Black-box vs gray-box vs white-box penetration testing
Published by Zero Hunt, an autonomous AI red team on an on-premise appliance running private AI: automated penetration testing for networks and infrastructure, black-box or gray-box, with a human approving every step that matters.
Short definition
Black-box and gray-box describe how much the tester knows at the start. Black-box testing starts from nothing but what the target exposes, like an outside attacker. Gray-box testing starts with partial knowledge — typically user credentials, documentation or the software's source — like an insider or an attacker who has done their homework.
Why this matters now
The mode decides which attacker your test represents. Regulators and threat-led frameworks (TLPT, TIBER-EU) expect tests grounded in realistic threat scenarios, and most real intrusions combine both perspectives: external reconnaissance first, then abuse of legitimate access or published source code.
Key points
- ▸Black-box: no credentials, no source, no documentation — the view of an external, unauthenticated attacker.
- ▸Gray-box: partial knowledge such as valid user accounts or the source of the exact software version in use.
- ▸White-box: full knowledge of the system, typical of code review and architecture assessment.
- ▸Black-box measures what is exposed; gray-box finds what an informed attacker would find behind the login.
- ▸An autonomous AI red team can run both continuously and compare the results over time.
Choosing the mode for each question
- "What can someone on the internet do to us?" — black-box against the external surface.
- "What happens if a user account is compromised?" — gray-box with the credentials of a standard user.
- "Is the software we run hiding a weakness no catalog lists yet?" — gray-box informed by the source of the exact version in use.
- "Is our architecture sound?" — white-box review with full documentation.
Mature programs schedule several modes: black-box to track the attack surface, gray-box to test what sits behind authentication, and periodic white-box reviews of critical systems.
Pros and limits of each mode
- Black box. Pros: the most realistic view of an outside attacker, and almost no preparation on your side. Limits: much of the time goes into discovery, and anything behind a login or off the reachable surface stays untested.
- Gray box. Pros: reaches authenticated functions and tests access control, privilege escalation and what one compromised account can do, with less time spent on discovery. Limits: you must prepare test accounts or provide the software version, and the result no longer shows what a stranger alone would find.
- White box. Pros: the deepest coverage, including design and code flaws that are invisible from outside. Limits: needs full documentation and source access and more expert time, and it does not measure your real external exposure.
No mode replaces the others: a clean black-box result says little about what sits behind authentication, and a white-box review says little about what the internet can reach today.
How Zero Hunt uses black-box and gray-box
Zero Hunt's campaigns run in black-box mode by default: the engine starts from the authorized scope and works only with what the targets reveal. It can switch to gray-box in two ways: authenticated testing, where it drives real login flows with credentials you provide and tests the application as a signed-in user; and source-informed analysis, where it identifies the exact version of the software in use, studies that version's source and validates a finding with a proof of concept — the capability we call Generative Zero-Day PoC.
Both run on the appliance, on private AI, within the approval gates of the chosen autonomy level.
Goes deeper
Want this against your environment?
Book a 30-minute scoping call — we will map this directly to your current compliance scope and threat profile.