Testing
Black, grey and white box: what you are buying with each
How much you tell the tester changes what the budget is spent on, and the intuitive choice is often the wrong one.
Facts checked — 2026-09-11
What is the difference between black, grey and white box testing?
Black box gives the tester nothing — realistic in the sense that an external attacker starts there, but a large part of the engagement is spent rediscovering an architecture you could have described in an hour. You pay for reconnaissance instead of findings.
Grey box supplies credentials for each role and some documentation, and is usually the best value: the tester spends the time on authorisation boundaries and business logic, which is where the interesting flaws are. White box adds source code and suits high-assurance work or a security-critical component.
The bottom line
Unless you are specifically testing detection and response, give the tester credentials. You are paying either way; grey box spends it on findings.
Related services
Vulnerability Assessment and Penetration Testing (VAPT)
Find what an attacker would find, ranked by what it would actually cost you — and get a report your auditor and your engineers can both use.
Related insights
Technical testing
The OWASP Testing Guide, and how to tell a real penetration test from a scan
Two tests can cost the same and cover entirely different ground. The methodology is how you tell, and it is checkable before you pay.
Technical testing
NIST SP 800-115: the four phases, and the one that is not a phase
The four-phase shape behind most credible test methodologies — and the phase that is not fourth at all.
Testing
What a CVSS score does and does not tell you about your risk
A shared scale for technical severity — deliberately context-free, which is exactly why it is not your priority order.