Types of penetration testing

What are the types of penetration testing?

Pentests are named along two independent axes: what is being attacked, and what the tester is told before starting. A "gray-box external web application test" uses both. The target axis decides which weaknesses the test can reach; the knowledge axis decides how much of the budget goes on discovery versus attack.

By target, the common types are external network, internal network, web application, API, mobile application, cloud, wireless, social engineering and physical. By knowledge, they are black-box, gray-box and white-box, covered in detail in black-box, gray-box and white-box testing.

What does each type cover, and when do you need it?

Each type attacks a different surface and answers a different question.

Specialized variants sit inside these. A segmentation test is a network test that checks whether out-of-scope networks can reach the cardholder data environment. An LLM penetration test is an application test aimed at prompt injection and tool misuse in AI features.

How do network, application and API tests differ?

A network test attacks hosts and services; an application or API test attacks what the software does once you reach it. A network tester who finds port 443 open with current TLS moves on; an application tester logs in as two users and checks whether one can read the other's data.

API testing overlaps with web application testing but deserves its own line in the scope. APIs expose object IDs and functions directly, without a UI hiding them, and many endpoints exist only for mobile apps or integrations. The OWASP API Security Top 10 2023 puts broken object level authorization first. Finding it requires accounts for at least two users, which is why application and API tests are nearly always authenticated.

The PCI SSC's penetration testing guidance makes the same distinction in a compliance setting: both internal and external tests must include application-layer and network-layer assessments. A network-only test does not meet that.

What makes cloud testing different?

In the cloud, much of the attack surface is configuration and identity, and the provider sets rules on what you may test. Under the shared responsibility model you can test your own resources, not the provider's underlying infrastructure.

Provider policies differ and change, so read them before scoping. AWS, for example, permits testing of listed services without prior approval but prohibits denial of service, request flooding, and DNS zone walking against Route 53, among other activities. A cloud test typically combines an authenticated configuration review (IAM policies, storage permissions, logging) with attacks from the application inward, such as server-side request forgery against the instance metadata service.

When are social engineering and physical tests in scope?

Only when they are explicitly agreed, because they target people and places. NIST SP 800-115 treats both as part of penetration testing and advises that security guards be told how to verify a tester's authorization, such as a point of contact or documentation. Most application-focused tests exclude both in the rules of engagement.

FedRAMP is the notable framework that requires one. Its Penetration Test Guidance makes "External to Corporate" a mandatory attack vector: a phishing campaign against the cloud provider's system administrators and the staff who can influence them.

How do you choose which types to buy?

Start from where your sensitive data and privileged functions live, then add what your frameworks name. A practical sequence:

1. List the surfaces. Public IP ranges, web apps, APIs, mobile apps, cloud accounts, office networks.
2. Mark where the data is. The surfaces that store or reach customer data, secrets or payment flows get tested first.
3. Add framework requirements. PCI DSS requires internal and external tests plus segmentation testing where segmentation reduces scope. FedRAMP names six mandatory attack vectors. See internal vs external penetration testing.
4. Pick the knowledge level. Gray-box for most application and API work; black-box when the question is what an outsider can find.
5. Write it into the scope. Name each type, target and exclusion so the report states exactly what was covered.

For a SaaS company with no offices of note, that usually means a gray-box web application and API test, a cloud configuration test, and an external network test of the public perimeter. For the process each test follows, see penetration testing methodology.

Written by Parameter · Last reviewed September 27, 2026