Key Takeaways:
Match the test to the attack surface. Network, web application, cloud, API, mobile, wireless, IoT, physical, and social-engineering testing each address distinct exposure points and should be selected based on the organization’s systems, data, and likely threat paths.
A scan is not a penetration test. Automated tools can identify known weaknesses, but skilled human testers validate exploitability, uncover business-logic and chained vulnerabilities, and demonstrate how an attacker could reach sensitive systems or data.
Test the full Path to Compromise. The most useful engagements show what happens after initial access—such as privilege escalation, credential theft, lateral movement, cloud pivoting, and data access—so teams can prioritize defenses around proven attack paths.
Gray-box and white-box testing often deliver deeper results within real engagement timelines. Providing selected credentials, architecture details, or system context reduces reconnaissance time and lets testers focus effort on exploitation, attack chaining, and actionable findings.
Capability matters more than the testing label. Whether the target is a web app, cloud environment, or internal network, the value of testing depends on whether it realistically reflects the skill, creativity, and techniques of the adversaries the organization needs to defend against.
Different assets face different threats, and each requires a testing approach designed for its specific attack surface. A web application faces different risks than an internal network. A cloud environment exposes different weaknesses than a mobile app. Understanding the types of penetration testing available helps organizations match testing to their actual risk profile.
But understanding types is only the beginning. The value of any penetration test depends on the level of capability behind it. Testing your defenses against automated scripts and industry-standard checklists tells you whether you can withstand a basic scan. Testing them against skilled human testers operating at the level of real-world threat actors tells you whether your defenses will actually hold when they need to. That distinction determines whether testing produces actionable intelligence or compliance paperwork.
This guide covers ten penetration testing types based on target, the distinctions between internal and external infrastructure testing, the differences between black box, white box, and gray box approaches, and why the capability level behind any test matters more than the label on it.
What is Penetration Testing?
Penetration testing is a controlled, authorized attack against your own systems. Skilled testers emulate the techniques, tactics, and procedures (TTPs) used by real threat actors to identify exploitable vulnerabilities and demonstrate actual Paths to Compromise. The objective is to determine whether your defenses can withstand the threats they were designed to stop.
Genuine penetration testing is human-driven. Automated vulnerability scanners identify known weaknesses, but they cannot think creatively, chain vulnerabilities together, or exploit business logic flaws. The majority of penetration tests sold today are automated scans being misrepresented as genuine testing. That distinction matters because a scan tells you what might be vulnerable. A genuine test tells you what is exploitable, how an attacker chains those exploits together, and what they reach at the end. That is contextualized threat intelligence, and it is the foundation for building defenses that actually work.
The intelligence produced by genuine penetration testing goes beyond a list of findings. It maps how an attacker moves through your environment, which systems serve as pivot points, which credentials enable lateral movement, and which paths lead to your most sensitive data. Organizations that use this intelligence to build threat-informed defenses, placing detection, segmentation, and hardening along demonstrated attack paths, achieve a fundamentally stronger security posture than those who simply patch the vulnerability list and move on.
One common misconception is that penetration testers are at a disadvantage compared to real attackers because engagements have fixed timelines. Attackers have weeks, months, or years. Testers might have two to four weeks. But skilled testers overcome that constraint through collaboration with the customer. The customer provides inside knowledge that an attacker would have to spend months discovering independently: network architecture, system inventories, credential sets, business context about where sensitive data lives and how applications interconnect. This compresses the reconnaissance phase dramatically. Instead of spending days mapping what the network looks like, testers start with that knowledge and invest their limited time where it matters most: finding and exploiting vulnerabilities, chaining them into attack paths, and producing the contextualized intelligence that drives real defensive improvement.
The result is that a well-scoped engagement with strong customer collaboration can cover more meaningful ground in two weeks than an attacker might cover in two months. The attacker has time but no insider access. The tester has limited time but leverages insider knowledge to make every hour count. This is why gray box and white box testing approaches often deliver more value than black box. It is not about making the test easier. It is about compressing time so the tester can focus on exploitation and intelligence rather than discovery, and ultimately deliver more coverage and deeper findings within a realistic engagement window.
