Penetration tests are categorised on three axes, and a real engagement combines them. By target: web application, API, mobile, network (internal/external), cloud, wireless, social engineering and OT/ICS. By tester knowledge: black box (none), grey box (partial — usually best value), white box (full). By perspective: external (from the internet) and internal (from inside the network). So "a grey-box external web application test" fully describes an engagement across all three. Choose by matching the type to your actual assets and risk — test the systems you run, from the perspective you are worried about, at the depth your budget and compliance need.
// 01 What are the types of penetration testing?
The confusion around "types" comes from mixing three different classifications into one list. A test is not either a web app test or a grey-box test or an external test — it is all three at once, described on three independent axes. Once you see the axes separately, scoping becomes straightforward: pick a target, a knowledge level, and a perspective.
| Axis | Options | Answers the question |
|---|---|---|
| By target | Web, API, mobile, network, cloud, wireless, social eng., OT | What are we testing? |
| By knowledge | Black / grey / white box | How much does the tester know? |
| By perspective | External / internal | Where does the tester start? |
// 02 Types by target (what is being tested)
This is the axis most people mean by "types of pentest" — the asset under test. Each demands different skills and tooling, which is why they are scoped and priced separately.
Web application
Public and internal web apps — access control, injection, business logic, authentication. The most commonly requested test.
API
REST, GraphQL and SOAP APIs — authorisation (BOLA/IDOR), mass assignment, rate limiting, data exposure.
Mobile application
iOS and Android — data storage, certificate pinning, IPC and runtime manipulation. Priced per platform.
Network
Internal and external networks — host discovery, service exploitation, lateral movement, Active Directory attacks.
Cloud
AWS, Azure and GCP — IAM misconfiguration, exposed storage, metadata abuse, cross-account trust.
Social engineering
Phishing and pretexting — testing the human layer, often as part of a red team.
Red team
Full-scope adversarial simulation combining many of the above to test detection and response.
OT / ICS
Industrial control systems — safety-first testing of the technology that runs physical processes.
// 03 Types by knowledge level (black, grey, white box)
The second axis is how much information the tester is given, which controls how deep they can go in the time available. This is the classic "box" classification.
| Type | Tester knows | Simulates | Best for |
|---|---|---|---|
| Black box | Nothing | An external attacker | Perimeter realism |
| Grey box | Partial (credentials) | A user or insider with limited access | Best value for apps |
| White box | Full (source, architecture) | Maximum-coverage review | Depth & critical systems |
Grey box is the sweet spot for most application testing: giving the tester user-level credentials means they spend their time on the authenticated functionality where the serious flaws usually are, rather than burning days trying to get in. We compare these in depth in our web application testing methodology.
// 04 Types by perspective (external vs internal)
The third axis is where the tester starts. External testing assesses your internet-facing systems from the outside — your perimeter, public applications and exposed services — answering "what can an attacker reach and exploit from the internet?" Internal testing assesses what an attacker could do once inside, modelling an insider or a compromised laptop — lateral movement, privilege escalation, and access to sensitive systems. They answer different questions, and many organisations need both: external to test the front door, internal to test what happens if someone gets past it. Both are covered in our network penetration testing service.
// 05 Which type do you need?
Scope from your assets and your risk, not from a menu. If you run a web application or API, those are the targets. If a compliance framework drives the test, it usually names the systems — use our requirements finder to see which. On perspective, start external if you want to understand your internet exposure, and add internal if you are concerned about insider threat or post-breach impact. On knowledge level, grey box is the pragmatic default for applications. Most real programmes end up combining several — for example, an annual grey-box external test of the web app and API, plus a periodic internal network test — and a good provider will help you assemble the right mix rather than selling you one of everything.
// 06 Frequently asked questions
What are the main types of penetration testing?
By target (web, API, mobile, network, cloud, wireless, social engineering, OT), by knowledge (black/grey/white box), and by perspective (external/internal). Real tests combine all three axes.
Black vs grey vs white box?
How much the tester knows: black = nothing (external attacker), grey = partial/credentials (best value), white = full including source code (most thorough).
External vs internal?
External tests internet-facing systems from outside; internal tests what an attacker could do once inside the network.
Which do I need?
Match to your assets and risk: test the systems you run, from the perspective you're worried about, at the depth your budget and compliance require. Many need a combination.