Black box, grey box or white box: which penetration test do you need?
Many organisations struggle to choose the right type of penetration test. This guide covers the common targets, how to scope a test and the three testing styles.
Updated October 2026 · 7 min read
We regularly speak with organisations in Sri Lanka and overseas that find it hard to decide which penetration test they need. This guide makes the choice simpler: first the common targets, then how to scope the test, then the three testing styles.
New to the topic? Start with our guide to vulnerability assessment and penetration testing.
Common penetration testing targets
- External infrastructure: internet-facing systems. To scope it, you need the number of external IP addresses, subnet sizes and sites.
- Internal infrastructure: servers and network devices inside your corporate network.
- Web applications: public websites and internal web portals. These usually take longest, depending on complexity and the number of input pages.
- Mobile applications: Android and iOS apps, tested according to how the app is used in your business.
- Wireless networks: weak encryption, unauthenticated access points and other WLAN misconfigurations.
How to scope a penetration test
Scope depends on why you are testing. Start from your goal and the assets involved:
| Your goal | Ask yourself |
|---|---|
| Assure that controls work | Which systems must the controls protect? |
| Launch a new product or service | Which assets support it? |
| Make a major infrastructure change | Where did the change happen? |
| Build or use custom applications | Which applications and data are involved? |
| Prepare for a security standard | What scope does the standard require? |
Black box, grey box and white box testing
The next decision is how much information to share with the tester. This is not about confidentiality; it sets the perspective the test is run from.
Black box testing
The tester receives no information and works like an outside attacker, from initial access through to exploitation. It is the most realistic view of how an adversary with no inside knowledge would target you. Because of the research time involved, it is usually the most expensive option.
Grey box testing
The tester receives limited information, such as standard user credentials or target IP addresses. It can simulate an insider threat or an attacker who has already breached the perimeter. Grey box is often the preferred balance of efficiency and realism, because it skips time-consuming reconnaissance.
White box testing
The tester receives full information, including network maps and credentials. It suits a deep, targeted test of a specific system using as many attack paths as possible, and is especially useful during product development to find fixes before launch.
Which style should you choose?
| Black box | Grey box | White box | |
|---|---|---|---|
| Information shared | None | Limited | Full |
| Simulates | External attacker | Insider or breached attacker | Targeted, informed attacker |
| Depth | Lower | Balanced | Highest |
| Relative cost | Highest | Moderate | Moderate |
| Best for | Realistic external view | Most regular assessments | New products and critical systems |
Frequently asked questions
Which testing style is most common?
Grey box, because it balances realism with efficient use of testing time.
Is black box testing always better because it is more realistic?
Not always. A determined attacker has unlimited time, while a test does not, so a grey or white box test often finds more within the same budget.
How long does a penetration test take?
It depends on the targets and scope. A small external test may take a few days; complex web applications take longer.
Do you test mobile apps on both Android and iOS?
Yes. Scope is based on the number of Android and iOS apps and how they are used.