Types of Penetration Testing
Penetration tests are categorized by target. Each type addresses specific attack surfaces and threats. Regardless of type, the value of any test depends on whether it is performed at a level of capability that reflects realistic threat actors or at a level that merely satisfies a compliance checkbox.
Network Penetration Testing
Network penetration testing evaluates the security of network infrastructure including firewalls, routers, switches, servers, and endpoints. Testing identifies vulnerabilities that could allow unauthorized access, lateral movement, data exfiltration, or service disruption.
At genuine testing levels, testers do not just scan for known vulnerabilities. They perform active and passive reconnaissance, attempt to breach perimeter defenses, and if successful, map the full Path to Compromise through your internal network. This includes lateral movement between systems, privilege escalation from standard user to administrator, and identification of the exact routes an attacker would take to reach sensitive data. The contextualized intelligence from network testing directly informs where to place honeypots, tighten segmentation, and harden critical pivot points.
Scope of testing:
- Port scanning and service enumeration
- Firewall and access control bypass
- Network segmentation validation
- Active Directory and authentication attacks
- Lateral and vertical movement paths
- Metastasis from external breach to internal infrastructure
Network attacks remain the most common initial access vector, with 38% of breaches in 2024 involving network intrusion.
External Network Testing
External penetration testing evaluates internet-facing systems from an outside attacker’s perspective. This includes web applications, email servers, VPN gateways, and any systems accessible from the public internet.
External testing answers: can an attacker on the internet breach our perimeter defenses? At genuine testing levels, successful external breaches lead to metastasis into internal infrastructure, with testing continuing from the new vantage point. This mirrors how real attacks progress and produces intelligence about the full attack chain, not just the initial entry point.
Internal Network Testing
Internal penetration testing evaluates security from the perspective of a malicious insider or compromised device already on the network. Testing identifies how far an attacker can move laterally and vertically once inside.
Internal testing reveals the paths an attacker would take after breaching the perimeter. The intelligence it produces is critical for building threat-informed defenses: where to place honeypots, which credentials to protect most aggressively, which segmentation boundaries to validate, and which systems serve as pivot points that demand hardening. Without internal testing, organizations have no visibility into what happens after the perimeter fails.
Cloud Penetration Testing
Cloud penetration testing assesses configurations, access controls, and data protection in AWS, Azure, GCP, and other cloud environments. Cloud deployments operate under a Shared Responsibility Model where the provider secures infrastructure and you secure your applications and configurations. Many organizations assume cloud hosting means cloud security. It does not.
Testing leverages industry benchmarks like CIS and provider-specific recommendations, focusing on access controls, network configurations, data storage, and security tooling. At higher testing levels, cloud escalation testing focuses on pivoting from traditional on-premises networks into cloud services through credential stuffing, MFA bypass, OAuth exploits, token manipulation, and session hijacking.
Scope of testing:
- Identity and Access Management (IAM) misconfigurations
- Storage bucket permissions and data exposure
- Network security groups and virtual network configurations
- Serverless function and container vulnerabilities
- Escalation paths from on-premises to cloud resources
Wireless Penetration Testing
Wireless penetration testing evaluates Wi‑Fi network security including encryption, authentication, and segmentation. Wireless networks extend the attack surface beyond physical boundaries. An attacker in a parking lot can breach the network without entering the building.
Testing uses passive techniques like packet sniffing and active techniques like exploiting access point vulnerabilities. At advanced levels, testing includes adversary-in-the-middle attacks, client compromise, and evaluation of wireless intrusion prevention system (WIPS) effectiveness.
