Types of penetration testing: by target, knowledge and starting point

The types of penetration testing are easiest to sort on three axes: what you test (the target), what the tester knows (black, grey or white box), and where the tester starts (outside, inside or with a stolen account). Every real scope picks one value on each axis. Lists of "seven types" mix the axes, which is why they overlap.

What three questions define a pentest type?#

A pentest type is the answer to three questions: what is in scope, how much does the tester know, and from where does the attack begin.

A test called "network pentest" says only the first answer. "Grey box web and API test from a signed-in tenant account" answers all three, and a provider can quote it without guessing. Put all three in the written scope. See rules of engagement for the other parts of that document.

Which types exist by target?#

The target decides which methods the tester uses and which checklist applies.

• Web application: Tests logins, sessions, authorization, input handling and business logic in the browser-facing app. The OWASP Web Security Testing Guide is the common reference. See web application penetration testing.
• API: Tests the endpoints that apps and partners call. The OWASP API Security Top 10 (2023) starts with broken object level authorization (API1:2023). See API penetration testing.
• Network: Tests hosts, services and segmentation, from outside the perimeter or from inside it.
• Cloud: Tests configuration and exposed services in a cloud account. Check the provider policy first. AWS says customers may test permitted services without prior approval, and that testing with command and control (C2) needs prior approval.
• Mobile: Tests the app binary, local storage and the API behind it.
• Wireless: Tests Wi-Fi and related radio networks on site.

Excession Labs scopes web applications, APIs, multi-tenant SaaS platforms and AI applications. We do not scope physical access, social engineering or network red team work. For AI applications, see the AI red teaming service.

What are black, grey and white box tests?#

The knowledge axis says how much the tester knows before the test starts. NIST SP 800-115 describes the same idea as the amount of information given to the tester.

Grey box is the usual default for web apps and APIs, because authorization flaws only show up when the tester holds accounts. Our guide to black box, grey box and white box testing gives the trade-offs in full.

What are external, internal and assumed breach tests?#

The starting point says where the attack begins. PCI DSS requirement 11.4.1 defines internal testing as testing from inside the network and external testing as testing from outside it.

• External: The tester starts on the internet with no access. It finds what any visitor can reach.
• Internal: The tester starts inside the network or on a corporate device. It finds what a compromised laptop or a malicious insider could reach.
• Assumed breach: The tester starts with one valid account or foothold, because phishing or credential reuse makes that a realistic start. For a multi-tenant SaaS product, this is a signed-in user in tenant A who tries to reach tenant B.

External vs internal penetration testing covers the first two in detail.

Which type matches your goal?#

The reason you buy the test often decides the type. Compliance programs name a test but rarely name its style, so ask your auditor which parts they need.

• Compliance: PCI DSS 11.4 asks for internal and external testing. SOC 2 and ISO 27001 leave the form to you and your auditor. See SOC 2 penetration testing.
• Pre-launch: A grey box test of the new app and API before real data arrives. See pre-launch security testing.
• Customer security review: A buyer asks for a recent third-party report. See customer security review.
• After a release: A focused test of the changed features. See recurring penetration testing.

How do you choose? A decision table#

Start from your situation and read across to the three axes.

What is a pentest not?#

A pentest is a person testing a defined scope with written authorization. Three other services get confused with it.

• A vulnerability scan is automated matching of known issues. It finds candidates, and a human confirms them.
• A security audit compares controls with a standard. It does not attack the system.
• A red team exercise tests detection and response against a goal, often across people and process. See red team vs penetration testing.

Testing without written authorization from the system owner can be a crime, whatever the intent. Excession Labs tests only with that authorization.

What should you ask before you accept a scope?#

Use these questions to check that the scope names a type, not just a label.

1. Which assets are in scope, and which are out?
2. Is it black, grey or white box, and which accounts and roles will the tester get?
3. Where does the test start: external, internal or signed in?
4. Is production tested, and which limits apply to uploads, email and password guessing?
5. Does the report show evidence for each finding, and does it list controls that held?
6. Is a retest included, and what does it cover?

If you want a first test at no charge, see the free pentest pilot.

Need a pentest you can act on?

Tell us what you need tested and why. We reply to agree scope, and testing starts only after written authorization.

Request a testSee the sample report