Black box vs white box penetration testing

Black box: no credentials, no documentation, no source. The tester starts where an anonymous internet attacker starts.

White box: source code, architecture documentation, credentials for every role. Grey box sits between, and is what most engagements should actually be: credentials for each role plus whatever documentation exists, without source code.

Discovery is not free. A black box tester spends a meaningful share of the window working out what you already know: which endpoints exist, which roles exist, how the application is structured.

At the end of a fixed window, you have paid for reconnaissance you could have supplied in an email. And you have no coverage at all of authenticated functionality, which is where most of the serious findings live.

When the question genuinely is about the external perimeter: what an unauthenticated attacker can reach from the internet, what your exposed services disclose, whether anything lets someone in without credentials.

It is also the honest choice when you want to test detection rather than the application. If nobody on your side knows the test is happening, you learn what your monitoring actually catches, which is a different and sometimes more valuable result.

Give the tester one account per role plus a second account at the lowest privilege level, and the whole access control category becomes testable. Without that second low-privilege account, horizontal access control cannot be tested at all.

Attackers are not limited to the black box position either. A real adversary buys a subscription, phishes an employee, or reads your public client code. Starting the tester with less knowledge than a motivated attacker would have does not make the test more realistic.