Scope of testing:
- Authentication and encryption effectiveness (WPA2, WPA3)
- Rogue access point detection
- Adversary-in-the-middle attacks
- Wireless client compromise
- WIPS effectiveness
- Wi‑Fi bleed into unsecured areas
Social Engineering
Social engineering testing evaluates the human element of security. Testers manipulate employees into divulging information, providing credentials, or performing actions that lead to security breaches. Social engineering was involved in 68% of breaches in 2024 according to the Verizon DBIR. The most sophisticated technical controls fail when an employee clicks a malicious link.
Testing uses phishing, vishing (voice phishing), and other psychological manipulation techniques. OSINT research develops realistic pretexts. Advanced testing includes spear phishing targeting specific individuals, baiting, quid pro quo attacks, doppelganger domains, and custom tools including C2 frameworks for endpoint compromise.
Scope of testing:
- Phishing campaigns with OSINT-developed pretexts
- Vishing with caller ID spoofing
- Credential harvesting and malware delivery
- Impersonation and pretexting
- Metrics tracking: delivery rates, engagement, breach success
Web Application Penetration Testing
Web application penetration testing identifies vulnerabilities that could allow attackers to compromise data, hijack sessions, or control backend systems. Testing covers both authenticated and unauthenticated perspectives.
Automated scanners cover the OWASP Top 10 as a baseline, but the vulnerabilities that matter most live in business logic, custom authentication flows, and the assumptions developers made about how users would interact with the application. A scanner cannot find the IDOR that exposes customer records through predictable API parameters, the race condition in a checkout flow, or the JWT implementation flaw that lets attackers forge tokens. Genuine testing finds these because human testers think like both developers and attackers.
Scope of testing (OWASP Top 10):
- A01:2025 – Broken Access Control
- A02:2025 – Security Misconfiguration
- A03:2025 – Software Supply Chain Failures
- A04:2025 – Cryptographic Failures
- A05:2025 – Injection
- A06:2025 – Insecure Design
- A07:2025 – Authentication Failures
- A08:2025 – Software or Data Integrity Failures
- A09:2025 – Security Logging and Alerting Failures
- A10:2025 – Mishandling of Exceptional Conditions
Genuine web application testing goes beyond the OWASP Top 10 to include business logic vulnerabilities, race conditions, and application-specific flaws that no framework can categorize in advance. These are often the most damaging because they are unique to the application and invisible to automated tools.
At advanced levels, WAF Efficacy Testing evaluates whether the web application firewall actually protects against discovered vulnerabilities by testing with and without WAF bypass.
Mobile App Penetration Testing
Mobile application penetration testing identifies vulnerabilities in iOS and Android applications, their backend APIs, and data transmission. Testing covers the entire mobile ecosystem including the underlying operating system, application backend, and third-party services.
Applications are loaded into emulators to facilitate network traffic interception. Testing phases include decompilation, reconnaissance, mapping, and exploitation following the OWASP Mobile Security Testing Guide (MSTG).
Scope of testing (OWASP Mobile Top 10):
- Insecure data storage on device
- Insecure communication
- Insecure authentication and authorization
- Insufficient cryptography
- Code tampering and reverse engineering
- Extraneous functionality
API Penetration Testing
API penetration testing targets Application Programming Interfaces that connect applications, services, and data. APIs are critical infrastructure for modern applications. A vulnerability in an API can expose data from every application that uses it.
Testing simulates attacks by external, unauthenticated, or authenticated threat actors to exploit API endpoints following the OWASP API Testing Guide.
Scope of testing:
- Broken object level authorization
- Broken user authentication
- Excessive data exposure
- Lack of rate limiting and resource exhaustion
- Broken function level authorization
- Injection vulnerabilities
IoT Penetration Testing
IoT penetration testing evaluates connected devices including sensors, cameras, industrial control systems, and smart building infrastructure. These devices often have weak security controls and provide entry points into otherwise secure networks.
Scope of testing:
- Default credentials and weak authentication
- Firmware vulnerabilities and update mechanisms
- Insecure network protocols
- Physical security of device interfaces
- Network segmentation between IoT and corporate systems
Physical Penetration Testing
Physical penetration testing evaluates an organization’s physical security controls by attempting to gain unauthorized access to facilities, restricted areas, and sensitive infrastructure. Physical security is often treated as separate from cybersecurity, but the two are inseparable. An attacker who can walk into a server room does not need a remote exploit.
