Black-box vs gray-box penetration testing
Short definition
Black-box and gray-box describe how much the tester knows at the start. Black-box testing starts from nothing but what the target exposes, like an outside attacker. Gray-box testing starts with partial knowledge — typically user credentials, documentation or the software's source — like an insider or an attacker who has done their homework.
Why this matters now
The mode decides which attacker your test represents. Regulators and threat-led frameworks (TLPT, TIBER-EU) expect tests grounded in realistic threat scenarios, and most real intrusions combine both perspectives: external reconnaissance first, then abuse of legitimate access or published source code.
Key points
- ▸Black-box: no credentials, no source, no documentation — the view of an external, unauthenticated attacker.
- ▸Gray-box: partial knowledge such as valid user accounts or the source of the exact software version in use.
- ▸White-box: full knowledge of the system, typical of code review and architecture assessment.
- ▸Black-box measures what is exposed; gray-box finds what an informed attacker would find behind the login.
- ▸An autonomous AI red team can run both continuously and compare the results over time.
Choosing the mode for each question
- "What can someone on the internet do to us?" — black-box against the external surface.
- "What happens if a user account is compromised?" — gray-box with the credentials of a standard user.
- "Is the software we run hiding a weakness no catalogue lists yet?" — gray-box informed by the source of the exact version in use.
- "Is our architecture sound?" — white-box review with full documentation.
Mature programmes schedule several modes: black-box to track the attack surface, gray-box to test what sits behind authentication, and periodic white-box reviews of critical systems.
How Zero Hunt uses black-box and gray-box
Zero Hunt's campaigns run in black-box mode by default: the engine starts from the authorised scope and works only with what the targets reveal. It can switch to gray-box in two ways: authenticated testing, where it drives real login flows with credentials you provide and tests the application as a signed-in user; and source-informed analysis, where it identifies the exact version of the software in use, studies that version's source and validates a finding with a proof of concept — the capability we call Generative Zero-Day PoC.
Both run on the appliance, on private AI, within the approval gates of the chosen autonomy level.
Goes deeper
Want this against your environment?
Book a 30-minute scoping call — we will map this directly to your current compliance scope and threat profile.