allows testing of your own resources but prohibits DoS testing. Always check your provider's current policy before engaging a tester.
Mobile Application Penetration Testing
Mobile app penetration testing evaluates the security of iOS and Android applications, their backend APIs, and the data they store on the device. With mobile apps often handling banking, healthcare, and authentication workflows, the stakes are high.
iOS vs Android Testing
Both platforms have unique security models. iOS testing requires working with the App Transport Security framework and the iOS Keychain, while Android testing involves evaluating content providers, intent handling, and the more permissive file system. Testers typically assess both platforms because vulnerabilities often differ between them.
What's Tested (OWASP Mobile Top 10)
- Insecure data storage: Sensitive data in SharedPreferences, SQLite databases, plist files, or the clipboard
- Insecure communication: Missing certificate pinning, cleartext traffic, weak TLS configurations
- Insecure authentication: Biometric bypass, weak session management, client-side authentication checks
- Reverse engineering: Lack of obfuscation, hardcoded secrets, exposed API keys in the binary
- Code tampering: Missing integrity checks, runtime manipulation, method hooking with Frida
- Backend API security: The APIs the mobile app calls often have the same vulnerabilities as web APIs (see the API testing section)
Real-World Scenario
A banking app implements certificate pinning in the production build but not in the debug build — and the debug flag is controlled by a value in local storage that the user can modify. A tester bypasses pinning, intercepts all traffic, and discovers the API accepts requests to transfer funds without re-authenticating the user's session.
API Penetration Testing
API penetration testing has become essential as modern applications shift toward microservices architectures. Your front-end might be locked down, but the APIs behind it often tell a different story.
REST and GraphQL Testing
REST APIs and GraphQL endpoints face different attack vectors. REST APIs are vulnerable to traditional injection and authentication bypass, while GraphQL adds unique risks like introspection queries that reveal the entire schema, nested query attacks that cause denial of service, and batch query abuse.
Key Vulnerability Areas
- BOLA (Broken Object-Level Authorization): The #1 API vulnerability. Changing an ID in a request grants access to another user's data. Automated scanners almost never catch this.
- Broken authentication: Weak API key management, JWT vulnerabilities (none algorithm, key confusion), missing token expiration
- Broken function-level authorization: Regular users accessing admin-only endpoints by simply calling them directly
- Mass assignment: Sending additional fields in API requests to modify data the user shouldn't be able to change (e.g., setting
is_admin: true) - Rate limiting: Missing or weak rate limits enabling brute force, credential stuffing, and data scraping
- Injection: SQL injection, NoSQL injection, and command injection through API parameters
Real-World Scenario
A pentester testing a multi-tenant SaaS API discovers that the GET /api/v2/organizations/{org_id}/users endpoint doesn't validate that the authenticated user belongs to the specified organization. By iterating through organization IDs, they can enumerate every user in the system — including email addresses, names, and role assignments across all tenants.
For a deep dive into the tools pentesters use for API testing and other engagements, see our penetration testing tools guide.
Social Engineering
Social engineering penetration testing is unique because it tests people, not technology. The best firewall in the world is irrelevant if an employee clicks a phishing link and enters their credentials.
Types of Social Engineering Tests
- Phishing campaigns: Custom emails designed to trick employees into clicking malicious links, opening attachments, or entering credentials on fake login pages. Results typically show 15-30% click rates even in security-aware organizations.
- Vishing (voice phishing): Phone calls impersonating IT support, vendors, or executives to extract credentials, trigger wire transfers, or gain remote access. Often more effective than email phishing because people are less suspicious on the phone.
- Pretexting: Creating elaborate cover stories to manipulate employees. A tester might pose as a new IT contractor who needs "temporary" network access, or as a vendor requiring VPN credentials for a "critical update."
- SMS phishing (smishing): Text messages targeting employees' mobile devices, often impersonating MFA verification or delivery notifications.
Real-World Scenario
A pentester sends a phishing email that appears to come from the company's HR department with a link to "review your updated benefits package." Of 500 employees targeted, 127 click the link, 43 enter their corporate credentials, and 8 of those are IT administrators. The tester uses the admin credentials to access the VPN, then compromises the internal network — demonstrating a full kill chain from email to domain admin.
Why social engineering matters: According to Verizon's Data Breach Investigations Report, the human element is involved in 68% of breaches. Technical security testing alone leaves your biggest attack surface untested. Social engineering assessments should be paired with security awareness training for maximum impact.
Physical Penetration Testing
Physical penetration testing evaluates the security of your physical premises — offices, data centers, server rooms, and restricted areas. It's the most dramatic form of testing and the one that often surprises organizations the most.