Testing assesses whether physical barriers, access controls, surveillance systems, and security personnel can prevent unauthorized entry. Testers attempt tailgating, badge cloning, lock bypass, and social engineering of front desk and security staff. At advanced levels, testing includes after-hours intrusion attempts, dumpster diving for sensitive information, and planting rogue devices on the internal network.
The intelligence from physical testing reveals gaps that no amount of network hardening can compensate for. If an attacker can plug a device into your network from inside the building, your perimeter defenses are irrelevant. Physical testing is particularly critical for organizations with data centers, research facilities, or any environment where physical access translates directly to data access.
Scope of testing:
- Badge cloning and access control bypass
- Tailgating and social engineering of security personnel
- Lock picking and physical barrier assessment
- Surveillance system effectiveness
- Rogue device placement on internal networks
- Dumpster diving and sensitive document exposure
Red Teaming
Red teaming is fundamentally different from traditional penetration testing. A penetration test is designed to find as many vulnerabilities and attack paths as possible within a defined scope. Red teaming is not. It is objective-oriented and executed like a military operation, not a security assessment.
In a red team engagement, the team is given a specific mission: exfiltrate a particular dataset, compromise a specific executive’s credentials, disrupt a critical business process, or demonstrate access to a high-value system. Every decision the red team makes serves that objective. They do not catalog every vulnerability they encounter along the way. They find what they need to accomplish the mission and they execute.
Red team operations combine multiple attack surfaces simultaneously. A single engagement might involve physical intrusion, social engineering, network exploitation, and application-level attacks, all coordinated toward the objective. The team operates with stealth, using custom tooling, real-world command and control infrastructure, and techniques designed to evade detection. This is adversary simulation at its most realistic.
The value of red teaming is that it tests your organization’s security program as a whole, not individual systems in isolation. It answers a fundamentally different question than penetration testing. A penetration test asks: what vulnerabilities exist? A red team engagement asks: can a skilled, motivated adversary achieve this specific objective against your organization, and can your people detect and respond to the attack in progress?
Red teaming also stress-tests your detection and response capabilities. If the red team achieves the objective without triggering an alert, that tells you something no penetration test ever would.
Difference Between Black Box, White Box, and Gray Box Penetration Testing
Penetration tests are also categorized by tester knowledge. The information provided affects scope, depth, and realism.
Black Box
Black box testing provides testers with no prior knowledge. Testers perform reconnaissance to discover systems, identify vulnerabilities, and plan attacks. This approach most closely simulates an external attacker with no insider knowledge.
Advantage: Realistic external threat simulation. Limitation: Reconnaissance time reduces testing depth.
White Box
White box testing provides complete knowledge: network diagrams, source code, credentials, and configurations. This eliminates reconnaissance time and enables maximum testing depth.
Advantage: Maximum depth and coverage. Limitation: Does not simulate real-world attacker perspective.
Gray Box
Gray box testing provides partial knowledge, typically user-level credentials and basic system information. This simulates an attacker with initial access or insider knowledge.
Advantage: Balances realism and depth. Limitation: May miss vulnerabilities visible only from fully external or internal perspectives.
| Aspect | Black Box | White Box | Gray Box |
|---|---|---|---|
| Tester Knowledge | None | Complete | Partial |
| Realism | High | Low | Medium |
| Coverage Depth | Limited by time | Maximum | Balanced |
| Simulates | External attacker | Insider threat | Compromised user |
Our Methodology: Real Time Dynamic Testing
Real Time Dynamic Testing is Netragard’s proprietary methodology derived from vulnerability research and exploit development practices. Unlike testing approaches that rely on automated tools with manual validation, this methodology treats every environment as unique and applies research-driven analysis to discover both known and novel vulnerabilities.
