Before any penetration test, we agree with the client how much context the testing team receives: what information, which accounts and what level of access. Depending on this choice, testing can be Black Box, Grey Box or White Box. Each approach answers a different question.
Black Box: the perspective of an external attacker
Testing is carried out without internal information about the systems being assessed. We simulate the perspective of someone trying to gain access without prior knowledge of the infrastructure. This approach shows how exposed the systems are from the outside and is particularly suited to publicly accessible applications and services.
Grey Box: the balance between realism and efficiency
Testing is carried out based on partial information or levels of access, set according to the objectives of the assessment. For example, the team receives accounts for the relevant roles in an application. The approach combines the perspective of an external attacker with the available information, for a more efficient and detailed analysis of certain components.
For web and mobile applications, we recommend, where possible, at least two accounts with the same level of rights, so that we can also check access scenarios between users.
White Box: in-depth analysis
Testing is carried out with extensive access to the relevant information and components of the system, such as technical documentation, configurations or code. This level of access allows for an in-depth analysis and the identification of vulnerabilities that are not always visible from the perspective of an external attacker.
How to choose
- Choose Black Box if you want to see what someone from the outside can do, without any advantage.
- Choose Grey Box if you want good coverage of functionality and roles within a reasonable timeframe.
- Choose White Box for critical systems, where you want the most detailed picture of the risks.
Whatever the approach, testing takes place within the limits set by the rules of engagement: the permitted time windows, sensitive systems and activities that cannot be carried out without approval. Tests that may affect availability are excluded by default and are only performed at the client’s express request, under controlled conditions. The client decides the level of access and the information it provides, and we help you choose the option that fits your objectives.
