What is penetration testing? How it works and the types (black, grey and white box)
A complete guide to penetration testing: definition, phases, types by knowledge level (black, grey, white box) and by target, what a good report contains and how often to test.
Definition: penetration testing (pentesting) is an authorised, expert-led simulated attack that finds and exploits vulnerabilities in systems, applications, APIs or AI models to demonstrate real business impact before an attacker does. What separates it from a vulnerability scan is exploitation and chaining: a pentest proves what can be done, not just what looks wrong.
This guide covers the basics — what it is, how it works, which types exist — and the questions that matter when you decide: which type to choose, what the report should contain, and when a pentest is required.
What a penetration test is for
- Reducing real risk. Finding the path from an ordinary user to other customers’ data, admin privileges or fraudulent transactions.
- Meeting requirements. PCI DSS requires an annual pentest and one after significant changes; SOC 2, ISO 27001, HIPAA, NIS2 and DORA treat security testing as control evidence. See pentesting for ISO 27001, SOC 2 and GDPR and NIS2 and DORA penetration testing.
- Closing deals. Enterprise buyers ask for a recent pentest report in security questionnaires. Without one, the deal stalls in procurement.
How it works, step by step
- Scope and rules of engagement. What can be tested, in which environment and window, with which accounts, and what is off-limits (for example, denial of service). In writing and authorised.
- Reconnaissance. Mapping the surface: subdomains, endpoints, technologies, exposed documentation, features per role.
- Analysis and discovery. Tools and manual analysis in parallel — what tools flag, the tester confirms; what tools cannot see (authorization, business logic), the tester hunts for.
- Exploitation and chaining. Turning a vulnerability into demonstrable impact with minimal intrusion.
- Reporting. Executive summary, findings with severity, reproducible evidence, business impact and remediation guidance.
- Retest. Validating that fixes work.
Types of penetration testing by knowledge level
Black box
The tester starts with nothing but the target — like an external attacker. Good for assessing internet exposure and testing detection. Limitation: much of the budget goes on discovering what your team could explain in minutes.
Grey box
The tester gets credentials per role, documentation (OpenAPI, architecture) and business context. It simulates a malicious legitimate user or an attacker who already stole an account — the most common scenario in real incidents. It is the best value for web applications, APIs and AI systems.
White box
Full access to source code, configuration and architecture. Enables the deepest analysis. Good for critical components (authentication, payments), technical due diligence and mature products.
| Black box | Grey box | White box | |
|---|---|---|---|
| Prior knowledge | none | accounts + docs | code + architecture |
| External-attacker realism | high | medium | low |
| Coverage per test day | low | high | very high |
| Best for | perimeter, detection | web, API, AI (default) | critical components |
Types of penetration testing by target
- Web application: authentication, session, authorization, injection, business logic, SSRF. References: OWASP Top 10 and OWASP WSTG.
- API: REST, GraphQL and gRPC against the OWASP API Security Top 10 — the most common critical finding is BOLA/IDOR. Full guide: API penetration testing.
- AI and LLM: chatbots, RAG and agents against the OWASP Top 10 for LLM applications.
- Mobile: the app and, above all, the API it calls.
- Infrastructure and cloud: external and internal networks, Active Directory, AWS/Azure/GCP.
- Red team: objective-driven adversary simulation that also tests detection and response.
Pentest vs. vulnerability scan vs. bug bounty
Scanners find the known and the shallow; bug bounties pay a crowd per finding with no coverage guarantee; a pentest guarantees methodology, depth and a scoped report. Details in pentest vs. scanner vs. bug bounty.
What a good pentest report contains
- An executive summary in business language.
- Findings with justified severity (CVSS adjusted to context).
- Reproduction steps and evidence developers can follow.
- Attack chains, not just isolated items.
- Remediation specific to your stack.
- Scope, dates, methodology and limitations — what an auditor will look for.
How often to test
At least annually and after significant changes. Products with continuous deployment benefit from smaller, recurring cycles. For budgeting, see how much a penetration test costs.
Frequently asked questions
Is penetration testing legal?
Yes, when the system owner authorises it in writing with a defined scope. Without authorisation, the same activity is a crime (in the US, under the Computer Fraud and Abuse Act).
Can a pentest take my system down?
A well-run one does not. Denial-of-service testing is out of scope by default, load is controlled, and destructive actions are agreed in advance.
How long does a penetration test take?
A mid-size web application or API typically takes 5–15 testing days plus 2–5 days for reporting.
What is the difference between a pentest and a vulnerability assessment?
A vulnerability assessment lists potential flaws, usually automatically. A pentest confirms, exploits and chains them to show real impact — and finds classes tools miss, such as authorization and business-logic flaws.