When you scope a penetration test, one of the first decisions is how much information and access to give the tester. Black box, grey box and white box describe that spectrum — and the choice materially changes what the test finds and what it costs. This guide explains each, with a clear recommendation.
Black box: the outsider’s view
The tester starts with nothing but a target — no credentials, no documentation, no source. They discover everything the way an external attacker would.
- Strength: realistic simulation of an unauthenticated internet attacker; tests your perimeter and public attack surface.
- Weakness: time is spent on reconnaissance rather than depth, and authenticated, role-based and logic flaws deep in the app may never be reached.
Grey box: the authenticated user
The tester is given standard user credentials and some basic information — how most real compromises actually begin, since attackers phish a login or buy one. This is the sweet spot for most web applications.
- Strength: covers the authenticated attack surface where the highest-impact bugs live — broken access control, privilege escalation and business logic. Efficient: less time on recon, more on exploitation.
- Weakness: slightly less “pure” as an external simulation — but far more representative of real breach paths.
White box: full transparency
The tester gets credentials for every role, architecture documentation and often the source code. This enables the deepest possible assessment.
- Strength: maximum coverage and depth; ideal for high-assurance systems, and it pairs naturally with secure code review to find root-cause flaws in code.
- Weakness: highest effort and cost; less representative of a blind external attacker.
Which should you choose?
For most web applications, grey box is the best value: it concentrates effort where the damaging bugs actually are — behind the login, across roles and inside business logic — rather than burning budget re-discovering what you already know about your perimeter. Choose black box when you specifically want to test external exposure or measure detection & response; choose white box for critical systems, regulated environments, or when you want code-level assurance.
How the choice affects cost
More access usually means the tester reaches depth faster, so grey and white box often deliver more findings per day than black box, where recon eats the clock. The overall price still tracks scope and effort — see what a pentest costs.
Frequently asked questions
Isn’t black box the most realistic? Only for an external, unauthenticated attacker. Most real breaches start from a valid account — which is exactly what grey box simulates.
Do we have to hand over source code for white box? Yes for true white box, but it is handled under NDA with strict controls, and the depth is worth it for high-assurance systems.
Not sure which model fits your app? We’ll recommend the right approach during scoping — start with web application penetration testing or get a fixed-price quote.