The methodology maps the Path to Compromise: how an attacker moves from initial access to sensitive data through lateral movement, privilege escalation, and data exfiltration. This produces contextualized threat intelligence that organizations can use to build threat-informed defenses, placing detection, hardening, and segmentation along the exact paths attackers would take. The intelligence from a single engagement informs honeypot placement, credential canary deployment, segmentation validation, and prioritized remediation. Testing at this level does not just find vulnerabilities. It provides the blueprint for a defense strategy informed by real attack scenarios.
Netragard Penetration Testing Capabilities
Netragard has delivered genuine, human-driven penetration testing services since 2006. Our methodology is derived from vulnerability research and exploit development, enabling discovery of vulnerabilities that automated tools and AI-driven services cannot find.
Every engagement produces contextualized threat intelligence that maps the Paths to Compromise through your specific environment. This intelligence drives more than remediation. It informs threat-informed defenses: honeypot placement along demonstrated attack paths, credential canary deployment where testers harvested credentials, segmentation hardening at validated pivot points, and system hardening based on demonstrated exploit chains. Organizations that leverage this intelligence build security programs that adapt to their actual threat landscape rather than reacting to generic vulnerability lists.
We test at a level of capability that matches or exceeds real-world threat actors because testing below that level does not answer the question that matters: will your defenses hold when a skilled adversary targets your organization? If you are testing against automated scripts and baseline checklists, you are measuring your defenses against a standard that no real attacker is constrained by.
All penetration testing types are available at three service tiers:
Silver: Industry-standard compliance testing. Automated scanning with manual vetting and exploitation. Satisfies audit requirements.
Gold: Research-driven genuine testing using Real Time Dynamic Testing. Identifies known and novel vulnerabilities, maps Path to Compromise, produces contextualized threat intelligence.
Platinum: Maximum threat intensity exceeding real-world attacks. Includes Gold capabilities plus Threat Augmentation Modules: advanced social engineering, stealth and evasion, adversary simulation, and incident detection efficacy testing.
If your organization needs testing that reflects the actual threats you face, not the ones automated tools can find,
Request a Quote to discuss your security objectives. For guidance on selecting a testing provider, see our guide on what to look for in a penetration testing company.
FAQ
How often should different types of penetration testing be performed?
At minimum, penetration testing should be performed annually across all critical systems. Additional testing should occur after significant infrastructure changes, new application deployments, mergers and acquisitions, or security incidents. High-risk systems like internet-facing applications may require more frequent testing. Regulatory frameworks like PCI DSS,
SOC 2, and GDPR have specific testing frequency requirements.
What is the difference between red teaming and penetration testing?
Red teaming is objective-oriented adversary simulation executed like a military operation. The team is given a specific mission and uses any combination of attack surfaces to achieve it. Penetration testing is broader, aiming to identify as many vulnerabilities and attack paths as possible within a defined scope. Red team engagements typically run over extended periods and emulate sophisticated threat actors using real-world TTPs, custom tools, and C2 infrastructure. They test the entire security program, including detection and response, not just technical controls.
What type of penetration testing is required for compliance audits?
Requirements vary by framework. PCI DSS requires annual network and web application penetration testing plus testing after significant changes. SOC 2 requires regular testing of security controls. HIPAA expects security assessments as part of demonstrating reasonable safeguards. Most frameworks require more than vulnerability scanning, though many organizations mistakenly accept scans as penetration tests. Compliance-level testing satisfies auditors. Genuine testing at realistic threat levels actually prevents breaches.
Can multiple types of penetration testing be combined?
Yes, and they should be. Comprehensive assessments combine multiple testing types to reflect how real attacks unfold. External network testing identifies initial access, leading to internal testing for lateral movement, combined with social engineering for the human element. Cloud testing can combine with network testing to identify on-premises to cloud escalation paths. Combining types produces a more complete picture of your organization’s Paths to Compromise and generates the contextualized intelligence needed to build effective threat-informed defenses.
