Topic · types of test
Ten types of penetration test, and who offers each.
A penetration test is defined by its target: a web app, an API, a network, a cloud account, a mobile app, an AI application, or your people. Most organizations start with their web application and external network. The counts below come from the 29 firms we compare.
Every type, side by side
| Type | What it covers | When you need it | Firms offering it |
|---|---|---|---|
| Web application | The app in the browser and the logic behind it, tested as each user role. | Any customer-facing app; most SOC 2 and customer questionnaires. | 29 of 29 |
| API | REST, GraphQL and mobile back ends: authorization between users above all. | Any app with an API, which is nearly all of them. | 24 of 29 |
| External network | Everything the internet can reach: IP ranges, VPN, mail, exposed admin panels. | Every year; required by PCI DSS. | 26 of 29 |
| Internal network | What an attacker can reach after a first foothold: Active Directory, lateral movement. | Once you run an internal network; required by PCI DSS. | 26 of 29 |
| Cloud | AWS, Azure or GCP configuration, identities and permissions. | When most of your systems run in the cloud. | 24 of 29 |
| Mobile application | iOS and Android apps: storage, transport, and the APIs they call. | If you ship a mobile app. | 23 of 29 |
| AI / LLM application | Prompt injection, unsafe tool use and data leakage in chatbots, copilots and agents. | If you ship anything built on a language model. | 23 of 29 |
| Social engineering | Phishing, phone pretexting and similar tests of people and processes. | When people are the likelier way in, or a regulator asks. | 20 of 29 |
| Red team | An objective-based, covert campaign testing detection and response. | After regular pentests, to test the defenders. | 22 of 29 |
| OT / ICS | Industrial control systems and operational technology, tested with extra care. | Manufacturing, energy, utilities. | 11 of 29 |
Counts from each firm’s own service pages, checked 2026-11-08. A firm counts when it lists the service; it doesn’t rank how well it does it.
Where to start
- Your main application and its API, tested authenticated as each role (grey box).
- Your external network, to find what is exposed that shouldn’t be.
- Whatever a requirement names: PCI DSS adds internal network and segmentation tests (compliance).
- Then the specialised ones: cloud, mobile, AI applications, and eventually a red or purple team.
How a test runs from scope to retest: the penetration testing process.
Questions
What are the main types of penetration testing?
Web application, API, external network, internal network, cloud, mobile, AI or LLM application, social engineering and red teaming. Most organizations start with their web application and external network.
Which type of penetration test do I need?
Start from what an attacker would target and what you are asked for: customer questionnaires and SOC 2 usually mean the web app and API; PCI DSS requires external and internal network tests.
Sources for this page
- NIST SP 800-115 — The standard reference for kinds of security testing.
- Each firm’s own service pages — The counts above, linked from every row of the comparison.
How firms are chosen, what counts as "published" and how to send a correction: methodology.
Cite this page
Pentesting Firms. "Types of penetration testing, and how many firms offer each." Updated November 8, 2026. https://pentestingfirms.com/types/