A penetration test typically aims to uncover security vulnerabilities in IT systems. During this process, systems are deliberately subjected to attacks with the consent of their operators. In contrast to real attack scenarios, all identified security vulnerabilities are extensively documented to enable their efficient resolution after the test.

Penetration tests are conducted on a variety of IT systems – from online shops to physical devices and complex corporate networks. We work closely with our clients to perform tests according to their individual requirements and circumstances, and adjust the test conditions as needed to allow for a holistic examination of the systems from various perspectives.

When preparing for a penetration test, clients often inquire about how much information they should disclose – a crucial question, as more extensive information typically leads to more comprehensive results. However, there is often the assumption that providing limited information, which is known as closed box or previously as black box testing, yields more realistic results. In practice, the efficiency of the penetration test could be impaired when such an approach is taken, and not disclosing the information required to find a vulnerability will not simply make it disappear.

However, the opposite extreme, a so-called open box or previously white box approach, also has its challenges. Sifting through extensive information takes time and potentially reduces the efficiency of the test. At the same time, there is a risk of inadvertently adopting the company’s internal perspective instead of the desired attacker perspective.

Therefore, we offer advise even before a pentest starts to collaboratively find an individual and balanced approach that combines the best of both worlds. This results in a grey box test, which allows for realistic attack scenarios without burdening the testing process with too many internal details. This way, the penetration test can be conducted precisely and efficiently to optimally identify and address potential vulnerabilities in the system.