Types of Penetration Testing: Target Domains and Approaches

The main types of penetration testing are network (external and internal), web application and API, mobile, cloud, wireless, social engineering and AI testing, each run as a black, grey or white box test. A penetration test is an authorized, simulated attack that finds weaknesses before a real attacker does.

The different types of penetration testing are grouped by what is tested (target domains) and how much the tester knows (knowledge levels). A typical test takes 1 to 3 weeks, plus a few days for the report.

Main target domains

• Network penetration testing: Servers, routers, firewalls and switches. Our network and infrastructure penetration testing costs $5,000–$12,000+ for complex infrastructure. It splits into:
  • External: An internet attacker probing public hosts and login portals. External penetration testing is quoted individually.
  • Internal: An insider, or an attacker already past the perimeter. Internal penetration testing is quoted individually; compare internal vs external penetration testing.
• Web application testing: Websites, web apps and APIs, checked for business logic flaws and OWASP Top 10 risks. Our standard web application penetration testing or API penetration testing engagement costs $2,500–$5,500.
• Mobile application testing: Apps checked for insecure data storage, weak encryption and improper session handling. Mobile application penetration testing starts from $3,500 for a mobile app (iOS or Android).
• Cloud infrastructure testing: Misconfigurations, IAM permission errors and container weaknesses. Cloud penetration testing costs $5,000–$12,000+ (AWS or Azure); GCP is quoted individually.
• Wireless network testing: Wi-Fi encryption and rogue access points. Wireless can be scoped into the network test; IoT and OT devices are quoted individually.
• Social engineering: Phishing, vishing and pretexting against your staff. Social engineering testing is quoted individually; physical testing is a separate engagement, authorized and quoted alone.
• AI penetration testing: Chatbots, agents and RAG systems, tested for prompt injection and tool misuse, with test cases aligned with the OWASP Top 10 for LLM Applications (2025). AI and LLM penetration testing is quoted individually.

Testing approaches (knowledge levels)

Three types of pen testing by knowledge level:

• Black box: The tester has no prior knowledge, like an uninformed outside attacker.
• White box: The tester gets source code, network diagrams and architecture for a deep audit.
• Grey box: The tester has partial information or limited user credentials, balancing realism and efficiency.

The approach changes where tester-days go; see black box penetration testing compared with grey and white box.

How to choose and combine test types

Choose penetration testing types by asset and goal:

• By asset: A web app maps to web and API testing, public systems to external, Active Directory to internal, AWS or Azure to cloud, and a mobile app to mobile plus its API.
• By goal: Audit evidence for PCI DSS, SOC 2 or ISO 27001 calls for compliance penetration testing (we don’t certify compliance). To check whether your team detects an attack, choose red teaming, from $15,000, and see how red teaming differs from a penetration test. Financial entities selected under DORA need threat-led penetration testing (TLPT). Frequent releases suit penetration testing as a service (PTaaS).
• Combine types in one scope: In one mobile test, the backend trusted values the app calculated on the device. By changing the request, the tester sent values the app’s screens wouldn’t allow. A scan of the app alone can miss this because the flaw sits between app and API, so it pays to scope both together.

(Note: we can quote several types together in tester-days. See our penetration testing services and the average cost of penetration testing by test type. A retest is available after fixes.)

Sources: OWASP Top 10.