Types of penetration test, from black box to red teaming
In short: A penetration test is an authorised, simulated attack to find and demonstrate weaknesses. Tests differ by how much the tester is told (black, grey or white box) and by what is targeted. Red team exercises go further, testing detection and response against a realistic goal.
What a penetration test is
A penetration test (pen test) is an authorised, time-limited attempt to find and safely exploit weaknesses, to show what a real attacker could achieve. Unlike a vulnerability scan, a tester thinks creatively, chains small issues together and confirms real impact. Every type of test needs written authorisation and an agreed scope.
Knowledge levels: black, grey and white box
- Black box: testers get only a company name or address range, like an outsider.
- Grey box: testers get some information, such as a normal user account or an API description. This balances realism with efficient use of the paid time.
- White box (crystal or clear box): testers get full access to documentation, configurations and sometimes source code.
Because tests are time-boxed, black box tests can spend much of their budget on discovery that the client could simply have provided. Grey box is often the best value.
Types by target
| Test type | Question it answers | Typical findings |
|---|---|---|
| External network | What can an internet attacker reach? | Exposed admin services, outdated VPNs, weak TLS |
| Internal network | If an attacker gets a foothold, how far can they go? | Weak passwords, legacy protocols, flat networks |
| Web application | Can the application be abused? | Access control flaws, injection, session issues |
| Wireless | Is Wi-Fi properly protected and separated? | Weak pre-shared keys, guest access to internal networks |
| Social engineering | Will people or processes give access away? | Phishing success, tailgating, help desk resets |
| Cloud | Are cloud accounts and services configured safely? | Over-privileged roles, public storage, missing logging |
Other specialist types include mobile application, API, thick client, hardware and IoT, and operational technology (OT) testing, which needs extra care because industrial systems can be fragile.
Red, blue and purple teaming
A red team exercise is broader and stealthier than a pen test. Instead of finding as many weaknesses as possible, the red team pursues a goal (for example, reaching the payments system) using whatever realistic routes are allowed, while the defenders, the blue team, are usually not told. It tests detection and response as much as prevention. In a purple team exercise, attackers and defenders work together openly, running techniques one by one and improving detections as they go. Regulated sectors sometimes require threat-led schemes such as CBEST in UK financial services or TIBER-EU in Europe.
Tip: match the test to the question. A new web app needs an application test; a board asking "would we spot a real attacker?" needs red or purple teaming, and only once basic hygiene is in place.
Practice
A tester is given a normal user login to the client portal before testing. Which knowledge level is this?
What is the main difference in purpose between a penetration test and a red team exercise?
Why is grey box testing often good value?
Key takeaways
- A pen test is an authorised, time-boxed simulated attack that proves impact.
- Black, grey and white box describe how much the tester is told.
- Targets include external, internal, web, wireless, social and cloud.
- Red teams pursue goals stealthily; purple teams improve detection together.
- Choose the test type that answers the business question.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.