Common Techniques
- Tailgating: Following an authorized employee through a secured door without badging in
- Lock picking: Bypassing physical locks on server rooms, network closets, and sensitive areas
- Badge cloning: Copying RFID or HID proximity badges to gain unauthorized building access
- Dumpster diving: Searching discarded materials for sensitive information, passwords written on sticky notes, or disposed hardware
- Social engineering at the front desk: Impersonating delivery drivers, IT technicians, or job candidates to gain building access
- Rogue device placement: Planting a wireless access point or network tap to create a persistent backdoor into the corporate network
Who Needs Physical Penetration Testing?
- Data center operators: Physical access to servers means game over for data security
- Financial institutions: Banks, trading floors, and vault areas with regulatory requirements
- Government and defense: Classified environments with strict physical security mandates
- Healthcare facilities: HIPAA requires physical safeguards for systems containing PHI
- Any organization with on-premise infrastructure: If your servers aren't all in the cloud, physical security matters
Real-World Scenario
A physical pentester arrives at a corporate office wearing a high-visibility vest and carrying a clipboard. They tell the receptionist they're from the fire alarm servicing company and need to check the sensors in the server room. The receptionist escorts them directly to the server room, where the tester plugs a small device into an open network port. That device provides persistent remote access to the internal network for the remainder of the engagement.
Which Type Do You Need?
Use this decision framework to determine the right penetration testing type for your organization. Work through these questions in order:
Step 1: What's Your Primary Goal?
- Compliance requirement (SOC 2, PCI-DSS, ISO 27001) → Grey box web app + external network test
- Validate perimeter security → Black box external penetration test
- Deep security assessment → White box testing with source code review
- Test your people → Social engineering assessment
- Full security posture evaluation → Combination of multiple types
Step 2: What's Your Attack Surface?
- Web application(s) with user login → Web app pentest (grey box)
- APIs serving mobile or SPA front-ends → API penetration test
- Cloud infrastructure (AWS/Azure/GCP) → Cloud security assessment
- Corporate office with on-premise servers → Internal network + physical testing
- Mobile apps (iOS/Android) → Mobile application penetration test
- Internet-facing servers and services → External network penetration test
Step 3: What's Your Budget?
- Under $10,000: Start with a grey box web app pentest on your most critical application
- $10,000–$30,000: Web app + external network, or a comprehensive API assessment
- $30,000–$60,000: Multiple target types — web, network (external + internal), cloud
- $60,000+: Full-scope VAPT across all environments, or red team assessment
Step 4: What's Your Maturity Level?
- First pentest ever: Grey box web application test. Get the basics right before going deeper.
- Had a few pentests: Add internal network and cloud. Start exploring white box for critical apps.
- Mature security program: Regular testing across all categories. Add social engineering and physical testing. Consider continuous penetration testing (PTaaS).
Not sure where to start? Read our complete guide to penetration testing for foundational concepts, then come back here to choose the specific type that fits your needs.
Not Sure Which Pentest Type You Need?
Tell us about your infrastructure and compliance requirements, and we'll recommend the right testing approach — with a fixed-price quote delivered within 24 hours.
Talk to VulnSkill About the Right Test Type →Frequently Asked Questions
The three main types of penetration testing classified by knowledge level are black box (zero knowledge, simulates an external attacker), white box (full access including source code, most thorough), and grey box (partial knowledge with credentials and documentation, most common in the industry). Grey box is the industry default because it balances realism with depth and cost-efficiency.
There is no single best type — it depends on your goals. Grey box testing is the most popular because it offers the best balance of thoroughness and cost. Black box is ideal for simulating real-world attacks, while white box is best for finding deep code-level vulnerabilities. For compliance requirements, grey or white box testing is typically recommended.
External penetration testing targets internet-facing systems — websites, VPNs, email servers, firewalls — simulating an attacker with no internal access. Internal penetration testing simulates a threat actor who has already breached the perimeter or a malicious insider, testing Active Directory, lateral movement, privilege escalation, and internal network segmentation. Most organizations need both.
Costs vary by type: black box testing costs 10-20% more than grey box due to longer reconnaissance time. Web app pentests range from $5,000-$20,000, network pentests from $4,000-$25,000, cloud security assessments from $8,000-$30,000, and mobile app tests from $8,000-$25,000. White box (source code review included) adds 20-40% to the base cost. See our full pricing guide for details.
Most organizations need more than one type. At minimum, you should test your web applications and external network. As your security program matures, add internal network, cloud, API, and mobile testing. The order depends on your attack surface — start with whatever is most exposed to the internet and most critical to your business.