Penetration testing uses three approaches: black-box (no inside knowledge), white-box (full transparency) and grey-box (limited access). Common test types include network, web and API, cloud, mobile, wireless, physical, social engineering and red team exercises. Use external network and web tests for internet-facing assets, cloud tests for accounts and configuration, and social engineering when people are the risk.
TL;DR:
- White box testing finds code flaws during development, black box testing checks outside exposure, and grey box testing models access through live user credentials.
- With budget for one test, prioritize assets holding customer data that face the internet; add internal or red team work after basic fixes.
- Ask for a written estimate tied to tester days; a quote far below competitors may indicate an automated scan rather than manual testing.
- Document authorized targets, allowed techniques, test windows, and incident contacts; FedRAMP JAB packages require annual testing, with the latest test no older than six months.
- A clean report reflects only the tests performed; fix findings quickly and retest, since later code, cloud settings, or attack methods can reopen risks.
Table of Contents
- 1. Black-box, white-box and grey-box approaches compared
- 2. Common penetration testing types and what each assesses
- 3. How do you choose the right penetration testing mix?
- 4. How much does a penetration test cost, and how long does it take?
- 5. What do compliance and rules of engagement require?
- 6. Who performs penetration tests, and what should you receive?
- 7. Why trust our guidance on penetration testing?
- 8. Why a passed pentest does not mean you are secure
- 9. Get managed penetration testing support from Nexus
- FAQ
- Sources
1. Black-box, white-box and grey-box approaches compared
The approach sets how much the tester knows before starting. It changes what you find, how long it takes and what it costs.
- Black-box: the tester acts like an outside attacker with no prior knowledge. It validates what a real adversary can reach from the internet, but it spends effort on discovery and can miss deep logic flaws.
- White-box: the tester gets full transparency, including source code and architecture. It is generally more efficient at finding logic and code-level flaws, and it fits development stages well.
- Grey-box: the tester gets limited information, such as user-level credentials. That focuses effort on realistic attack paths, like what a stolen customer login could reach, without paying for a full code review.
The approaches complement each other. White-box work can help uncover code and logic issues during development, while black-box work shows the attack surface an outside adversary can see.
Cost and time depend on the knowledge level. Black-box engagements can require substantial reconnaissance. White-box engagements need preparation and specialist reviewers. Grey-box can be a practical choice for production web applications, because the tester starts with limited information, such as user-level credentials. Coursera's overview summarises the same three approaches and the common test categories.
Pro Tip: Ask every vendor which approach they are quoting. Quotes for "a web app pentest" can describe very different amounts of work.
2. Common penetration testing types and what each assesses
Think of the types as a catalogue organised by asset. Organisations can choose the tests that fit their assets and risks.
- Network testing (external and internal): external tests probe internet-facing hosts, services and firewalls. Internal tests assume an attacker already sits on your network and look at segmentation, weak credentials, exposed services and lateral movement.
- Web application and API testing: testers examine authentication flows, business logic, injection flaws and session management. OWASP's testing framework recommends combining penetration testing with code review, threat modelling and manual inspection as part of a balanced programme. The OWASP Top Ten helps prioritise what to look for.
- Cloud testing: this covers account and configuration review, identity and access management, and cross-account access. Provider rules matter here, and our guide to cloud penetration testing explains how to scope tests without triggering a suspension. If your cloud holds regulated health data, this HIPAA-compliant cloud providers buyer's guide is useful background.
- Mobile application testing: iOS and Android differ in storage, permissions and platform protections. Testers check the app, its backend coupling, and how it behaves on jailbroken or rooted devices.
- Wireless and Bluetooth testing: testers review SSID configuration, encryption strength and rogue access points that could trick staff into connecting.
- Physical security assessments: these test access control, badge cloning and lock weaknesses, often by attempting to enter a facility.
- Social engineering: phishing, voice phishing (vishing), in-person pretexting and awareness testing measure how people respond. Our piece on a phishing simulation program shows how to build readiness over time.
- Red team exercises: an extended adversary simulation that blends technical and human attack paths. A pentest hunts as many vulnerabilities as possible in a defined scope. A red team has a goal, such as reaching customer data, and tests whether your detection and response notice the attempt. Frameworks like Mitre ATT&CK are often used to define objectives. In red teaming versus blue teaming terms, the red team attacks and your defenders (the blue team) respond.
- Specialised tests: consider IoT, OT/SCADA and AI/ML model testing when those systems carry real risk. They need testers with niche skills, so scope them separately.
NIST SP 800-115 stresses that no single technique gives a complete picture. It recommends combining several techniques, including vulnerability scanning, password cracking and penetration testing, for a robust assessment. Before any test, an up-to-date asset inventory helps, and our attack surface management guide covers how to build one.
3. How do you choose the right penetration testing mix?
Work from your assets and your stage, then pick the approach.
- Match tests to assets. Internet-facing services need external network and web tests. Cloud accounts need a cloud pentest. If staff are the likely entry point, add social engineering.
