Glossary · testing approach
Black, grey or white box: how much to tell the tester.
The “box” is how much the tester knows going in: nothing (black), user accounts and documentation (grey), or everything including source code (white). The more you share, the more they find per day you pay for. For most web applications and APIs, grey box is the right buy.
The three approaches side by side
| Approach | Tester gets | Shows you | Time and cost | Best for |
|---|---|---|---|---|
| Black box | Nothing beyond the target’s address | What an outsider can reach with no help | Slowest per finding; time goes on discovery | External attack-surface checks; testing an outside view |
| Grey box | User accounts for each role, API docs | What a logged-in user, customer or tenant can do that they shouldn’t | The usual balance of realism and coverage | Most web application and API tests |
| White box | Source code, architecture, admin access | The most issues per testing day, including ones hard to reach from outside | Fastest per finding; needs code access | High-risk apps, pre-launch reviews, code-level assurance |
How to choose, and what it does to the quote
A test is priced by the days it takes. In a black box test, much of that time goes on finding things you already know: which pages exist, which roles there are, how the API is shaped. Handing that over turns those days into testing. That’s why most firms recommend grey box for applications and why it rarely costs more.
Choose black box when the question is specifically what an outsider sees: an external perimeter check, or a test of how much your public footprint gives away. Choose white box for high-risk applications, before a launch, or when you want code-level assurance and can share the repository. Whichever you pick, it belongs in the written scope and rules of engagement (how a test runs).
Questions
Which is better, black box or white box testing?
Neither is better in general. Black box shows what an outsider can reach; white box finds the most issues per testing day. For most web applications, grey box (accounts for each role, plus API documentation) is the best value.
Does black box testing cost less?
Not usually per finding. The tester spends paid time discovering what you could simply have told them, so you get less coverage for the same budget.
Is grey box the same as authenticated testing?
Close: grey box usually means the tester has user accounts for each role and some documentation, which makes the test authenticated.
Sources for this page
- NIST SP 800-115 — Covert and overt testing and the information given to testers.
- OWASP Web Security Testing Guide — Testing with and without credentials and documentation.
How firms are chosen, what counts as "published" and how to send a correction: methodology.
Cite this page
Pentesting Firms. "Black box, grey box and white box penetration testing: which to buy." Updated November 8, 2026. https://pentestingfirms.com/glossary/black-box-white-box-grey-box/