Key Takeaways
- There are 7 primary types of penetration testing, each targeting a different attack surface
- The right test type depends on your infrastructure, threat model, and compliance requirements
- Most organizations need a combination of network, web application, and social engineering tests
- Black box, white box, and grey box approaches offer different levels of realism versus thoroughness
- Cloud and API pentesting have become critical as organizations accelerate digital transformation
Not all penetration tests are equal. A network pentest examines fundamentally different attack surfaces than a web application test or a social engineering assessment. Choosing the wrong type wastes budget and leaves critical vulnerabilities unexposed. According to SANS Institute research (2025), 67% of organizations that suffered a breach had conducted penetration testing in the prior 12 months — but had tested the wrong attack surface. This guide breaks down the 7 primary types of penetration testing so you can make an informed decision about which tests your organization actually needs.
Understanding Testing Approaches: Black Box, White Box, Grey Box
Before exploring the 7 types, it is essential to understand the three fundamental testing approaches that apply across all types:
| Approach | Tester Knowledge | Simulates | Best For |
|---|---|---|---|
| Black Box | No prior knowledge of systems | External attacker | Realistic attack simulation |
| White Box | Full access to source code, architecture, credentials | Insider threat or post-compromise | Maximum vulnerability coverage |
| Grey Box | Partial knowledge (e.g., user credentials, network diagrams) | Compromised user or partner | Balance of realism and depth |
A 2025 study by the Ponemon Institute found that grey box testing identifies 39% more critical vulnerabilities than black box testing alone, while white box testing finds 52% more — though at higher cost and time investment.
1. Network Penetration Testing
Network pentesting evaluates the security of your network infrastructure — both external (internet-facing) and internal (behind the firewall). It is the most traditional and widely conducted form of penetration testing.
What It Tests
- Firewalls, routers, and switches
- Network segmentation and VLAN configurations
- Active Directory and domain services
- VPN and remote access configurations
- Wireless networks (if in scope)
- DNS, DHCP, and other network services
Common Findings
According to Rapid7's 2025 Penetration Testing Report, the most common network pentest findings include: weak or default credentials (found in 71% of engagements), outdated or unpatched systems (63%), excessive user privileges (58%), and poor network segmentation (49%).
Cost range: EUR 5,000 - 20,000 depending on the number of hosts and network complexity.
Duration: 1-3 weeks for a typical mid-sized organization (100-500 hosts).
Best for: Any organization with a corporate network. Required annually at minimum under most compliance frameworks.
2. Web Application Penetration Testing
Web application pentesting targets websites, web portals, e-commerce platforms, and SaaS applications. With web applications being the number one attack vector in 2025 (Verizon DBIR 2025), this is often the highest-priority test type.
What It Tests
- OWASP Top 10 vulnerabilities (injection, broken authentication, XSS, etc.)
- Business logic flaws
- Session management and authentication mechanisms
- Input validation and output encoding
- File upload and download functionality
- Role-based access control (RBAC) bypass
Common Findings
HackerOne's 2025 Hacker-Powered Security Report found that cross-site scripting (XSS) remains the most commonly reported web vulnerability (23%), followed by insecure direct object references (IDOR) at 18%, and SQL injection at 12%. Business logic flaws, which automated scanners cannot detect, accounted for 15% of critical findings.
Cost range: EUR 3,000 - 18,000 per application.
Duration: 3-10 business days per application.
Best for: Organizations running customer-facing web applications, SaaS providers, e-commerce businesses. For a deep dive into web app testing methodology, see our OWASP Top 10 methodology guide.
3. Mobile Application Penetration Testing
Mobile pentesting assesses the security of iOS and Android applications, including their communication with backend APIs and local data storage. With mobile devices accounting for 59% of global web traffic (Statista, 2025), mobile app security is no longer an afterthought.
What It Tests
- Local data storage (keychain, shared preferences, SQLite databases)
- Transport layer security (certificate pinning, TLS configuration)
- Authentication and session management
- Binary protections (code obfuscation, anti-tampering)
- Inter-process communication (IPC) vulnerabilities
- Backend API security (shared with API pentesting)
The OWASP Mobile Application Security Testing Guide (MASTG) serves as the primary methodology, covering both iOS and Android platforms.
Cost range: EUR 6,000 - 15,000 per platform (iOS or Android). Testing both platforms typically costs 1.5x a single platform test, not 2x, due to shared backend testing.
Duration: 1-2 weeks per platform.
Best for: FinTech, healthcare, banking, and any organization with a public-facing mobile app handling sensitive data.
4. API Penetration Testing
API pentesting has surged in importance as organizations adopt microservices architectures and expose APIs to partners and third parties. Gartner predicted that API attacks would become the most frequent attack vector by 2025, and their prediction has proven accurate — API-related breaches increased 137% between 2023 and 2025 (Salt Security, State of API Security 2025).
What It Tests
- Authentication mechanisms (OAuth 2.0, JWT, API keys)
- Authorization and access control (BOLA, BFLA vulnerabilities)
- Input validation and injection attacks
- Rate limiting and resource consumption
- Data exposure through verbose error messages or oversharing endpoints
- API versioning and deprecated endpoint security
OWASP API Security Top 10 (2023)
The OWASP API Security Top 10 serves as the primary reference. The most critical risks include: Broken Object Level Authorization (BOLA), Broken Authentication, Broken Object Property Level Authorization, Unrestricted Resource Consumption, and Broken Function Level Authorization.
Cost range: EUR 5,000 - 15,000 per API or API group.
Duration: 1-2 weeks.
Best for: SaaS companies, financial services, healthcare platforms, and any organization exposing APIs to external consumers.