- Pick the approach by stage. Use white-box during development or when code review is available. Use black-box to validate your external attack surface. Use grey-box for live applications with user roles.
- Phase the work when budget or disruption is a concern. Start with a scoped web application test, then move to deeper internal or red team work once the basics are fixed.
- Write down the engagement basics: objectives, scope, business-hours constraints, allowed techniques, and retest and remediation expectations.
- Plan the follow-up before you buy. Fixes without a retest leave you guessing whether the problem is gone. Our enterprise vulnerability management process guide shows how to track remediation.
Early-stage companies can start small. Our guide to pentesting in startups covers timing and minimal-scope engagements.
Pro Tip: If your budget covers only one test, pick the asset that holds customer data and is reachable from the internet.
4. How much does a penetration test cost, and how long does it take?
Pricing depends on scope, not on the label. Our offers do not publish fixed rates for individual test types, so use these relative expectations when you budget, and ask each vendor for a written estimate tied to tester-days.
- External network: the smallest scope, usually the shortest engagement.
- Internal network: longer, because of segmentation review and lateral movement.
- Web application and API: time scales with the number of roles, endpoints and workflows.
- Mobile and cloud: usually cost more than a single web app because of platform and configuration depth.
- Wireless and social engineering: scoped by sites, users and campaigns.
- Red team: the largest and longest engagement, running as a campaign rather than a one-off test.
The main drivers are asset count, whether testing is authenticated, the number of tester-days, report depth and retest options. A quote far below others usually signals a scanner-only deliverable rather than manual testing.
The price rule of thumb: a pentest is priced by expert time, and NIST SP 800-115 frames it as one technique that works best alongside others, so a price that buys only an automated scan buys only one of them.
5. What do compliance and rules of engagement require?
Every test needs written authorisation and rules of engagement (ROE) before the first packet is sent.
- Authorised targets: list the approved IP ranges, domains and accounts.
- Restricted hosts: name any fragile or out-of-scope systems.
- Allowed techniques: state whether social engineering, denial-of-service or physical entry is permitted.
- Test windows and contacts: agree when testing runs and who to call if something breaks.
For cloud providers under FedRAMP, timeliness and accuracy guidance requires that penetration tests in a JAB P-ATO package be no older than six months, and that providers complete a new test at least once a year through a 3PAO. A new test may also be required after significant changes.
Documenting the plan prevents false alarms, keeps operations safe, and gives your security team a clear way to separate testers from real attackers. Frameworks such as PCI also reference testing requirements for cardholder data environments.
6. Who performs penetration tests, and what should you receive?
A mature engagement has defined roles, and each one matters:
- Engagement lead: owns scope, communication and the final report.
- Technical testers: run the manual testing and exploitation.
- Specialists: cover areas like cloud, mobile or industrial systems.
- Your point of contact: approves scope changes and handles incidents.
Look for testers who work from OWASP, NIST and Mitre ATT&CK, and who can explain their method. Expect a scoping questionnaire, signed ROE, a test plan, a findings report with evidence and fix guidance, and a retest option. Missing artefacts are a warning sign.
7. Why trust our guidance on penetration testing?
We deliver cybersecurity, cloud, compliance and managed IT services under one roof. For critical systems we recommend combining white-box and black-box assessments, so you see both the code-level flaws and the outside view. Our blog covers cloud penetration testing in depth.
8. Why a passed pentest does not mean you are secure
A clean report shows only that the specific tests found nothing. It does not show that your system is secure, because new code, new cloud settings and new attack techniques arrive every week. Treat each report as a snapshot. Fix findings quickly, retest to confirm the fixes, and move toward continuous assessment so the next change does not reopen the door.
9. Get managed penetration testing support from Nexus
We handle the parts that stall most pentest projects: scoping, rules of engagement, remediation and retesting, with one provider accountable from start to finish.
- Cloud configuration reviews and security testing support
- Clear scoping and ROE before work begins
- Reporting that engineers can act on
- Remediation help and retesting after fixes
See what is included and talk to our team on our services page.
FAQ
What are the three types of penetration testing?
The three approaches are black-box, white-box and grey-box. Black-box gives the tester no inside knowledge, white-box gives full access to code and architecture, and grey-box provides limited access such as user credentials. Coursera summarises them.
What are the top five penetration testing tools?
Tool choice depends on the test. Testers commonly use a mix of scanners, proxies and exploitation frameworks, and the best results come from skilled manual work rather than any one tool. Ask your provider which tools they use and why.
What are the stages of penetration testing?
Engagements typically include planning, testing and reporting, with any retesting agreed as part of the engagement. NIST SP 800-115 describes penetration-testing phases and recommends combining techniques for a robust assessment.
What is the difference between a red team and a pentest?
A pentest finds as many vulnerabilities as possible within a defined scope. A red team simulates a determined adversary pursuing a goal over time and tests whether your defenders detect and respond.
Sources
- NIST SP 800-115, Technical Guide to Information Security Testing and Assessment
- Accuracy of Testing
- Owasp
- What Are the Different Types of Penetration Testing?