Types of Penetration Testing: The Complete Guide

"Penetration test" isn't one thing. It's a family of engagements, each built to find a different class of weakness — and picking the wrong one means paying for a report that doesn't answer the question you actually had. This guide breaks down every major type so you can figure out which ones apply to you, then links out to a full write-up on each.

The types split into two groups: access models (how much information and access the tester starts with) and attack surfaces (what part of your environment they're testing). Most real engagements combine one from each group — e.g., a black box web application test, or a gray box cloud test.

Access models: how much the tester knows going in

These describe the tester's starting knowledge, not the target. The same web app can be tested black, white, or gray box depending on what you want to learn.

• Black Box Penetration Testing — the tester gets zero inside information and attacks the way a real outside attacker would: pure external recon and exploitation. Best for validating what's actually exposed to the internet.
• White Box Penetration Testing — the tester gets full access: source code, architecture diagrams, credentials. This finds deeper, more subtle flaws faster because time isn't spent on blind recon.
• Gray Box Penetration Testing — a hybrid, usually simulating an insider or a compromised low-privilege account. It's the most common real-world starting point because most breaches don't start from zero knowledge either.

Attack surfaces: what's being tested

• Web Application Penetration Testing — targets the OWASP Top 10 and business logic flaws in the applications your customers and employees actually use.
• Mobile Application Penetration Testing — covers the client, the API it talks to, and how it stores data on-device, across the risk categories specific to mobile apps.
• Cloud Penetration Testing — tests your side of the shared responsibility model: misconfigurations, IAM, storage exposure, and the issues that are unique to cloud infrastructure versus on-prem.
• IoT Penetration Testing — connected devices and the SCADA/embedded systems behind them, mapped against the OWASP IoT Top 10.
• Physical Penetration Testing — tests whether someone can walk into your building, badge-clone their way past a door, or plug into an open network port.
• Wireless Penetration Testing — targets your Wi-Fi infrastructure and the vulnerabilities specific to wireless protocols and rogue access points.
• Social Engineering Testing — targets people: phishing, pretexting, and the human layer that technical controls can't patch.

Where to start

If you've never had a penetration test, start with our overview of what a penetration test actually is — it covers the fundamentals this guide assumes. If you already know you need one but aren't sure how to scope it, our Penetration Testing Buyer's Guide covers when you need a test, how to choose a provider, and what a real engagement looks like end to end. Curious what actually happens once testing starts? See Our Penetration Testing Process.