5. Cloud Penetration Testing
Cloud pentesting evaluates the security of infrastructure, configurations, and workloads deployed on cloud platforms (AWS, Azure, GCP). As 94% of enterprises now use cloud services (Flexera State of the Cloud Report 2025), cloud-specific security testing has become essential.
What It Tests
- IAM policies and role configurations
- Storage bucket permissions (S3, Azure Blob, GCS)
- Virtual network segmentation and security groups
- Container and Kubernetes security
- Serverless function vulnerabilities
- Cloud-native service misconfigurations
Important: Cloud Provider Rules of Engagement
Each cloud provider has specific policies regarding penetration testing. AWS no longer requires prior authorization for most tests. Azure requires following their Rules of Engagement. GCP permits testing of your own resources without notification. Always verify current policies before testing.
Cost range: EUR 10,000 - 30,000 depending on cloud environment complexity.
Duration: 1-3 weeks.
Best for: Organizations with significant cloud workloads, especially those handling regulated data. Orizon Recon can provide continuous external visibility into your cloud attack surface between periodic pentests.
6. Social Engineering Penetration Testing
Social engineering testing evaluates the human element of security — your employees' ability to recognize and resist manipulation attempts. Verizon's 2025 Data Breach Investigations Report found that 74% of all breaches involved a human element, making this test type indispensable.
What It Tests
- Email phishing campaigns (spear phishing, whaling)
- Phone-based pretexting (vishing)
- SMS phishing (smishing)
- Physical social engineering (tailgating, impersonation)
- USB drop attacks
- Credential harvesting through fake login pages
Typical Results
According to KnowBe4's 2025 Phishing Industry Benchmarking Report, the average phishing click rate across all industries is 32.4% before security awareness training and drops to 5.4% after one year of regular training and simulated phishing exercises.
Cost range: EUR 5,000 - 15,000 depending on campaign scope and duration.
Duration: 1-4 weeks (campaigns typically run for 2 weeks to capture realistic response rates).
Best for: All organizations. Particularly critical for finance, healthcare, and any industry handling sensitive customer data.
7. Physical Penetration Testing
Physical pentesting assesses the security of your physical facilities — building access controls, surveillance systems, server room protection, and clean desk policies. While less commonly requested than digital tests, physical security breaches can be devastating.
What It Tests
- Perimeter security (fences, gates, barriers)
- Access control systems (badge readers, biometrics, mantraps)
- Surveillance systems (CCTV coverage gaps)
- Reception and visitor management procedures
- Server room and data center physical access
- Sensitive document disposal (dumpster diving)
- Tailgating and social pretexting for physical entry
Cost range: EUR 8,000 - 25,000 depending on facility size and scope.
Duration: 1-3 weeks including reconnaissance and reporting.
Best for: Data centers, financial institutions, government facilities, healthcare organizations, and any entity with high-value physical assets.
Comparison Table: All 7 Types at a Glance
| Type | Primary Target | Cost (EUR) | Duration | Compliance Drivers |
|---|---|---|---|---|
| Network | Infrastructure, Active Directory | 5,000 - 20,000 | 1-3 weeks | NIS2, PCI DSS, ISO 27001 |
| Web Application | Websites, portals, SaaS | 3,000 - 18,000 | 3-10 days | PCI DSS, OWASP, NIS2 |
| Mobile Application | iOS/Android apps | 6,000 - 15,000 | 1-2 weeks | PCI DSS, HIPAA |
| API | REST/GraphQL/SOAP APIs | 5,000 - 15,000 | 1-2 weeks | PCI DSS, PSD2, NIS2 |
| Cloud | AWS/Azure/GCP environments | 10,000 - 30,000 | 1-3 weeks | NIS2, ISO 27001, SOC 2 |
| Social Engineering | Employees (human factor) | 5,000 - 15,000 | 1-4 weeks | NIS2, ISO 27001 |
| Physical | Facilities, access controls | 8,000 - 25,000 | 1-3 weeks | ISO 27001, NIS2 |
Which Types Does Your Organization Need?
The answer depends on your specific risk profile, but here are general recommendations by organization type:
SMEs (Small and Medium Enterprises)
Start with a web application pentest (if you have customer-facing applications) and a network pentest (external perimeter). Add social engineering testing annually. This covers the most common attack vectors while staying within budget.
Financial Services
Financial institutions need the most comprehensive coverage: network, web application, API, and social engineering testing at minimum. PCI DSS 4.0 and DORA mandate specific testing requirements. Cloud pentesting is essential if you use cloud-based infrastructure.
Healthcare
Network, web application, and mobile testing are priorities. Many healthcare organizations have legacy systems with known vulnerabilities. Social engineering testing is critical given the high value of medical records on the black market (averaging USD 250 per record according to Trustwave's 2025 Global Security Report).
SaaS / Technology Companies
Focus on web application, API, and cloud pentesting. These are your primary attack surfaces. Integrate pentesting into your SDLC with tests before major releases.
Manufacturing / Industrial
Beyond standard network testing, consider OT (Operational Technology) and IoT security assessments. NIS2 now covers essential entities in manufacturing, making regular penetration testing a compliance requirement.
Getting Started
The most important step is the first one. If your organization has never conducted a penetration test, begin with the test types that cover your greatest risk exposure. For most organizations, that means a combination of network and web application testing.
Orizon Fireline provides all 7 types of penetration testing with CREST-aligned methodologies, delivering comprehensive coverage tailored to your specific risk profile and compliance requirements. Our team works with you to identify the right combination of tests and prioritize based on your threat model and budget.
For a complete overview of the penetration testing process, methodology, and pricing, read our comprehensive penetration testing guide.